The April 22, 2026, COPPA compliance deadline has passed, but a child’s app sign-up screen may still combine basic data collection with advertising choices (FTC rule summary).
Fastest decision: for a service covered by COPPA, assess consent to disclose a child’s personal information to third parties for targeted advertising separately from consent to collect and use information needed to run the service. Declining the ad-disclosure choice should not automatically be treated as refusing registration. An email address receives messages; it does not prove a parent’s identity or authorize advertising disclosures.
Who this is for: Parents and guardians registering a child under 13 for a game, learning service, or interest app that presents advertising or data-sharing choices.
It also helps parents sorting an app’s authorization email from an ordinary address or login verification message.
Family members managing sign-ups can use it to decide which requests belong at a long-term address.
Last updated November 4, 2026; rule dates and requirements checked against the FTC’s COPPA FAQ, its parent guidance, and the Federal Register final rule. This is a practical reading of the U.S. rule, not legal advice.
Start with the screen, not the checkbox
The COPPA rule is not a blanket rule for every app that a child might use. It applies to covered online services that collect, use, or disclose personal information from children under 13, including services directed to children and certain operators with actual knowledge that they are collecting that information from a child. The FTC explains the scope and operator obligations in its COPPA guidance. Other laws and a platform’s own policies may also apply.
A sign-up page can make separate decisions look like one. Look for distinct wording about account setup, service operation, analytics, sharing with outside companies, and personalized or behavior-based ads. The useful question is not simply “Does this app collect data?” It is “What information is used for what purpose, and does this choice cover a disclosure to another company?”
“Personal information” can include more than a child’s name or email address. Depending on the details, persistent identifiers and information that can identify or contact a child may also be relevant under COPPA. A short permission label may not explain enough to make a meaningful choice, so open the linked privacy explanation before accepting.
Does COPPA apply to every app my child uses? No. Check whether the service is covered by the rule rather than assuming that a child-facing app automatically falls under COPPA. The service’s audience, what the operator knows, and what it does with children’s information matter; a platform’s privacy notice should explain its practices, but the FTC’s scope guidance is the place to confirm the rule’s general boundaries.
For a family that wants to check an app’s broader privacy practices, our guide to reviewing privacy commitments and data handling can help structure that review. It does not replace the app’s own notice or determine whether the law applies.
Separate service operation from third-party ad disclosure
The revised COPPA rule was published in the Federal Register on April 22, 2025, took effect on June 23, 2025, and set a general compliance date of April 22, 2026, according to the final rule. For covered services, the rule requires separate, verifiable parental consent for certain disclosures of children’s personal information to third parties, including disclosures for targeted advertising. That choice is distinct from consent for collection and use that supports the service.
The word “separate” matters. It means a parent should be able to evaluate the ad-related disclosure choice on its own, rather than treating agreement to all data practices as an unavoidable part of account creation. It does not mean every data practice needs its own checkbox, nor does it tell us that every service function can operate without any information. The exact choices depend on the service’s stated purposes and the applicable rule.
| Screen wording or notice | What to check | How to assess it |
|---|---|---|
| Information needed to create or run an account | Which fields are required, and what the service says they support | Consider whether the stated purpose is clear and connected to the service |
| Sharing with service providers or other third parties | The information involved, recipient or recipient category, and purpose | Look for a specific explanation rather than a broad “partners” label |
| Targeted or personalized advertising | Whether the child’s information is disclosed for behavior-based advertising | Treat the ad-disclosure choice as separate from basic service consent |
| Privacy notice or data-sharing explanation | The operator’s practices, contact details, and choices for parents | Read the linked notice; a checkbox label alone may not describe the full arrangement |
Which details matter when a kids’ app shares information with third parties? Check the type of information, who receives it or the category of recipients, why it is disclosed, and where the app explains that practice. If the notice only says “trusted partners” without explaining the purpose or data involved, pause and look for a fuller privacy notice or a way to ask the operator. The FTC’s business compliance guidance explains the role of notice and verifiable parental consent for covered services.
Do not infer that an outside company receives every item the app collects. Equally, do not assume that a disclosure is harmless because the app does not display a child’s name in an ad. Persistent identifiers or other information may still be relevant; the operator’s explanation is what the parent needs to examine.
