Direct notice provided to parents before collecting children's PI
Why it matters
COPPA §312.4 and §312.4(c) require a direct notice to parents before collecting personal information from children — distinct from the privacy policy, this is a direct communication to the specific parent whose child is initiating signup. Sending the consent link to the child's email rather than a separately collected parent email address means the child is effectively approving their own account, which is not parental consent by any definition. The direct notice must also include the operator's full legal name and contact information, a description of data collected, use, third-party disclosure, and parental rights — omitting any of these is an independent §312.4 violation.
Severity rationale
Info because the violation is a notice-delivery deficiency rather than a data collection failure, but an incomplete or misdirected direct notice invalidates the consent it was meant to establish.
Remediation
Ensure the direct notice email is sent to a separately collected parent email address and includes all FTC-required disclosures. Use this structure as a template in your email service.
Subject: [App Name] — Notice to parents: your child has requested an account
This notice is required by the Children's Online Privacy Protection Act (COPPA).
[Company Legal Name]
[Company address]
privacy@example.com
A child using [child email] has requested an account and provided your email
as their parent or guardian.
WHAT WE COLLECT FROM CHILDREN
[List each data item specifically]
HOW WE USE THIS INFORMATION
[Plain-language description]
THIRD-PARTY DISCLOSURE
We do not share children's personal information with third parties for their own use.
YOUR RIGHTS AS A PARENT
You may review, correct, or request deletion of your child's data at any time
by contacting privacy@example.com.
TO APPROVE: [Consent link — expires in 7 days]
TO DECLINE: Ignore this email. No account will be created.
Full Children's Privacy Policy: [URL]
Store the parent email separately from the child email in your pendingConsentRequest record — never send the consent link to the same address the child provided for their own account.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the COPPA Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- coppa · §312.4 — Notice to parents — direct notice required; must be sent before collection; specifies required content
- coppa · §312.4(c) — Direct notice — must be sent directly to parent, not embedded in general terms
- coppa · §312.5 — Verifiable parental consent — direct notice is the prerequisite step for obtaining consent
- gdpr · Art. 8(2) — Conditions applicable to child's consent — controller makes reasonable efforts to verify consent holder is parent
Taxons
History
- 2026-04-18·v1.0.0·Initial import from coppa-compliance·automated