Privacy policy specifically addresses children's data practices
Why it matters
COPPA §312.4 and §312.4(b) require operators whose websites or services are directed to children to post a clear and prominent link to a notice describing their information practices for children. A single sentence like 'We comply with COPPA' does not satisfy this requirement — the notice must specifically describe what is collected from children, how it is used, how parents can exercise their rights, and how consent was obtained. A generic adult privacy policy with no children's section is the most common COPPA documentation gap found in AI-built apps and is independently cited in FTC complaints alongside substantive violations.
Severity rationale
Low because the documentation gap is a notice violation under §312.4 rather than an active data collection violation, but it eliminates any good-faith defense and is independently actionable by the FTC.
Remediation
Add a dedicated 'Children's Privacy (COPPA Notice)' section to your privacy policy at src/app/privacy/page.tsx or the equivalent. The section must cover all five required disclosures.
## Children's Privacy (COPPA Notice)
### Information we collect from children
With verifiable parental consent, we collect: display name, email address,
date of birth. We do not collect: real name, home address, phone number,
school name, geolocation, or any information not listed above.
### How we use children's information
Only to provide and operate the service and to communicate with the parent.
We do not use children's information for advertising.
### Parental rights
Parents may review, correct, or request deletion of their child's data by
contacting privacy@example.com with subject 'Parental Data Request.'
We respond within 5 business days after verifying parent identity.
### Consent mechanism
We use the email-plus method approved by the FTC: a direct notice to the
parent's email address, requiring the parent to click a confirmation link
before we create the child's account.
Link this section from the footer on every page and ensure it is accessible without authentication.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the COPPA Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- coppa · §312.4 — Notice to parents — detailed notice requirements for children's privacy policy content
- coppa · §312.4(b) — Content of the notice — policy must state operator identity, data collected, use, and parental rights
- gdpr · Art. 13 — Information to be provided — parallel transparency obligation for privacy policies
- nist:rev5 · PT-2 — Purpose Specification — privacy policy documents lawful purpose for data collection
Taxons
History
- 2026-04-18·v1.0.0·Initial import from coppa-compliance·automated