COPPA Rule Breakdown: Key Numbers for Forum Admins
Running an online discussion space that permits younger participants requires navigating specific federal privacy standards. Under 16 CFR Part 312, the Federal Trade Commission enforces regulations established by the Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6501 through 6506). For hobbyists and webmasters structuring their community spaces, balancing general community guidelines with federal compliance is critical. Below is a structured key-numbers breakdown of the core requirements outlined in 16 CFR Part 312 for operators of websites and online services.
13: The Age Threshold Defining a Child
Under § 312.2, a child is defined specifically as an individual under the age of 13. The regulation applies directly to an operator of a commercial website or online service that targets children or knowingly handles their details. The rule specifically exempts nonprofit entities that are outside coverage under Section 5 of the Federal Trade Commission Act (15 U.S.C. 45).
If your message board qualifies as a mixed audience website or online service, § 312.2 notes that it is directed to children but does not target them as its primary audience. On such mixed audience platforms, operators cannot collect personal data from visitors prior to collecting age information or using another means reasonably calculated to determine if a visitor is under 13. Crucially, any age collection must be executed in a neutral manner that does not default to a set age or encourage visitors to falsify age information.
11: Regulated Categories of Personal Information
Section 312.2 establishes 11 distinct items that constitute individually identifiable personal information collected online:
- A first and last name.
- A home or other physical address, including street name and name of a city or town.
- Online contact information, such as an email address, instant messaging user identifier, voice over Internet Protocol (VOIP) identifier, video chat identifier, or mobile phone number used strictly for parental consent text messages.
- A screen or user name where it functions in the same manner as online contact information.
- A telephone number.
- A government-issued identifier, including a Social Security, State identification card, birth certificate, or passport number.
- A persistent identifier used to recognize a user over time and across different websites or services, such as a customer number held in a cookie, an Internet Protocol (IP) address, a processor or device serial number, or a unique device identifier.
- A photograph, video, or audio file containing a child's image or voice.
- Geolocation information sufficient to identify street name and name of a city or town.
- A biometric identifier used for automated or semi-automated recognition, such as fingerprints, handprints, retina patterns, iris patterns, genetic data (including a DNA sequence), voiceprints, gait patterns, facial templates, or faceprints.
- Information concerning the child or parents that the operator collects online and combines with any of the identifiers listed above.
3: Methods That Constitute Data Collection
Under § 312.2, the gathering of personal information from a child occurs through 3 distinct avenues:
- Requesting, prompting, or encouraging a child to submit personal details online.
- Enabling a child to make personal information publicly available in identifiable form, including public postings on message boards, chat rooms, pen pal services, or personal home pages.
- Passive tracking of a child online.
For forum software administrators, the public posting definition is especially notable. An operator is not considered to have collected personal information through public postings if reasonable measures are taken to delete all or virtually all personal details from a child's postings before they are made public, while also deleting that information from system records.
2: Core Mandates for Verifiable Consent
When obtaining verifiable consent before gathering information, § 312.2 requires an operator to make reasonable efforts, in light of available technology, to ensure a parent meets 2 conditions:
- Receives direct notice of the operator's personal information collection, use, and disclosure practices.
- Authorizes the collection, use, or disclosure of that personal information.
Consent requirements interact with internal operational activities. Section 312.2 allows data processing to support internal operations without full third-party release rules, covering activities like network communications, user authentication, content personalization, contextual advertising, security protection, or regulatory compliance. However, information collected for internal operations cannot be used to contact an individual, run behavioral advertising, or amass a profile.
13: Operational Sections Governed by the Rule
The regulatory text within eCFR :: 16 CFR Part 312 is divided across 13 numbered sections (§ 312.1 through § 312.13). These sections dictate scope (§ 312.1), notice standards (§ 312.4), parental consent rules (§ 312.5), parental review rights (§ 312.6), and conditioning prohibitions (§ 312.7). They further mandate confidentiality and security programs (§ 312.8), set enforcement policies (§ 312.9), establish data retention and deletion rules (§ 312.10), authorize safe harbor programs (§ 312.11), outline voluntary Commission approval processes (§ 312.12), and specify severability (§ 312.13). Understanding how these 13 sections interact helps community owners design appropriate registration flows, evaluate forum privacy considerations, and maintain regulatory compliance.
Sources
eCFR :: 16 CFR Part 312 -- Children's Online Privacy Protection Rule (Coppa Rule)
Published October 28, 2026. No affiliate links on this page. Facts come from the sources linked above; check them for updates.