Decide whether to decline the ad choice
Can a parent refuse targeted-ad consent separately? Under the revised rule, covered services must obtain separate verifiable parental consent for relevant third-party disclosures, including those for targeted advertising. A parent can therefore evaluate that disclosure choice separately from permission for collection and use that supports the service. The FTC’s announcement of the rule changes describes the added choice.
If a parent does not give the required consent for disclosure of a child’s information for behaviorally targeted advertising, the service may not condition the child’s access to the service on that consent. Keep the scope precise: this does not promise that every app must provide every feature regardless of other permissions, information needs, or legal requirements. The rule addresses the specified disclosure and the covered service; it is not a guarantee of full access in every situation.
Can my child keep using the app if I decline the advertising choice? For the covered disclosure described above, refusal should not by itself be used as the condition that blocks access. If the screen says otherwise, save the wording, review the linked explanation, and ask the operator which information is necessary to provide the service and which choice concerns advertising disclosure. Do not assume that a separate feature restriction has the same legal status as denial of the entire service.
Use this decision list before selecting anything:
- [ ] Confirm that the service describes its COPPA practices and identifies a way for parents to contact the operator.
- [ ] Separate information needed to provide the account or requested feature from information disclosed for advertising.
- [ ] Read the stated recipient or recipient category, information types, and purpose of each third-party disclosure.
- [ ] Look for an independent choice for targeted-ad disclosure rather than accepting it as part of a bundled “all data” permission.
- [ ] If declining appears to block basic access, capture the screen and ask the operator to explain the specific service requirement.
- [ ] Keep a copy of the relevant notice and the choice made, so the family can revisit it later.
This is a decision aid, not a legal test. If the app’s wording is unclear, the safer next step is to ask the operator rather than guessing that an email verification code or a broad consent button resolves the ambiguity.
Keep consent manageable after registration
Parental decisions may need review if the child stops using an app, the operator changes its practices, or the family wants to change a previous choice. Check the service’s official instructions for viewing or managing parental consent, asking what information it holds, correcting information, withdrawing consent, or requesting deletion. The FTC’s guidance for parents describes parents’ options under COPPA, while the exact request route and scope depend on the service and the applicable circumstances.
Withdrawing permission for an advertising-related disclosure is not automatically the same as closing an account or deleting all past information. Likewise, deleting an account may not answer every question about a prior consent choice or the operator’s handling of information. Read the service’s explanation and, if necessary, ask for confirmation of what the requested action covers.
A simple household record can prevent confusion later. Save the app’s privacy notice, the wording of the choices presented, the date the family made the decision, and any confirmation from the operator. Do not treat that record as proof that the service has complied; it gives the family a reference point if it needs to review or change the choice.
For a child’s continuing account, parental consent, account recovery, and ongoing family notices should go to an address the responsible adult can access for the life of the account. Avoid using an address that may disappear or be unavailable when the family needs to change a setting or recover access.
Match the email address to the account’s lifespan
A temporary inbox may be appropriate only for a low-continuity sign-up where the family does not need future authorization messages, account recovery, or continuing notices at that address. This article does not assume a particular service’s address lifetime, message retention, forwarding, or registration requirements. Check those details directly before relying on any temporary email service.
For a child’s account that will be used over time, a parent-controlled long-term address, a dedicated alias, or another address the family can keep accessing is generally a more suitable route for consent and recovery messages. If the family is considering an alias, a separate address can help organize app mail without making a short-lived inbox responsible for account access. The choice should reflect the service’s rules and the family’s ability to keep the address secure and monitored.
The practical dividing line is continuity, not whether a service asks for an email. If the address will receive an authorization decision, a change notice, or a recovery link, use an address the family can return to. If the registration is genuinely short-term and no later access depends on that mailbox, assess a temporary option only after checking its current terms and limitations.
Once the consent decision is clear, InboxCloak may be worth considering for a low-continuity registration where a separate receiving address fits the service’s rules. Keep parental authorization, recovery, and ongoing family communication on a long-term address instead. For the family’s broader approach, see our guide to choosing an email setup for different sign-ups, then use the address type that matches how long the account needs to remain accessible.
Put your notes to work with the tool—share only what’s needed
Go back to your inbox to check for real messages. If none have arrived, follow the separate troubleshooting checklist step by step; there’s no need to capture the whole screen again.