COPPA for pediatric practice websites and apps

A pediatric practice website is written for parents, and that keeps it outside the children’s privacy rule in the ordinary case. The trouble starts at the edges: a kids corner with games, a brushing timer app with a cartoon mascot, a coloring contest, a portal login a 10 year old can use on their own, or an ad pixel that fires on a page built for children. Each of those can bring the FTC’s Children’s Online Privacy Protection Rule into play, and the rule was rewritten in 2025.

This guide covers the amended rule in depth for practice owners. For the wider picture of marketing to families, start with our pediatric practice marketing guide, which gives the short version of COPPA. For dental and orthodontic offices, see our pediatric dentist marketing guide and our orthodontist marketing guide. For tags and pixels on any health website, see our tracking pixels guide. For how the under 13 line plays out on a social platform, see our guide to Snapchat ads for medical practices.

This is general information, not legal advice. Sources cited were checked on October 30, 2026: the FTC final rule amending the COPPA Rule, 90 FR 16918 (Federal Register, April 22, 2025), 16 CFR part 312 and 16 CFR 1.98 (eCFR), 15 U.S.C. 6501 to 6506 and 45 CFR 164.502(g). State privacy laws for minors differ from state to state and change. Have a privacy attorney review any page, app or form aimed at children before launch.

The amended rule and its dates

The FTC published the amended COPPA Rule in the Federal Register on April 22, 2025, at 90 FR 16918. The dates are set out at the top of that notice:

Effective date: June 23, 2025.
Compliance date: April 22, 2026 for regulated entities, except for three provisions on FTC-approved safe harbor programs, 312.11(d)(1), (d)(4) and (g), which had their own dates.
During the 365 days after publication, the FTC said operators could follow either the pre-2025 rule or the revised rule for the provisions without an earlier date (90 FR 16971).

Both dates have now passed, so the amended text in 16 CFR part 312 is the rule to plan against. Older guides and vendor checklists written against the 2013 version of the rule miss the changes below. The FTC also said in the notice that it was not finalizing the proposed provisions on schools and education technology, to avoid conflict with possible changes to the Department of Education’s FERPA regulations (90 FR 16918). A school-based program should get its own legal review.

Does COPPA reach your practice?

Under 16 CFR 312.3, the rule applies to an operator of a website or online service directed to children, and to an operator with actual knowledge that it is collecting or maintaining personal information from a child. A child is an individual under the age of 13 (312.2).

A site or a portion of a site is directed to children when it is targeted to children. Under 312.2, the FTC looks at subject matter, visual content, use of animated characters or child-oriented activities and incentives, music or other audio content, age of models, child celebrities, language, and whether advertising on or for the site is directed to children. It also weighs evidence about the audience, including marketing plans, representations to consumers or third parties, user reviews and the age of users on similar services. A link to a children’s site does not by itself make your site directed to children (312.2, paragraph 4 of that definition).

Low risk: service pages, provider bios, insurance and new patient information written for parents.
Look closer: a kids corner with games, coloring pages, cartoon mascots or videos made for children.
Look closer: a mobile app, timer or reward chart a child uses directly, even if the parent installs it.
Look closer: a contest, birthday club or pen pal style feature that a child fills in.
Look closer: a portal or messaging feature where a child under 13 can log in or write on their own.

The rule also has a mixed audience category in 312.2: a site that is directed to children under the factors above but does not target children as its primary audience. Such a site may ask for age in a neutral way before collecting personal information, and it is not treated as directed to children for a visitor who is not identified as under 13. The age question must not default to a set age or encourage visitors to give a false age.

Two other points in the definitions matter for a practice. Personal information collected by a vendor on your behalf counts as collected by you, and so does information a third party collects directly from your users where you benefit from allowing it (312.2, operator). The operator definition does not include a nonprofit entity that would otherwise be exempt from section 5 of the FTC Act, a question for counsel if your clinic is a nonprofit.

What counts as personal information

Under 312.2, personal information is individually identifiable information about an individual collected online, including:

First and last name, home or other physical address, and online contact information such as an email address.
A screen or user name where it works as online contact information, and a telephone number.
A government-issued identifier, such as a Social Security, state ID, birth certificate or passport number. The amended rule lists these by name.
A persistent identifier that can be used to recognize a user over time and across different websites or online services, such as a customer number held in a cookie, an IP address or a device identifier.
A photo, video or audio file that contains a child’s image or voice.
Geolocation sufficient to identify a street name and a city or town.
A biometric identifier that can be used for automated or semi-automated recognition, such as fingerprints, retina or iris patterns, genetic data, voiceprints, gait patterns, facial templates or faceprints. This is new in the amended rule.
Information about the child or the parents that is collected from the child and combined with any identifier above.

