COPPA

Children Online Privacy Protection Act - verifiable parental consent, notice, data minimization (under-13).


Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers COPPA

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for COPPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for COPPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`COPPA-312.8` Confidentiality, Security, and Integrity	Operators must establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children, implying integrity verification of the software handling that information (16 CFR 312.8)	Scan
`COPPA-312.8-SP` Capable Service Providers and Third Parties	Operators may release children's personal information only to service providers and third parties capable of maintaining its confidentiality, security, and integrity, and must obtain assurances they will do so: requiring knowledge of the supplier behind each component and service (16 CFR 312.8)	Scan
`COPPA-312.4` Notice of Information Practices	Operators must provide clear and complete notice of what information is collected from children, how it is used, and their disclosure practices, which is supported by formally identified, timestamped documentation of the collecting systems (16 CFR 312.4)	Scan
`COPPA-312.10` Retention Limits and Deletion Readiness	Children's personal information may be retained only as long as reasonably necessary and must then be securely deleted; honoring this requires knowing which systems and software components hold the data, i.e. an enumerated inventory (16 CFR 312.10)	Scan
`COPPA-312.8-VULN` Reasonable Security Procedures Against Known Flaws	Maintaining reasonable security procedures for children's data includes keeping collection systems free of known exploitable flaws, which requires the exact version of each deployed component to be recorded and checkable (16 CFR 312.8 reasonable-procedures standard)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`312.3`	Privacy Notice
`312.4`	Direct Notice to Parents
`312.5`	Verifiable Parental Consent
`312.6`	Parental Rights
`312.7`	Prohibition on Conditioning Participation
`312.8`	Confidentiality, Security, and Integrity
`312.9`	Retention and Deletion
`312.10`	Safe Harbor Programs
`312.12`	Operator Accountability

Policy templates

Written for COPPA:

COPPA Parental Consent Procedure

And 22 from the standard set, adapted to COPPA.