Rules
How COPPA and California's design code change social apps for US teens
COPPA sets the federal baseline for kids' data, while California's Age-Appropriate Design Code adds design duties that reshape teen social apps across the US.
What to take away
- COPPA is the federal rule for children under 13. It requires verifiable parental consent before an app collects personal data, plus parent review and deletion rights. The FTC enforces it.
- California's Age-Appropriate Design Code covers everyone under 18 and regulates design. It sets high privacy defaults, age estimation, impact assessments and limits on dark patterns.
- The AADC is not fully in force. A federal judge enjoined its core provisions in September 2023 and the appeal is still open as of 2026.
- Penalties scale per violation, and the FTC counts each affected child separately, so exposure grows with user numbers rather than with the number of broken features.
Where the two rules split
A US teen app answers to two kinds of law. COPPA is a federal consent and data rule for children under 13. California's Age-Appropriate Design Code is a state design rule for everyone under 18. One governs what you collect. The other governs how the product is built.
COPPA
- Age group covered
- Under 13
- Main duty
- Parental consent before collection
- Age check
- None required
- Parent and user rights
- Parent review and deletion
- Risk assessment
- Not required
- Enforcement
- FTC and state attorneys general
California AADC
- Age group covered
- Under 18
- Main duty
- High privacy defaults, best-interests design
- Age check
- Age estimation or assurance
- Parent and user rights
- Child deletion requests
- Risk assessment
- Impact assessment required
- Enforcement
- California Attorney General
COPPA vs AADC feature duties
Feature area
- Default privacy
- No default rule
- Age assurance
- Not required
- Parental controls
- Consent required
- Data deletion
- Parents can delete
- Impact assessments
- Not required
COPPA
- Default privacy
- High privacy default
- Age assurance
- Required
- Parental controls
- Tools for parents
- Data deletion
- Children can request
- Impact assessments
- Required
AADC
- Default privacy
- Age assurance
- Parental controls
- Data deletion
- Impact assessments
COPPA applies to a service because of who it reaches, not the label in its terms. A teen app can be treated as child-directed when its content, marketing or actual users point younger. Our side-by-side on the California Age-Appropriate Design Code vs COPPA works through the comparison source by source.
What COPPA requires of a teen-facing social app
COPPA applies to services directed to children under 13, and to general-audience services with actual knowledge of younger users. The duties are the same either way: notice, verifiable parental consent, data minimisation, security and parent access.
The definition of personal information includes persistent identifiers. Device IDs, cookies and advertising tags count, so ad networks and analytics vendors share the same obligations as the app.
The FTC enforces the rule and amended it in 2025, tightening consent for third-party disclosure and setting retention limits. The prior major revision came in 2013, when persistent identifiers were brought into scope. Read the Children's Online Privacy Protection Rule rather than a summary written before those changes.
State attorneys general can also sue under COPPA, so one decision can attract two enforcers. How these duties sit beside adult content rules is set out in US platform rules that shape what stays online.
Where California's design code goes further
A federal judge enjoined the AADC's core provisions in September 2023. The appeal is still unresolved as of 2026, so the law is not fully in force. The duties below describe the statute as written.
California passed AB 2273 in 2022. It covers businesses offering online services likely to be accessed by children under 18, a far wider group than COPPA's under-13s. The statute regulates design, not just collection.
Covered platforms must default minors to high privacy settings unless a compelling reason supports otherwise. They must limit collection to what the service needs and run impact assessments for features children are likely to reach. Dark patterns and unnecessary precise geolocation are banned.
Age estimation is the sharpest break with federal law. COPPA requires no age check at all, while the AADC expects a reasonable estimate for covered features. The text of AB 2273 carries the exact wording.
The California Attorney General enforces the code and can seek civil penalties and injunctive relief. Where state duties end and federal communications rules begin is covered in what the FCC actually regulates on US social platforms.
Example: the 2019 Facebook order
The clearest named enforcement action against a large social platform is not a COPPA case. In 2019 the FTC fined Facebook $5 billion over the Cambridge Analytica episode and alleged breaches of a 2012 consent order. The FTC's announcement lists the penalty and the new privacy restrictions.
That order added independent oversight and runs for 20 years. One action can fix a platform's data practices for a generation.
Penalties and the arithmetic that scales
The COPPA civil penalty maximum is adjusted for inflation every year. It has sat above $50,000 per violation since 2024. Check the FTC's current table before you put a number in a budget.
Each affected child can be counted as a separate violation. At $50,000 apiece, an app with one million under-13 users faces a theoretical maximum of $50 billion. That arithmetic is illustrative, but it explains the board-level attention.
Penalty exposure per violation
- Over $50,000 | COPPA maximum per violation
- $2,500 | AADC negligent per child
- $7,500 | AADC intentional per child
No regulator publishes a per-platform compliance cost. Quotes for age assurance and consent infrastructure come from vendors and vary widely. Treat any single figure as an estimate.
A 20-year consent order usually adds a written privacy programme and independent assessments. Where those duties sit in the wider argument is covered in critiques of social media for people who want the details.
A compliance checklist for product teams
- Map every data field collected from users under 18 and record its stated purpose.
- Build a parental consent path that survives an auditnotice, verification and revocation.
- Set private-by-default profiles and messaging limits for accounts flagged as minors.
- Document an impact assessment for recommendation, messaging and location features.
- Log age estimates, deletion requests and the dates they were completed.
