The near-universal “you must be at least 13” on sign-up forms is not a coincidence or a maturity judgment. It comes from the Children's Online Privacy Protection Act, and services choose 13 because that is the line at which COPPA's obligations largely stop applying. Understanding what the law actually requires explains both why the gate exists and why it protects less than people assume.
What COPPA requires, and of whom
COPPA applies to operators of websites and online services directed to children under 13, and to operators with actual knowledge that they are collecting personal information from a child under 13. The Federal Trade Commission enforces it. Covered operators must post a clear privacy policy, obtain verifiable parental consent before collecting personal information from a child, give parents a way to review and delete that information, and not condition a child's participation on disclosing more information than is reasonably necessary.
The obligation falls on the operator, not on the child. A young person who enters a false birthdate has not broken a law — but they have generally moved themselves outside the protections the law was written to give them, which is the part worth understanding.
What it does not do
COPPA is a parental-consent and notice law, not a general ban on collecting data from young people. Once a user is 13, COPPA's requirements largely stop applying — which is why a fourteen-year-old's data is generally treated by federal law much like an adult's, despite being a minor in every other context.
That gap is why the material in our articles on data brokers, app permissions, and AI chatbots matters more for teenagers than the age gate suggests. Turning 13 does not switch on a protection; it switches one off.
Schools, apps, and consent given on your behalf
FTC guidance recognizes that a school can, in certain circumstances, provide consent on behalf of parents for an educational service used in class — which is how classroom software gets deployed without a consent form per child per app. That is a real and practical accommodation, and it also means a student may be using services no one at home specifically approved.
A family can ask a district which third-party services students use, what data those services receive, and what the district's agreement with them says. That question is answerable, districts increasingly publish the list, and it pairs with the FERPA rights covered in our article on school records.
Remember this
- COPPA covers services directed to under-13s, or with actual knowledge they're collecting from an under-13 — the FTC enforces it.
- It requires verifiable parental consent, a clear policy, and a way for parents to review and delete the data.
- The obligation is on the operator, not the child — but turning 13 switches the protection off rather than on.
- Schools can consent on parents' behalf for classroom services — you can ask your district for the list and the agreements.
Sources
This article provides general educational information, not individualized legal advice. KidsKnowRights is not a law firm, and reading this article does not create an attorney-client relationship. Laws vary by state, age, and circumstances, and they change over time. For advice about a real situation, talk with a licensed attorney or a legal aid organization.