← COPPA · Parental consent
312.5(a)(2) — Separate consent before disclosing children's data to third parties
Requirement
Under the amended rule (compliance required from 22 April 2026), an operator must obtain separate verifiable parental consent before disclosing a child's personal information to third parties — including for targeted advertising — unless the disclosure is integral to the nature of the service; parents can consent to collection without consenting to disclosure.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GDPR | Art.8 | Conditions for a child's consent to online services | consent children |
| CCPA/CPRA | 1798.120(c)-(d) | Opt-in consent to sell or share minors' information | children consent |
| GLBA | Reg P 1016.7-1016.10 | Opt-out of sharing with nonaffiliated third parties | consent third-party |
| NDPA 2023 | s.31 | Processing the data of children and persons lacking capacity | consent children |
| GDPR | Art.6 | Lawful basis for processing | consent |
| GDPR | Art.7 | Conditions for consent | consent |
| GDPR | Art.14 | Information when data is not obtained from the data subject | third-party |
| GDPR | Art.19 | Notifying recipients of rectification, erasure or restriction | third-party |