Collection includes passive tracking of a child online (312.2). That is why the analytics and ad tags on a kids page matter as much as the forms.

Trackers, pixels and ads on pages for children

A cookie ID or IP address is personal information under the rule. Under 312.5(c)(7), an operator may collect a persistent identifier without parental consent when it collects no other personal information and uses the identifier only to support the internal operations of the site or service. Under 312.2, support for internal operations covers activities such as keeping the site working and analyzing its functioning, network communications, authentication, personalizing content, serving contextual advertising or capping ad frequency, security, and legal compliance. The same definition says that information collected for those purposes cannot be used or disclosed to contact a specific individual, including through behavioral advertising, or to build a profile on a specific individual.

When you rely on that exception, the online notice must name the specific internal operations and the means you use to keep the identifier from being used for behavioral advertising or profiling (312.4(d)(3)).

Use: no advertising pixels, retargeting tags or session replay on pages directed to children.
Use: a written list of each tag that loads on those pages, what it does and who receives the data.
Use: a vendor setting or contract term that limits the data to internal operations, kept on file.
Avoid: building retargeting audiences from visitors to a kids corner or a children’s app.
Avoid: assuming a tag manager or plugin default is set for a children’s audience.

For how pixels interact with HIPAA on the rest of your site, see our tracking pixels guide and our cookie consent banner guide.

Separate consent before sharing with third parties

This is the change in the amended rule with the largest effect on marketing. Under 312.5(a)(2), an operator must give the parent the option to consent to the collection and use of the child’s personal information without consenting to disclosure to third parties, unless the disclosure is integral to the website or online service. Where that option is required, the operator must obtain separate verifiable parental consent to the disclosure.

In the notice, the FTC agreed with commenters that a separate consent requirement for non-integral disclosures to third parties, such as for third-party advertising, gives parents a more deliberate and meaningful choice (90 FR 16948). The direct notice to the parent must now name the identities or specific categories of third parties and the purposes for the disclosure, and must say that the parent can consent to collection and use without consenting to disclosure (312.4(c)(1)(iv)).

For a practice, the plain reading is this: an app or kids page that shares children’s data with an ad network, a data broker or a marketing platform needs a second, separate consent from the parent for that sharing, and the parent must be able to consent to collection and use without it. Simpler still is not to share it.

How parental consent can be obtained

Under 312.5(b)(1), any consent method must be reasonably calculated, in light of available technology, to ensure that the person consenting is the child’s parent. The rule lists methods that meet that test in 312.5(b)(2):

A signed consent form returned by postal mail, fax or electronic scan.
A credit card, debit card or other online payment system used in connection with a transaction, that notifies the primary account holder of each transaction.
A call to a toll-free number staffed by trained personnel, or a video call with trained personnel.
Checking a government-issued ID against databases, with the ID deleted promptly after verification.
Knowledge-based authentication with dynamic multiple-choice questions that a child age 12 or younger in the household could not reasonably answer.
A government-issued photo ID compared with a live image of the parent by facial recognition and confirmed by trained personnel, with both deleted promptly after the match.
Email or text message plus an additional step, such as a confirming message or a follow-up letter or call, but only for an operator that does not disclose children’s personal information, and with notice that the parent can revoke the consent.

A front desk can play a part here. A parent who signs a consent form in the office for a practice app is using the first method on the list, as long as the form and the direct notice contain what 312.4(c) requires.

Exceptions a practice website may use

Under 312.5(c), some limited collection needs no prior parental consent. The ones that fit a practice site are these:

Collecting a parent’s or child’s name or online contact information only to send the direct notice and ask for consent. If consent does not come within a reasonable time, the information must be deleted (312.5(c)(1)).
Collecting a child’s online contact information to answer a single specific request once, with no re-contact, no disclosure and prompt deletion afterward (312.5(c)(3)).
Collecting a child’s and a parent’s online contact information to answer a specific request more than once, such as a newsletter, with notice to the parent and no other use (312.5(c)(4)).
A persistent identifier used only for internal operations, with the notice described above (312.5(c)(7)).

A symptom question, an appointment request or a photo upload from a child is not a good fit for these exceptions. Route those to a parent-facing form instead.

