Third parties receiving children's data contractually bound to COPPA
Why it matters
COPPA §312.8 and §312.2 hold operators responsible for third-party misuse of children's data when the operator 'discloses' that data to the third party. Sending a child's email address to SendGrid, a child's session data to Sentry, or a child's page views to Google Analytics constitutes disclosure — and the FTC treats operators as liable for what those third parties do with the data if there is no contractual obligation binding them to the same COPPA protections. GDPR Article 28 requires a Data Processing Agreement with any processor that handles EU personal data, including children's. Standard GDPR DPAs often lack COPPA-specific children's data provisions, creating a gap for US child data.
Severity rationale
Info because the violation is contractual rather than technical — the data flows already exist, and the question is whether downstream handling is covered — but COPPA §312.8 makes the operator directly liable for third-party non-compliance.
Remediation
Audit every third-party service that receives data from child sessions and take one of three actions: bind them to COPPA terms, configure their COPPA-compliant mode, or exclude child sessions from their data collection entirely.
Third-party COPPA checklist:
Google Analytics
Action: Set tfcd=1 or exclude child sessions entirely
Config: googletag.pubads().setPrivacySettings({ childDirectedTreatment: true })
Sentry (error tracking)
Action: Configure data scrubbing to exclude PII from child sessions
Docs: docs.sentry.io/data-management/sensitive-data
SendGrid / Resend / Postmark
Action: Verify DPA covers use with children's data; restrict to
transactional emails to parent addresses only
Supabase / Vercel / AWS
Action: Standard DPAs generally cover COPPA — verify current DPA
for COPPA or CIPA references explicitly
Auth0 / Clerk / Supabase Auth
Action: Confirm vendor does not use children's auth data for
their own product analytics
Add to any vendor agreement where child data may flow: 'Vendor shall not use personal information of users under 13 for any purpose other than providing the contracted service, and shall not share such information with third parties.'
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the COPPA Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- coppa · §312.8 — Confidentiality and security of personal information — operator responsible for third-party recipients of children's PI
- coppa · §312.2 — Definitions — 'operator' liability extends to third parties that receive PI under the operator's control
- gdpr · Art. 28 — Processor — data processor must provide sufficient guarantees; parallel contract requirement for child data
- iso-27001:2022 · A.5.19 — Information security in supplier relationships — contractual obligations binding third parties
Taxons
History
- 2026-04-18·v1.0.0·Initial import from coppa-compliance·automated