Skip to content

COPPA's Gray Areas: One Law, Five Interpretations

I build products for a living; I'm not a lawyer. What follows is my experience and my opinion, not legal advice.

You're building a smartwatch so a parent can find their kid and call them on the walk home. Somewhere in that flow, your app asks a mapping provider to turn a Wi-Fi signal into a location. To that provider's servers, it's just another request from a paying customer. It doesn't know there's an eight-year-old on the other end.

You do.

That gap (the operator knows the data is a child's; the vendor doesn't) is where the Children's Online Privacy Protection Act stops being a statute and starts being a judgment call. People talk about COPPA like it's a checklist. After years of shipping connected products for families, here's the honest version: it's one law, and if you ask five lawyers how it applies to your product, you can get five answers. These are the five places that happens.

First, the two doors

COPPA reaches you through one of two doors (15 U.S.C. § 6502 (opens in a new tab); 16 CFR § 312.3 (opens in a new tab)): your service is "directed to children" under 13, or you have "actual knowledge" that you're collecting a child's personal information. Both sound crisp. Neither is.

Gray area 1: "directed to children," or to their parents?

Whether something is "directed to children" is decided by a totality-of-the-circumstances test: subject matter, visuals, characters, the age of your models, whether the ads target kids, who actually shows up (16 CFR § 312.2 (opens in a new tab)). No bright line, on purpose.

Here's where I land, and where I've watched whole rooms disagree: a parent-tracking app isn't something a child sets up for themselves. The account holder is an adult. The consent is the parent's. The product is directed to a parent, about a child. To me, that's a different thing than a cartoon game built to keep a seven-year-old tapping.

But "to me" is doing a lot of work there, because the standard is a judgment, and risk appetite, not the text, usually decides. And one company made sure that judgment has teeth. Buried in Google's Maps Platform terms, in the General Restrictions (§ 3.2.1 (opens in a new tab)), is a line saying you "will not … [use the Services] in a Customer Application that would be deemed to be a 'Website or online service directed to children' under the Children's Online Privacy Protection Act (COPPA)." Read it twice. Google took COPPA's fuzziest phrase, dropped it into a contract, and handed the call to you. And Google Maps is hard to walk away from, not because it's objectively "the best" (other providers give you more customization and control), but because it's the one parents and caregivers already recognize, and in the U.S. its maps and Wi-Fi-based location data are about as rich as the market gets. So "are we directed to children?" stops being only a regulatory question and becomes a product one: answer it wrong and you lose the maps they expect to see.

Gray area 2: "actual knowledge" is a tripwire, not a setting

The second door is narrower and sneakier. You don't have to investigate your users' ages, but the moment you learn a specific user is under 13 (a parent emails you; a support ticket mentions a grade), you're "held to have acquired actual knowledge," and COPPA switches on. And you can't dodge it by choosing not to look: the FTC's position is that willful blindness already counts as knowledge (it leans on Global-Tech Appliances, Inc. v. SEB S.A., 563 U.S. 754 (opens in a new tab)).

This is the by-proxy problem again. The mapping vendor can honestly say it didn't know. You can't. Your analytics, your marketing, your own roadmap make it obvious there are kids on the platform. The knowledge is yours, so the obligation is yours, regardless of what the vendor's servers "think."

Gray area 3: the anonymization myth

So you do the natural engineer thing: strip the identifiers. No name, no device ID, just coordinates. Anonymous, right?

No. COPPA's definition of "personal information" is a list, and each item counts on its own, including "geolocation information sufficient to identify street name and name of a city or town" (16 CFR § 312.2 (opens in a new tab)). Precise location is the personal information. It was never the name that made it sensitive; it's that you can tell where a specific child is. Stripping the name removes something COPPA never required in the first place. "We anonymized it" is not a defense.

Gray area 4: "collection" vs. data you never keep, and why your vendor is a compliance control

If you can't anonymize your way out, the only lever left is not collecting it, or making sure nobody downstream keeps it. That turns a tooling decision into a privacy decision.

In practice: route everything through one tenant-level key so the provider sees your service, not a stream of identifiable kids; carry no persistent per-child identifier; and pick a provider that will contractually turn telemetry off and drop the event fast: say, within 24 to 48 hours, enough to debug an issue and no longer. The two that have actually supported this for us are Mapbox and HERE. Mapbox documents a telemetry opt-out (opens in a new tab) (it even requires apps to offer one) and anonymizes location telemetry by "clipping traces" (opens in a new tab); HERE runs a B2B location business (opens in a new tab) and ships an "Anonymizer" (opens in a new tab) for exactly this.