The two notices you need

Under 312.4(b), the operator must make reasonable efforts to get a direct notice to the parent before collecting, using or disclosing the child’s information. Under 312.4(c)(1), the direct notice for consent must say what information you will collect, how you will use it, which third parties or categories of third parties receive it and why, that the parent can refuse third-party disclosure while allowing collection and use, a link to the online notice, how to give consent, and that contact details collected to ask for consent will be deleted if the parent does not respond.

Under 312.4(d), you also need an online notice. A prominent, clearly labeled link to it must appear on the home or landing page and at each area where you collect personal information from children, close to the request. A general audience site with a separate children’s area must link to it on that area’s landing page. The online notice must include:

The name, address, telephone number and email address of each operator collecting or maintaining children’s information, or one contact who answers for all of them while all are named.
What you collect from children, how you use it, your disclosure practices including the identities or specific categories of third parties and the purposes, and your data retention policy.
Where you rely on the internal operations exception, the specific operations and how you keep the identifier from being used for behavioral advertising or profiling.
Where it applies, that the parent can review or have deleted the child’s information and refuse further collection or use, and how to do so.

Your general practice website privacy policy can link to this notice, but the children’s notice must be complete on its own and contain no unrelated, confusing or contradictory material (312.4(a)).

A written information security program

Under 312.8(a), an operator must keep reasonable procedures to protect the confidentiality, security and integrity of children’s personal information. The amended rule adds a floor in 312.8(b): a written information security program with safeguards suited to the sensitivity of the information and to the operator’s size, complexity and activities. The operator must:

Designate one or more employees to coordinate the program.
Identify risks to children’s information and, at least annually, assess them and the safeguards in place.
Design and maintain safeguards based on the volume and sensitivity of the information and the likelihood of harm.
Regularly test and monitor those safeguards.
At least annually, evaluate and update the program.

Under 312.8(c), before letting another operator, a service provider or a third party collect or keep children’s information for you, or before releasing it to them, you must take reasonable steps to confirm that they can protect it and obtain written assurances that they will. For an app developer, a form tool or a hosting company, that means a contract clause and a short file note on why you chose them.

A written data retention policy

Under 312.10, children’s personal information may be kept only as long as reasonably necessary for the specific purpose it was collected for, and may not be kept indefinitely. When it is no longer needed, it must be deleted with reasonable measures against unauthorized access during deletion. At a minimum, the operator must keep a written data retention policy that states the purposes for which children’s information is collected, the business need for keeping it and a timeframe for deleting it, and must include that policy in the online notice.

Keep the two kinds of records apart in your planning. Medical record retention is a separate question for counsel under state law. The retention policy here covers what a kids page, app or contest collects online, such as a nickname, a drawing upload or a device ID.

Parent rights and contests

Under 312.6, a parent who asks must get a description of the types of information collected from the child, a way to review the information, and the chance to refuse further use or collection and to have it deleted, through a process that confirms the requester is the parent and is not unduly burdensome. Under 312.7, you may not make a child’s participation in a game, prize or other activity depend on the child giving more personal information than is reasonably necessary for it. If you plan a coloring contest or a no-cavity club, read this with our giveaway and sweepstakes rules guide, and keep the entry with the parent.

COPPA and HIPAA together

The sections of 16 CFR part 312 cited in this guide do not exempt HIPAA covered entities, so a pediatric practice that runs an app or a children’s area can face both rules. They answer different questions. COPPA governs what an operator collects online from a child under 13 and what the parent must be told and agree to. HIPAA governs protected health information held by the practice.

On the HIPAA side, 45 CFR 164.502(g) tells a covered entity to treat a personal representative as the individual. For an unemancipated minor, a parent, guardian or other person acting in place of a parent who has authority under applicable law to make health care decisions for the child is generally the personal representative, with exceptions in 164.502(g)(3), for example where state or other law lets the minor consent to the care. A portal that is safe under COPPA can still give a parent access that HIPAA or state law does not allow, so set portal proxy rules with both in mind.

Teens and state laws

COPPA’s definition of a child stops at under 13 (312.2). Orthodontic, sports medicine and adolescent practices see patients who are 13 and older, who fall outside that definition. State privacy and consumer health data laws may set their own rules for minors and for health data. Check the laws of each state where you have patients, and see our consumer health data privacy laws guide for the health data side. For confidential services that teens can consent to on their own, see our guide to marketing confidential health services to teens.

