Privacy
Available nowCOPPA · 16 CFR Part 312 (2025 amendments)
COPPA is the FTC’s Children’s Online Privacy Protection Rule, 16 CFR Part 312. It binds any operator of a service directed to children under 13, and any operator with actual knowledge it is collecting personal information from a child — which is why it catches products that were never aimed at children. Keel models the Rule at its own designated-paragraph level: the notices, verifiable parental consent and its recognised methods and exceptions, the parent’s right to review and delete, the ban on conditioning a child’s participation on excess collection, the written children’s information security programme, and the retention-and-deletion duty. Scope, definitions, enforcement, safe harbor programmes and the Commission’s own processes are cited but not scored, because they place no implementable duty on an operator.
32
requirements tracked
Premium
Access
Add-on from $39/mo
Children’s Privacy: COPPA, Google Play Families, Amazon Appstore Child-Directed Apps, Apple App Store Kids Category are one add-on at $39/mo, bought through COPPA, and together they count as one framework against your plan’s allowance.
Scope
How much of the standard Keel models
Keel authors every leaf requirement in the scope declared below — all 32 of them, with nothing inside that scope left out. A test fails the build if the authored count and the declared count ever diverge, so this framework cannot quietly lose requirements after the fact.
- Authored in Keel
- 32 requirements
- In Keel’s scored scope
- 32 leaf requirements
Keel publishes this for every framework it ships, complete or not, so a readiness percentage can be read against a denominator you can see. Compare every framework
Who it is for
Who needs COPPA?
- App and game studios whose product is directed to children under 13
- General-audience services that have learned they collect data from children anyway
- Anyone shipping to an app store, where COPPA is the floor and the store rules sit on top
What Keel does
How Keel helps with COPPA
- Every operator duty in the Rule as a scored control, at the paragraph level rather than one line per section
- The store programmes crosswalked alongside it, so shared work is evidenced once rather than three more times
- Notice, consent, retention and security tracked with owners and evidence, not as a policy PDF
Collect once, comply everywhere
COPPA shares canonical controls with GDPR, ISO/IEC 27001 and NIST SP 800-53 and others in the catalog. Implement one of those controls and it counts toward every framework it satisfies, so adding COPPA rarely means starting from scratch.
Shares canonical controls with
- ISO/IEC 27001
- CIS Critical Security Controls
- PCI DSS
- SOC 2
- SOX (Sarbanes-Oxley) Section 404
- NIST Cybersecurity Framework
- NIST SP 800-53
- NIST SP 800-171
- HIPAA
- GDPR
- Google Play Families
- Amazon Appstore Child-Directed Apps
- Apple App Store Kids Category
- ISO 9001
- AI Governance Essentials
- ISO/IEC 42001
- NIST AI Risk Management Framework
- EU AI Act
- ESG Essentials
- US Employment Law - Federal Baseline
Other frameworks: ISO/IEC 27001 · CIS Critical Security Controls · PCI DSS · SOC 2 · SOX (Sarbanes-Oxley) Section 404 · NIST Cybersecurity Framework · All frameworks