Requirement
COPPA applies to operators of websites or online services directed to children under 13, and to general-audience or mixed-audience services with actual knowledge that they collect personal information from a child. The operator should document whether its service is child-directed (considering subject matter, visual content, characters, audience composition and advertising) and how it screens for age where the audience is mixed.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GDPR | Art.9 | Special category data | data-classification |
| GDPR | Art.10 | Criminal convictions and offences data | data-classification |
| CCPA/CPRA | 1798.120(c)-(d) | Opt-in consent to sell or share minors' information | children |
| CCPA/CPRA | 1798.121 | Right to limit use of sensitive personal information | data-classification |
| SOC 2 | C1.1 | Identification and protection of confidential information | data-classification |
| ISO 27001 | A.5.12 | Classification of information | data-classification |
| ISO 27001 | A.8.3 | Information access restriction | data-classification |
| PCI DSS 4.0.1 | 3.4 | PAN is masked when displayed and protected from copying | data-classification |