COPPA Compliance for Online Games: The 2026 Rules, Explained

COPPA Compliance for Online Games: The 2026 Rules, Explained

Honesty note: I’m not a lawyer; this is a plain-language reading of the FTC’s COPPA Rule (16 C.F.R. Part 312) as of 2026, aimed at indie game developers. My game (Merge Fish 2048) is casual and all-ages: no accounts, no email, no chat, no third-party data — and this article explains exactly why that design keeps COPPA exposure minimal.

TL;DR

1. The amended COPPA Rule is now fully enforced (deadline passed April 22, 2026) — the biggest COPPA change since 2013. Compliance isn’t “something to do later”; it’s the current law.
2. COPPA applies if you’re directed to kids under 13 or have actual knowledge you’re collecting personal info from a child. Casual games with no accounts/chat/email are the lowest-risk category — but portals and ad SDKs change the picture.
3. The core requirement: verifiable parental consent (VPC) before collecting any personal information from a child under 13. No opt-out, no retroactive notice, no implied consent. And the 2025 amendments add: separate VPC for third-party disclosure (including targeted advertising) — one general consent no longer covers it.
4. What changed in the amendments (in force): biometric identifiers now count as personal information; third-party disclosures need separate consent; and the FTC explicitly supports age-verification technologies (Feb 2026 policy statement — age-verification-only data collection won’t be prosecuted). Penalties: up to $53,088 per violation (June 2026 figure).

Does COPPA apply to your game?

Two triggers (FTC):

1. “Directed to children” — the service is aimed at kids under 13 (kid content, cartoons, child-oriented design, etc.). A casual merge game with no child-targeted content/design is generally not directed to children.
2. “Actual knowledge” — you know (or should know) you’re collecting personal information from a child. If a user tells you they’re 8, COPPA applies to that collection.

The nuance for web games: the game itself may be fine, but what your SDK and ad providers collect (ad IDs, device identifiers for targeting) can be personal information — and if your audience includes under-13s, the operator obligations can attach through the stack. This is why portals like CrazyGames/Poki run their own age-gated SDKs and ad systems (the submission reality).

What “personal information” means (2026)

The Rule’s definition includes: name, contact info, identifiers (persistent device identifiers, IP, cookies used for tracking), screen names, photos/videos containing the child, geolocation, and now (2025 amendments) biometric identifiers. Local-only data (a localStorage save on the player’s own device, never transmitted) is not “collected” in the COPPA sense — that’s a design that minimizes exposure.

The compliance core: verifiable parental consent

If COPPA applies to a collection, before collecting you must:

• Give direct notice to parents (what’s collected, why, who it’s shared with).
• Obtain verifiable parental consent (VPC) — affirmative and verifiable (signed form, payment method, ID verification, etc.), obtained before collection begins.
• Honor parental access/deletion rights.
• Keep the data secure and delete under-13 data when no longer needed (retention policy).

2025 amendment that matters most: one general consent no longer covers third-party disclosure. Disclosing a child’s personal info to third parties — including for targeted advertising — now requires separate VPC. For an ad-driven web game, that’s the practical crux: targeted ads to under-13 users are effectively off the table without heavy machinery, which is why portals handle it with age gates and their own ad policies.

What the amendments added (2026 in force)

What a $0-budget casual game should actually do

Honest, practical tiers:

Tier 1 — design it out (cheapest):

• No accounts, no email collection, no chat, no player-to-player messaging.
• No third-party personal info flow: portal SDKs handle age gates and ads themselves (SDK comparison).
• Keep saves local (localStorage, never transmitted — our save pattern).

Tier 2 — if you add anything that collects:

• Add an age gate / age verification at entry (FTC now incentivizes this).
• Route under-13 users away from anything that collects or from targeted ads.
• Update your privacy policy to state the under-13 policy explicitly (our template, which covers this).
• Document a retention/deletion path for any under-13 data you might hold.

Tier 3 — if your game is genuinely directed to children:

• You need real VPC machinery, a dedicated COPPA-compliant flow, and legal review. This is beyond a tutorial — budget for it or avoid the child-directed design.

Pitfalls

1. “My game is free so COPPA doesn’t apply” — free vs paid is irrelevant; it’s directed-to-children and collection that trigger the Rule.
2. Ignoring the SDK layer — your ad/analytics SDK collecting device identifiers is collection; the operator duty can run through your stack.
3. One consent for everything — post-2025, third-party disclosure needs separate VPC; “we asked once” doesn’t cover targeted ads.
4. Saving personal info locally and calling it safe — local is safer, but anything you transmit (telemetry with IDs, cloud saves with emails) is collection.
5. No retention plan — holding under-13 data “just in case” violates the data-minimization/retention requirement.

Bottom line

The amended COPPA Rule is fully enforced as of April 22, 2026: verifiable parental consent before any under-13 personal-information collection, separate consent for third-party disclosure, biometrics now included, and penalties up to $53,088 per violation. For a casual, all-ages web game, the practical answer is design it out: no accounts/email/chat, local-only saves, portal SDKs for age gates and ads, and an explicit under-13 policy in your privacy notice. That’s what my game does (privacy policy template) — the cheapest compliance is the compliance you never need to exercise.