← COPPA · Scope

312.2-312.3 — Determine whether COPPA applies

high childrendata-classification

Requirement

COPPA applies to operators of websites or online services directed to children under 13, and to general-audience or mixed-audience services with actual knowledge that they collect personal information from a child. The operator should document whether its service is child-directed (considering subject matter, visual content, characters, audience composition and advertising) and how it screens for age where the audience is mixed.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of
childrenchildkidsunder 13under the age of 13under-13minors
Required element 2 — any one of
directed to childrenchild-directedmixed audiencegeneral audienceactual knowledgenot directednot intendedage screenage gateneutral age
Supporting terms — specificity signals
312.2312.3audience compositionunder 13age screening

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

FrameworkControlTitleShared topics
GDPR Art.9 Special category data data-classification
GDPR Art.10 Criminal convictions and offences data data-classification
CCPA/CPRA 1798.120(c)-(d) Opt-in consent to sell or share minors' information children
CCPA/CPRA 1798.121 Right to limit use of sensitive personal information data-classification
SOC 2 C1.1 Identification and protection of confidential information data-classification
ISO 27001 A.5.12 Classification of information data-classification
ISO 27001 A.8.3 Information access restriction data-classification
PCI DSS 4.0.1 3.4 PAN is masked when displayed and protected from copying data-classification