U.S. Code » Title 15 » Chapter CHAPTER 91— CHILDREN’S ONLINE PRIVACY PROTECTION

15 U.S.C. § 6502

Regulation of unfair and deceptive acts and practices in connection with collection and use of personal information from and about children on the Internet

Read at: OLRCuscode.house.gov CornellLII GovInfogovinfo.gov JustiaTitle 15 CasesGoogle Scholar
(a) Acts prohibited(1) In general

It is unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under subsection (b).

(2) Disclosure to parent protected

Notwithstanding paragraph (1), neither an operator of such a website or online service nor the operator’s agent shall be held to be liable under any Federal or State law for any disclosure made in good faith and following reasonable procedures in responding to a request for disclosure of personal information under subsection (b)(1)(B)(iii) to the parent of a child.

(b) Regulations(1) In generalNot later than 1 year after October 21, 1998, the Commission shall promulgate under section 553 of title 5 regulations that—(A) require the operator of any website or online service directed to children that collects personal information from children or the operator of a website or online service that has actual knowledge that it is collecting personal information from a child—(i) to provide notice on the website of what information is collected from children by the operator, how the operator uses such information, and the operator’s disclosure practices for such information; and(ii) to obtain verifiable parental consent for the collection, use, or disclosure of personal information from children;(B) require the operator to provide, upon request of a parent under this subparagraph whose child has provided personal information to that website or online service, upon proper identification of that parent, to such parent—(i) a description of the specific types of personal information collected from the child by that operator;(ii) the opportunity at any time to refuse to permit the operator’s further use or maintenance in retrievable form, or future online collection, of personal information from that child; and(iii) notwithstanding any other provision of law, a means that is reasonable under the circumstances for the parent to obtain any personal information collected from that child;(C) prohibit conditioning a child’s participation in a game, the offering of a prize, or another activity on the child disclosing more personal information than is reasonably necessary to participate in such activity; and(D) require the operator of such a website or online service to establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children.(2) When consent not requiredThe regulations shall provide that verifiable parental consent under paragraph (1)(A)(ii) is not required in the case of—(A) online contact information collected from a child that is used only to respond directly on a one-time basis to a specific request from the child and is not used to recontact the child and is not maintained in retrievable form by the operator;(B) a request for the name or online contact information of a parent or child that is used for the sole purpose of obtaining parental consent or providing notice under this section and where such information is not maintained in retrievable form by the operator if parental consent is not obtained after a reasonable time;(C) online contact information collected from a child that is used only to respond more than once directly to a specific request from the child and is not used to recontact the child beyond the scope of that request—(i) if, before any additional response after the initial response to the child, the operator uses reasonable efforts to provide a parent notice of the online contact information collected from the child, the purposes for which it is to be used, and an opportunity for the parent to request that the operator make no further use of the information and that it not be maintained in retrievable form; or(ii) without notice to the parent in such circumstances as the Commission may determine are appropriate, taking into consideration the benefits to the child of access to information and services, and risks to the security and privacy of the child, in regulations promulgated under this subsection;(D) the name of the child and online contact information (to the extent reasonably necessary to protect the safety of a child participant on the site)—(i) used only for the purpose of protecting such safety;(ii) not used to recontact the child or for any other purpose; and(iii) not disclosed on the site,if the operator uses reasonable efforts to provide a parent notice of the name and online contact information collected from the child, the purposes for which it is to be used, and an opportunity for the parent to request that the operator make no further use of the information and that it not be maintained in retrievable form; or(E) the collection, use, or dissemination of such information by the operator of such a website or online service necessary—(i) to protect the security or integrity of its website;(ii) to take precautions against liability;(iii) to respond to judicial process; or(iv) to the extent permitted under other provisions of law, to provide information to law enforcement agencies or for an investigation on a matter related to public safety.(3) Termination of service

The regulations shall permit the operator of a website or an online service to terminate service provided to a child whose parent has refused, under the regulations prescribed under paragraph (1)(B)(ii), to permit the operator’s further use or maintenance in retrievable form, or future online collection, of personal information from that child.

(c) Enforcement

Subject to sections 6503 and 6505 of this title, a violation of a regulation prescribed under subsection (a) shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 57a(a)(1)(B) of this title.