Here's the part nobody tells the small team, though: the real kid-grade controls (telemetry fully off, custom endpoints) came through an enterprise agreement. The out-of-the-box settings get you partway; the rest you negotiate, and you only get to negotiate if you're a big enough customer. So the most privacy-protective path is, quietly, the one most available to companies that can afford it. Strange outcome for a law meant to protect every kid equally.

There's a rung above even that. Mapbox sells a fully self-hosted version, Atlas (opens in a new tab), that you run inside your own firewall, air-gapped if you want, so the location data never leaves your infrastructure at all. Total control over what you collect and keep. It's also the priciest option, built for governments and banks, and it only pencils out at a certain scale. Which is the whole pattern in one product: the more control you want over a child's data, the more you pay, and the fewer companies can afford it.

So here's a question I keep circling, and it's bigger than maps: should providers simply offer a COPPA-ready option? They already ship FISMA, SOC 2, and GDPR modes: "children's data, minimized by default" could be one more line on the menu. And it would matter far beyond location: even something as ordinary as a weather feature in a kids' app calls a third-party service that may quietly log where that child is. Today, building any of it responsibly is on you to negotiate, vendor by vendor. It doesn't have to be.

And the question underneath all of it is still open: if a provider receives a location, never ties it to a child, and deletes it within a day, was it ever "collected"? COPPA covers "collecting or maintaining" a child's information (16 CFR § 312.3 (opens in a new tab)), and the 2025 Rule update (opens in a new tab) tightened the data-retention rules (§ 312.10 (opens in a new tab)), yet reasonable attorneys still split on where transient, dropped data falls.

Gray area 5: it's not one law, it's a moving patchwork

COPPA is the floor, not the whole building. Then came California's CCPA, then CPRA, and now a growing stack of state laws that don't agree with each other and have no federal referee. Texas passed an App Store Accountability Act (SB 2420 (opens in a new tab)) that pushes age-verification and parental-consent duties onto Apple and Google and compliance obligations onto individual developers, too; current status and litigation on my Texas children's privacy laws page; Utah did its own version (opens in a new tab) with different dates (tracked on the Utah page). Apple and Google have shipped APIs to cope (Apple's Declared Age Range (opens in a new tab), Google's Play Age Signals (opens in a new tab)), and their app-store developer policies keep shifting under you. None of those are laws you wrote, and all of them are rules you have to follow.

So "ship a feature" now quietly means "ship a feature, after legal, privacy, product, and engineering have all asked: how is this data used, how long do we keep it, can anyone tie it to a person, and which state's rule governs this week?" Privacy stopped being a line item and became its own budget, and a simple feature can cost an extra sprint or two while you build around the requirement and then re-work the experience so it still delivers the value people came for.

The honest close

Here's the irony I keep coming back to. Every one of these requirements makes the parent's experience heavier: more permission prompts, more consent screens, more legalese at setup. Which raises the question nobody wants to ask: does anyone actually read it? The more boxes we make people check, the less any single box means. We may be building consent theater that protects no one.

To be clear: I'm for this. The intent behind COPPA is right, Apple has done genuinely good work making privacy legible on its platforms, and kids' data should never be something you quietly monetize. My frustration isn't with the goal; it's with the gap between the goal and how it's written, and with how rarely the people drafting these rules bring in the engineers who'll have to build against them. The line I'd draw is simple enough to fit on one page. You're protecting kids when you're not advertising to them and not monetizing their data; when you secure that data like it matters (the security testing, the penetration testing, the ordinary discipline of launching a product the right way); and when the vendors you depend on aren't using a child's data to improve their own products, unless doing so genuinely benefits that child. And under all of it sits one question I keep coming back to: is this to the benefit of the child and the parent? That's the test.

Until the law says something that clear, building for kids feels like working in a sandbox someone keeps reshaping while you're in it. You build something solid; a rule, a store policy, or a vendor term shifts; it gets knocked over, so you build it again. The good teams keep building anyway. They just learn to budget for the sandbox.

Sources

(All links verified 2026-06-27.)

Views are my own and do not reflect those of my employer.

← All writing