Enforcement

Under 312.9, a violation of the rule is treated as a violation of an FTC rule on unfair or deceptive acts or practices. Under 15 U.S.C. 6504, a state attorney general may bring a civil action in federal court on behalf of state residents to stop a practice that violates the rule and to enforce compliance. The FTC’s inflation-adjusted civil penalty under 15 U.S.C. 45(m)(1)(A) is listed in 16 CFR 1.98(d) as 53,088 dollars per violation, as checked on the date above.

Notes by specialty

Pediatrics: keep health questions, symptom checkers and appointment requests on parent-facing forms. A kids corner should be content only, with no tags beyond internal operations.
Pediatric dentistry: brushing timer apps, reward charts and no-cavity clubs are where children enter information. Name the app operator in the notice and keep ad SDKs out.
Orthodontics: early treatment patients can be under 13 while teen and adult patients are older. Build any app with an age question that does not default to a set age.
Pediatric therapy and behavioral health: progress games or home exercise apps used by the child need consent from the parent and a written retention timeframe for each data type.
Practices with school programs: the amended rule did not finalize the school authorization provisions, so get counsel before collecting through a school. Our school-based health center marketing guide covers the FERPA and HIPAA side.

An illustration

This example is invented to show the reasoning. It does not describe a real practice.

[Practice name], a pediatric dental office, planned a brushing app for children: a two-minute timer with a cartoon tooth, a sticker reward for each day, a prompt for the child to enter a first name and upload a selfie with their new toothbrush, and an advertising SDK that the app builder included by default. Read against the amended rule, the app is directed to children, the first name and the selfie are personal information, and the advertising SDK discloses a persistent identifier to a third party for purposes beyond internal operations.

The revised plan removed the advertising SDK and the selfie. The name field became optional and stays on the device. The app now asks for a parent’s email only to send a direct notice and get consent before any account is created, with the consent confirmed by a follow-up message because nothing is disclosed to third parties. The office wrote a one-page information security program naming the office manager as coordinator, a retention policy that deletes inactive accounts after a stated period, and added both to the children’s privacy notice linked from the app’s start screen. Counsel reviewed it before release.

Checklist

List each page, app and form that a child under 13 could use, and score it against the factors in 312.2.
Remove ad pixels, retargeting tags and ad SDKs from anything directed to children.
Write the children’s online notice with all of the items in 312.4(d), and link it from the landing page and each collection point.
Write the direct notice to parents with all of the items in 312.4(c)(1).
Choose a consent method from 312.5(b)(2), and get separate consent for any non-integral third-party disclosure.
Write the information security program under 312.8(b) and name its coordinator.
Get written assurances from each vendor that handles children’s information (312.8(c)).
Write the data retention policy under 312.10 with a deletion timeframe, and put it in the online notice.
Set up a parent request process for review and deletion under 312.6.
Have a privacy attorney review the plan before launch, and recheck it each year.

How we help

We build websites, local search, Google Ads and lead generation and AI front desk tools for independent practices and health businesses. For pediatric sites, that means pages written for parents, parent-facing forms, an inventory of each tag on the site, and kids content kept free of advertising tags, ready for your attorney to review. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules hub.

Does COPPA apply to a pediatric practice website?

Not in the ordinary case, if the site is written for parents and does not knowingly collect information from children under 13. It can apply to a portion of the site or an app that is directed to children under the factors in 16 CFR 312.2, or where you have actual knowledge you collect from a child.

When did the amended COPPA Rule take effect?

The FTC published it on April 22, 2025 (90 FR 16918). It took effect June 23, 2025, and regulated entities had until April 22, 2026 to comply, except for three safe harbor provisions with their own dates.

What are the main changes in the amended rule?

Separate parental consent before non-integral disclosure to third parties such as advertisers (312.5(a)(2)), a written information security program (312.8(b)), a written data retention policy shown in the online notice (312.10), and biometric and government identifiers added to personal information (312.2).

Can we use analytics on a kids page?

Only within the internal operations exception in 312.5(c)(7): a persistent identifier with no other personal information, used only to support internal operations, with the notice in 312.4(d)(3). It cannot be used for behavioral advertising or profiling.

Can a parent sign COPPA consent at the front desk?

Yes. A consent form signed by the parent and returned is the first method listed in 312.5(b)(2), as long as the parent received a direct notice with the content in 312.4(c)(1).

Does HIPAA replace COPPA for a practice?

No. The sections of part 312 cited here do not exempt HIPAA covered entities. COPPA covers online collection from children under 13, and HIPAA covers the practice’s protected health information, so an app or kids area can need both.

COPPA for pediatric practice websites and apps: the amended 2025 rule