§What COPPA requires
Source: Children's Online Privacy Protection Act / 16 CFR Part 312 — accessed 2026-05-11.
Jurisdiction. Applies to operators of websites and online services directed to children under 13, and to general-audience operators with actual knowledge that they are collecting personal information from a child under 13. Original Rule effective 2000; amended 2013.
Personal data definition. COPPA's definition of personal information at 16 CFR §312.2 includes first and last name, home or other physical address, online contact information (including email or screen name that permits direct contact), telephone number, social security number, a persistent identifier that can be used to recognise a user over time and across different websites or online services, photographs/videos/ audio containing a child's image or voice, geolocation sufficient to identify street/city, and information concerning the child or parents that is combined with any of the above.
Key requirements relevant to mobile analytics. Operators must provide direct notice to parents and obtain verifiable parental consent (§312.5) before any collection, use, or disclosure of personal information from children under 13. The Rule requires reasonable procedures to ensure the person providing consent is in fact the parent. Limited exceptions exist (e.g., obtaining a one-time email for the purpose of responding to a specific request).
⚑Where mobile analytics typically creates exposure for ai chatbot & assistant apps
A mobile-analytics SDK that assigns a persistent device identifier and ships it with every event collects personal information under COPPA's definition — regardless of whether the SDK separately collects a name or email. The FTC has made clear in enforcement actions that persistent identifiers used to recognise a user over time fall within the rule's scope, and that simply describing an app as 'analytics' does not avoid the verifiable-parental-consent requirement when the app is directed to children.
AI chatbot apps process user prompts (which may contain anything the user types), model outputs, conversation history, user-uploaded files, and feedback ratings. The prompt and response strings are the highest-risk surface — a single message can contain PII, PHI, financial data, or special-category information.
Because prompts are free-form natural language, they can contain any category of personal data under any regulation — names, health, finance, sexual orientation, religious belief. Logging full prompts to an analytics SDK is one of the highest-exposure patterns in modern apps.
▸What Respectlytics's design does (technical facts)
Respectlytics's API does not accept prompt or response strings as event parameters. A chatbot app can record that a user sent a message, opened the feedback dialog, or hit a token-quota wall — without the content of the message flowing into analytics. The conversation content remains where the user expects: inside the app's primary store, governed by the app's privacy notice.
Reduces the surface. Removing the surface where the categories covered by COPPA could be collected in the first place narrows what a COPPA review needs to scope. Whether the resulting posture meets the regulation's requirements for your specific app is something to discuss with your legal team.
❓Frequently asked questions
What counts as a 'website or online service directed to children'?
§312.2 lists factors the FTC considers: subject matter, visual or audio content, use of animated characters or child-oriented activities and incentives, age of models, language, advertising directed to children, and competent and reliable empirical evidence about audience composition.
If our app is rated 12+ but children use it anyway, are we covered?
If the operator has actual knowledge that it is collecting personal information from a child under 13, COPPA applies even on a general-audience service. The actual-knowledge standard is fact-specific — consult your legal team if you have signals that your audience includes under-13s.
Does using Respectlytics by itself resolve COPPA obligations for our ai chatbot & assistant apps app?
No — and no analytics SDK can credibly answer that question. Whether your product meets COPPA's requirements is a property of your whole product, contracts, and operational practice, evaluated by your legal team. Respectlytics's contribution is a smaller data surface: identifying fields and the regulation's special categories are rejected at the API. Whether that posture, combined with your other controls, satisfies COPPA for your specific app is a conversation for your counsel.
What if we already use a different analytics SDK today?
The starting point is an inventory of what your current SDK actually collects and where it sends it. Our privacy self-assessment worksheet walks through that in seven sections — it outputs an educational summary you can bring to your legal team.