COPPA and AI Features 2026: Compliance Guide for Apps Used by Kids
Teams building for kids know COPPA governs signup fields and analytics SDKs. Far fewer have applied it to the AI tutor, the drawing assistant, or the voice helper shipped last quarter — features that collect open-ended input from children, send it to a third-party model provider, and store it forever by default.
A Prompt Box Is a Collection Point
COPPA compliance programs are usually built around structured fields — name, email, birthday, device identifiers — because those are what the intake form asks for. An AI feature inverts that model. It opens a free-text box, or a microphone, or a camera, and invites a child to supply whatever they want. Children being children, what arrives includes their full name, their school, their friends, their address, and things about their home life that no product team intended to hold.
Unstructured input is still personal information when it is associated with a child user and stored under their account. If your data map has a row for the signup form and no row for the assistant's conversation log, the map is wrong in the direction that matters most.
What the Amended Rule Changed for AI Products
- •Separate opt-in consent before disclosing children's data to third parties
- •A written, published data retention policy with a defined deletion schedule
- •No retaining children's information indefinitely or for secondary purposes
- •Direct notice that names the categories of data and who receives it
- •Security program obligations that extend to vendors and subprocessors
- •Prompts routed to an external model API with no disclosure consent step
- •Conversation history and embeddings kept forever as product memory
- •Evaluation and fine-tuning datasets built from real child sessions
- •Voice clips retained for quality review after the request is fulfilled
- •Vendor terms that permit training on customer data by default
The Model Provider Is a Third Party
Engineering treats an inference API as infrastructure, the same category as a CDN or a database host. Privacy law treats it as a recipient of personal information. When a child types into your assistant and that text leaves your systems for an external provider, you have disclosed children's personal information to a third party — which under the amended rule generally requires consent obtained separately from consent to use the service, and a parent must be able to decline the disclosure without being locked out of the product entirely. That is a product design constraint, not just a legal one: it implies a working non-AI path through your app.
Training on Kids' Data Creates an Unfixable Deletion Problem
COPPA gives parents the right to review and delete their child's information. That right is straightforward when the data sits in a row you can drop. It is close to impossible once the same data has been used to fine-tune a model, because the information no longer lives anywhere you can point at. You cannot honestly certify deletion from a set of weights.
The practical rule: children's inputs are for serving the immediate request, not for improving the product. Bar training use in your own pipeline, and get it in writing from every vendor in the path — including the default terms of whichever inference API the team wired up during the prototype and never revisited.
Mixed-Audience Products Are the Common Trap
Plenty of teams believe they are outside COPPA because the product was designed for adults or teens. Then a school district deploys it, or parent support tickets make it obvious who is typing, and actual knowledge arrives whether or not anyone documented it. The safer posture for anything plausibly attractive to children is a neutral age screen at the top of the funnel and a restricted experience for under-13 users where open-ended AI features are limited, logging is minimized, and third-party disclosure is off until a parent consents.
COPPA-for-AI Compliance Checklist
Immediate Actions
- ☐Map every AI feature that accepts text, voice, image, or video from a child
- ☐Identify which external providers receive that data and under what terms
- ☐Disable training and human review on children's data with every vendor
- ☐Delete voice recordings immediately after the request is executed
- ☐Check whether an age screen exists before any open-ended AI feature
Within the Quarter
- ☐Add a separate consent step for third-party disclosure of children's data
- ☐Publish a written retention policy and enforce deletion in the pipeline
- ☐Build a parental review and deletion path that reaches conversation logs
- ☐Purge child sessions from evaluation and fine-tuning datasets
- ☐Update direct notice to name AI data categories and recipients plainly
Frequently Asked Questions
Does COPPA apply to the AI features in our app?
If the service is child-directed or you have actual knowledge of under-13 users, yes — and AI features collect. Free-text prompts, uploads, and voice input tied to a child user are personal information, and they are usually the least-governed data in the product.
Is sending prompts to an AI vendor a third-party disclosure?
Yes. Engineering sees infrastructure; the rule sees a recipient of children's personal information. That generally requires a separate consent step, and a parent should be able to decline the disclosure while still using the app.
Can children's inputs be used for training or fine-tuning?
Treat it as prohibited without specific informed consent. Beyond the consent problem, training use makes parental deletion rights impossible to honor, because you cannot remove a child's data from model weights after the fact.
What does the retention requirement actually require?
A written policy, retention only as long as reasonably necessary for the stated purpose, and no indefinite storage. Conversation logs, embeddings, and evaluation sets all need explicit deletion schedules that someone owns.
How should we handle children's voice input?
Use the audio to execute the request and delete it immediately, with no secondary use. Retaining clips for quality review, analytics, or model improvement moves you outside the narrow allowance for voice instructions.
Our app is general audience — are we covered?
Only until you have actual knowledge of under-13 users, which arrives through support tickets, in-product signals, and school deployments. For anything plausibly attractive to kids, use a neutral age screen and a restricted under-13 experience.
Fix the Pipeline Before the Feature Ships
Every hard part of COPPA-for-AI compliance is cheap at design time and expensive afterward. Deciding not to log a child's prompts costs a config flag today; purging them from a fine-tuned model later costs a retraining run and an uncomfortable letter to parents. Set retention, disclosure consent, and training bans before the feature reaches production.
Auditing what your public product exposes is the same habit applied outward. Run a free scan of your site to see what's live today.