(d) Inconsistent State law

No State or local government may impose any liability for commercial activities or actions by operators in interstate or foreign commerce in connection with an activity or action described in this chapter that is inconsistent with the treatment of those activities or actions under this section.

(Pub. L. 105–277, div. C, title XIII, § 1303, Oct. 21, 1998, 112 Stat. 2681–730.)Statutory Notes and Related SubsidiariesEffective Date

For effective date of subsec. (a) of this section, see section 1308 of Pub. L. 105–277, set out as a note under section 6501 of this title.

Notes of Decisions
Cited in 18 cases (10 in the last 5 years), 2004–2026 · leading case: In Re Nickelodeon Consum. Privacy Litig., 827 F.3d 262 (3rd Cir. 2016).
Sort: Relevance Newest Treatment
In Re Nickelodeon Consum. Privacy Litig., 827 F.3d 262 (3rd Cir. 2016). · cites it 2× “15 U.S.C. § 6502 (d). 181 . Id. § 6502(b)(1)(A).”
Fed. Trade Comm'n v. Wyndham Worldwide Corp., 799 F.3d 236 (3rd Cir. 2015). “And the Children’s Online Privacy Protection Act ordered the FTC to promulgate regulations requiring children’s websites, among other things, to provide notice of “what information is collected from children ..., how the operator uses such information, and the operator’s…”
Ctr. for Digit. Democracy v. Fed. Trade Comm'n, 189 F. Supp. 3d 151 (D.D.C. 2016). · cites it 2× “15 U.S.C. § 6502 (b); Def.’s Statement of Material Facts, ECF No.”
Fraley v. Facebook, Inc., 966 F. Supp. 2d 939 (N.D. Cal. 2013). “Because COPPA expressly preempts state requirements that are “inconsistent with” this “treatment,” 15 U.S.C. § 6502 (d), it could bar any efforts by plaintiffs to use state law to impose a parental consent requirement for minors over the age of 13.”
Ex Parte Nat'l W. Life Ins. Co., 899 So. 2d 218 (Ala. 2004). “15 U.S.C. § 6502 (a)(1), (b)(1)(A). Like the GLBA, COPPA provides certain exceptions to its general prohibition on disclosure, allowing disclosure without parental consent under certain circumstances: "The regulations shall provide that verifiable parental consent under…”
Hubbard v. Google LLC (N.D. Cal. 2020). · cites it 6× “6 15 U.S.C. § 6502 (a). SAC ¶ 75. COPPA applies to any operator of a commercial website or online 7 service directed to children under thirteen years of age that collects, uses, and/or discloses personal 8 information from children.”
Hubbard v. Google LLC (N.D. Cal. 2021). · cites it 5× “20 21 15 U.S.C. § 6502 (a). TAC ¶ 72. COPPA applies to any operator of a commercial website or online 22 service directed to children under thirteen years of age that collects, uses, and/or discloses personal 23 information from children.”
Hartman v. Meta Platforms, Inc. (S.D. Ill. 2024). · cites it 5× “15 U.S.C. § 6502 (b). They also must obtain “verifiable parental consent for the collection, use, or disclosure of personal information from children.”
Cara Jones v. Google LLC (9th Cir. 2022). · cites it 3× “” 15 U.S.C. § 6502 (d). The panel held that state laws that supplement, or require the same thing, as federal law, do not stand as an obstacle to Congress’ objectives, and are not “inconsistent.”
Cara Jones v. Google LLC (9th Cir. 2023). · cites it 3× “” 15 U.S.C. § 6502 (d). The panel held that state laws that supplement, or require the same thing, as federal law, do not stand as an obstacle to Congress’s objectives, and are not “inconsistent.”
NetChoice (D. Maryland 2025). · cites it 3× “15 U.S.C. § 6502 (d). This provision allows states to create “consistent” parallel legislative schemes covering online privacy of children.”
Ridenti v. Google LLC (N.D. Cal. 2021). · cites it 2× “15 U.S.C. § 6502 . In September, 2019, the Federal Trade Commission (“the FTC”) filed a complaint against the Google Companies for knowingly collecting, using and/or disclosing the personal information of children under the age of 13 without parental consent.”
Show all 18 citing cases →
Annotations are extracted automatically from the opinions in the Syfert caselaw corpus and ranked by authority, recency, and treatment. Dots show Syfertize treatment of the citing case itself.