Kids' Privacy and AI Tools: What COPPA Means for You

Run a tutoring service, a kids' class, a summer camp, or an online shop for children? Online forms, apps, and AI chat tools can make life easier. When kids under 13 are involved, there's a rule to know about. Here's a plain-English starting point from the Federal Trade Commission's (FTC) official pages, checked on Oct 28, 2026.

The basics: COPPA, the Children's Online Privacy Protection Rule, puts parents in control of personal information collected online from kids under 13. The FTC enforces it.

Who it covers, per the FTC: you need to comply if any of these apply:

• Your website or online service is directed to children under 13, and you collect personal information from them.
• It's directed to kids under 13, and you let others collect personal information from them.
• It's for a general audience, but you have actual knowledge that you collect personal information from kids under 13.

The FTC's six steps: 1. Decide if COPPA covers your website or online service. 2. Post a privacy policy that meets COPPA's requirements. 3. Notify parents directly before collecting personal information from their kids. 4. Get parents' verifiable consent before collecting it. 5. Honor parents' ongoing rights about their kids' information. 6. Protect kids' information with reasonable security, and have retention and deletion procedures.

The 2025 updates: the FTC amended the rule in April 2025. The amended rule took effect June 23, 2025, and most businesses had until April 22, 2026 to comply. The FTC's summary lists changes including a new definition for mixed-audience websites and services, mobile phone numbers added to online contact information, government-issued IDs and biometric identifiers added to personal information, and updated duties for notices, security, and data retention and deletion.

Where AI tools come in (our suggestions):

• Chatbots on kids' sites: if children can type into a chatbot on your site, think about what personal information they might share, and where it goes.
• Third-party tools: the FTC's guide says your privacy notice must describe others who collect information on your site, like plug-ins.
• Parents first: build forms so parents, not kids, enter contact details.
• Keep less: don't paste kids' names or details into general AI tools when you don't need to.

A small-business example: a reading tutor builds a sign-up page for kids ages 7 to 10. Parents fill out the form, not the kids. The tutor uses AI to draft lesson plans with first names removed, keeps student notes in one secure place, and deletes old records on a schedule. (Our illustration.)

Questions to ask yourself:

• Is my website, app, or online class aimed at kids under 13?
• What information do we collect, and who else collects it through our site?
• Can parents easily see, change, or delete their child's information?
• Do any AI tools we use receive kids' information?

Want related ideas? See our tutoring materials service idea and our security and privacy lesson.

A friendly note: this lesson is a starting point for learning, not legal advice. The FTC's COPPA resources and a lawyer are great next steps for your situation.