Privacy
Available nowCOPPA · 16 CFR Part 312 (2025 amendments)
COPPA is the FTC’s Children’s Online Privacy Protection Rule, 16 CFR Part 312. It binds any operator of a service directed to children under 13, and any operator with actual knowledge it is collecting personal information from a child — which is why it catches products that were never aimed at children. Keel models the Rule at its own designated-paragraph level: the notices, verifiable parental consent and its recognised methods and exceptions, the parent’s right to review and delete, the ban on conditioning a child’s participation on excess collection, the written children’s information security programme, and the retention-and-deletion duty. Scope (§312.1), definitions (§312.2), enforcement (§312.9), safe harbor programs (§312.11), the Commission’s own approval processes (§312.12) and severability (§312.13) are cited but not scored, because they place no implementable duty on an operator.
32
requirements tracked
Premium
Access
Add-on from $39/mo
Children’s Privacy: COPPA, Google Play Families, Amazon Appstore Child-Directed Apps, Apple App Store Kids Category are one add-on at $39/mo, bought through COPPA, and together they count as one framework against your plan’s allowance.
Scope
How much of the standard Keel models
Keel authors every leaf requirement in the scope declared below — all 32 of them, with nothing inside that scope left out. A test fails the build if the authored count and the declared count ever diverge, so this framework cannot quietly lose requirements after the fact.
- Authored in Keel
- 32 requirements
- In Keel’s scored scope
- 32 leaf requirements
Keel publishes this for every framework it ships, complete or not, so a readiness percentage can be read against a denominator you can see. Compare every framework
Who it is for
Who needs COPPA?
- App and game studios whose product is directed to children under 13
- General-audience services that have learned they collect data from children anyway
- Anyone shipping to an app store, where COPPA is the floor and the store rules sit on top
What Keel does
How Keel helps with COPPA
- Every operator duty in the Rule as a scored control, at the paragraph level rather than one line per section
- The store programmes crosswalked alongside it, so shared work is evidenced once rather than three more times
- Notice, consent, retention and security tracked with owners and evidence, not as a policy PDF
Collect once, comply everywhere
COPPA shares canonical controls with GDPR, ISO/IEC 27001 and NIST SP 800-53 and others in the catalog. Implement one of those controls and it counts toward every framework it satisfies, so adding COPPA rarely means starting from scratch.
- ISO/IEC 27001 shares canonical controls
- CIS Critical Security Controls shares canonical controls
- PCI DSS shares canonical controls
- SOC 2 shares canonical controls
- SOX (Sarbanes-Oxley) Section 404 shares canonical controls
- NIST Cybersecurity Framework shares canonical controls
- NIST SP 800-53 shares canonical controls
- NIST SP 800-171 shares canonical controls
- HIPAA shares canonical controls
- GDPR shares canonical controls
- Google Play Families shares canonical controls
- Amazon Appstore Child-Directed Apps shares canonical controls
- Apple App Store Kids Category shares canonical controls
- PIPEDA shares canonical controls
- ISO 9001 shares canonical controls
- AI Governance Essentials no shared canonical controls
- ISO/IEC 42001 shares canonical controls
- NIST AI Risk Management Framework no shared canonical controls
- EU AI Act no shared canonical controls
- ESG Essentials shares canonical controls
- US Employment Law - Federal Baseline shares canonical controls
A framework is lit when at least one canonical control satisfies both COPPA and that framework. Unlit means none of them do — an absence, not a judgment about that standard. 18 of 21 are lit here.
Other frameworks: ISO/IEC 27001 · CIS Critical Security Controls · PCI DSS · SOC 2 · SOX (Sarbanes-Oxley) Section 404 · NIST Cybersecurity Framework · All frameworks