COPPA, the Children's Online Privacy Protection Act, is the US law, enforced by the Federal Trade Commission, that makes websites, apps and games directed at children under 13 get verifiable parental consent before collecting their personal information. For a brand game aimed at US children, it sets what you may ask, track and keep.
How it works
Congress passed the act in 1998. The FTC's rule covers operators of sites and online services directed to children under 13, and any operator that knowingly collects personal information from a child. That term is wide: a full name or email, but also a persistent identifier that can recognise a user over time and across sites or services, a photo or voice recording, and location precise enough to name a street (FTC FAQ).
Before collecting any of it, the operator posts a privacy policy, notifies parents directly and gets consent by a method the FTC accepts, such as a signed form, a card transaction or a call with trained staff. Parents can review and delete the data (FTC six-step plan). One clause speaks to games: a child's play or prize may not depend on disclosing more personal information than the activity reasonably needs (16 CFR 312.7).
Where brands use it
COPPA took effect in April 2000 (Wikipedia), as food and drink brands built game sites for children (history of advergames). A 2006 Kaiser Family Foundation study of 77 food-brand sites with content for children found advergames on 73%; 64% urged children to email friends about a product. General Mills' Millsberry required registration for full access.
In 2003 Mrs. Fields agreed to pay a $100,000 civil penalty and Hershey $85,000. The FTC alleged Mrs. Fields' sites collected full names, home addresses, email addresses and birth dates from more than 84,000 children without parental consent, and that Hershey took no steps to ensure a parent saw or filled in its consent form (FTC). Today brands meet children in apps and on Roblox; the library tags 125 games as made for children.
When it fits
Treat COPPA as part of the brief whenever US children under 13 are the players, or a real share of them. The FTC weighs subject matter, animated characters, child-oriented incentives, music, the age of models and evidence of who actually plays (FTC FAQ).
Design for little or no data. Google's Interland needs no sign-in. An identifier used only to run the game, such as for a saved score, needs no consent if nothing else is collected; a contest may take a child's email only to say once, at the end, whether they won (FTC FAQ). A mixed-audience game can ask age neutrally and collect nothing before it. The FTC has approved six safe harbor programmes, including CARU, ESRB, kidSAFE and PRIVO; Applaydu (below) carries the kidSAFE seal.
When not to use it
COPPA is not the whole job: it covers only US children under 13, so check teen and non-US rules with counsel.
Keep sharing inside the game. The FTC says a send-to-a-friend system that lets a child reveal more than the recipient's email address and first name needs verifiable parental consent; for photos and voice, see user-generated content. Behavioural ads aren't part of running the game, so they need consent too.
Check who actually plays: WimbleWorld (below), a Roblox experience for young fans, drew 53% of its play hours from under-13s. Watch chat: in 2022 Epic Games agreed to a $275 million penalty over FTC allegations that it collected under-13 Fortnite players' data without parental consent and turned voice and text chat on by default. For lead generation, address the parents.
Examples from the library
Postopia — Post Cereals (2001)
Agency: Scient, Razorfish (2004 rebuild), Skyworks Technologies (production) · Platform: Web
Children arrived from a cereal box or TV ad, picked one of four lands and played short browser games, from races to virtual pets. Typing a Postoken, a password printed on the box, unlocked extra levels or cheats. In a 2004 Justice League tie-in a code opened a comic builder, and the finished comic could be sent to a friend or posted to the site's gallery. The portal closed in January 2011 and can't be played today.
Result: A June 2001 Nielsen survey counted 260,000 unique users aged under 12; the site was featured in more than 17 million Post cereal boxes and by 2004 drew two million unique users a month, staying up to 30 minutes a day each, according to Wikipedia.
Applaydu — Kinder (2020)
Agency: Gameloft for Brands · Platform: App
A child scans the QR code on a Kinder Surprise or Kinder Joy wrapper, and the toy appears on screen as an animated 3D character. They lead it through mini-games, place it in their room in AR and build a storybook to read with a parent. Kinder's US page lists COPPA certification, the kidSAFE seal, no ads, no in-app purchases and a parent portal with screen-time controls.
Result: More than 322 million game sessions since launch, 113 million of them in 2023–2024, at 14.3 minutes on average, and more than 68 million families reached since 2021, according to a case study in The Drum.
WimbleWorld — Wimbledon (2022)
Agency: The Gang · Platform: Roblox
Players land on a recreation of the Wimbledon grounds, where an Andy Murray avatar teaches the basics, then play singles against the AI or other players for Wimble Bux coins. Coins buy Wimbledon x Ralph Lauren gear in a branded shop, and hidden-item hunts and lawn-care mini-games fill the map. The brief aimed at Gen Z and Gen Alpha. It is still playable on Roblox as Wimbledon: Tennis Showdown.
Result: 15.3 million visits and a 10-minute average dwell time; players under 13 accounted for 53% of hours played and 55% of sessions and new users, according to The Gang.
FAQ
Does COPPA still exist?
Yes, and it has been tightened. The amended rule took effect on 23 June 2025, and operators had to comply by 22 April 2026 (Federal Register). It adds biometric identifiers to personal information and requires separate parental consent before a child's data goes to third parties for targeted advertising or other purposes (FTC).
Does COPPA apply to brands outside the US?
It applies to any site or service directed to children in the US, wherever the company is based, the FTC says. Other markets have their own rules: the UK's Children's code sets 15 standards for online services, including games, likely to be accessed by children. Check with counsel in each market.