--- title: "16 CFR 312.11 COPPA: Safe harbor programs" canonical: "https://dposchool.com/coppa/section/312.11" source: "https://www.ecfr.gov/current/title-16/section-312.11" source_note: "Source: United States Code, title 15, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 16 CFR 312.11 COPPA · Part 312: CHILDREN'S ONLINE PRIVACY PROTECTION RULE (COPPA RULE) # 16 CFR 312.11 COPPA: Safe harbor programs eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 16 CFR 312.11(a) **(a)** In general. Industry groups or other persons may apply to the Commission for approval of self-regulatory program guidelines (“safe harbor programs”). The application shall be filed with the Commission's Office of the Secretary. The Commission will publish in the Federal Register a document seeking public comment on the application. The Commission shall issue a written determination within 180 days of the filing of the application. ### 16 CFR 312.11(b) **(b)** Criteria for approval of self-regulatory program guidelines. Proposed safe harbor programs must demonstrate that they meet the following performance standards: #### 16 CFR 312.11(b)(1) **(1)** Program requirements that ensure operators subject to the self-regulatory program guidelines (“subject operators”) provide substantially the same or greater protections for children as those contained in §§ 312.2 through 312.8, and 312.10. #### 16 CFR 312.11(b)(2) **(2)** An effective, mandatory mechanism for the independent assessment of subject operators' compliance with the self-regulatory program guidelines. At a minimum, this mechanism must include a comprehensive review by the safe harbor program, to be conducted not less than annually, of each subject operator's information privacy and security policies, practices, and representations. The assessment mechanism required under this paragraph can be provided by an independent enforcement program, such as a seal program. #### 16 CFR 312.11(b)(3) **(3)** Disciplinary actions for subject operators' non-compliance with self-regulatory program guidelines. This performance standard may be satisfied by: ##### 16 CFR 312.11(b)(3)(i) **(i)** Mandatory, public reporting of any action taken against subject operators by the industry group issuing the self-regulatory guidelines; ##### 16 CFR 312.11(b)(3)(ii) **(ii)** Consumer redress; ##### 16 CFR 312.11(b)(3)(iii) **(iii)** Voluntary payments to the United States Treasury in connection with an industry-directed program for violators of the self-regulatory guidelines; ##### 16 CFR 312.11(b)(3)(iv) **(iv)** Referral to the Commission of operators who engage in a pattern or practice of violating the self-regulatory guidelines; or ##### 16 CFR 312.11(b)(3)(v) **(v)** Any other equally effective action. ### 16 CFR 312.11(c) **(c)** Request for Commission approval of self-regulatory program guidelines. A proposed safe harbor program's request for approval shall be accompanied by the following: #### 16 CFR 312.11(c)(1) **(1)** A detailed explanation of the applicant's business model, and the technological capabilities and mechanisms that will be used for initial and continuing assessment of subject operators' fitness for membership in the safe harbor program; #### 16 CFR 312.11(c)(2) **(2)** A copy of the full text of the guidelines for which approval is sought and any accompanying commentary; #### 16 CFR 312.11(c)(3) **(3)** A comparison of each provision of §§ 312.2 through 312.8, and 312.10 with the corresponding provisions of the guidelines; and #### 16 CFR 312.11(c)(4) **(4)** A statement explaining: ##### 16 CFR 312.11(c)(4)(i) **(i)** How the self-regulatory program guidelines, including the applicable assessment mechanisms, meet the requirements of this part; and ##### 16 CFR 312.11(c)(4)(ii) **(ii)** How the assessment mechanisms and compliance consequences required under paragraphs (b)(2) and (b)(3) of this section provide effective enforcement of the requirements of this part. ### 16 CFR 312.11(d) **(d)** Reporting and recordkeeping requirements. Approved safe harbor programs shall: #### 16 CFR 312.11(d)(1) **(1)** By October 22, 2025, and annually thereafter, submit a report to the Commission that identifies each subject operator and all approved websites or online services, as well as any subject operators that have left the safe harbor program. The report must also contain, at a minimum: ##### 16 CFR 312.11(d)(1)(i) **(i)** a narrative description of the safe harbor program's business model, including whether it provides additional services such as training to subject operators; ##### 16 CFR 312.11(d)(1)(ii) **(ii)** copies of each consumer complaint related to each subject operator's violation of a safe harbor program's guidelines; ##### 16 CFR 312.11(d)(1)(iii) **(iii)** an aggregated summary of the results of the independent assessments conducted under paragraph (b)(2) of this section; ##### 16 CFR 312.11(d)(1)(iv) **(iv)** a description of each disciplinary action taken against any subject operator under paragraph (b)(3) of this section, as well as a description of the process for determining whether a subject operator is subject to discipline; and ##### 16 CFR 312.11(d)(1)(v) **(v)** a description of any approvals of member operators' use of a parental consent mechanism, pursuant to § 312.5(b)(3); #### 16 CFR 312.11(d)(2) **(2)** Promptly respond to Commission requests for additional information; #### 16 CFR 312.11(d)(3) **(3)** Maintain for a period not less than three years, and upon request make available to the Commission for inspection and copying: ##### 16 CFR 312.11(d)(3)(i) **(i)** Consumer complaints alleging violations of the guidelines by subject operators; ##### 16 CFR 312.11(d)(3)(ii) **(ii)** Records of disciplinary actions taken against subject operators; and ##### 16 CFR 312.11(d)(3)(iii) **(iii)** Results of the independent assessments of subject operators' compliance required under paragraph (b)(2) of this section; and #### 16 CFR 312.11(d)(4) **(4)** No later than July 21, 2025, publicly post on each of the approved safe harbor program's websites and online services a list of all current subject operators and, for each such operator, list each certified website or online service. Approved safe harbor programs shall update this list every six months thereafter to reflect any changes to the approved safe harbor programs' subject operators or their applicable websites and online services. ### 16 CFR 312.11(e) **(e)** Post-approval modifications to self-regulatory program guidelines. Approved safe harbor programs must submit proposed changes to their guidelines for review and approval by the Commission in the manner required for initial approval of guidelines under paragraph (c)(2) of this section. The statement required under paragraph (c)(4) of this section must describe how the proposed changes affect existing provisions of the guidelines. ### 16 CFR 312.11(f) **(f)** Review of self-regulatory program guidelines. No later than April 22, 2028, and every three years thereafter, approved safe harbor programs shall submit to the Commission a report detailing the safe harbor program's technological capabilities and mechanisms for assessing subject operators' fitness for membership in the safe harbor program. ### 16 CFR 312.11(g) **(g)** Revocation of approval of self-regulatory program guidelines. The Commission reserves the right to revoke any approval granted under this section if at any time it determines that the approved self-regulatory program guidelines or their implementation do not meet the requirements of this part. Safe harbor programs shall, by October 22, 2025, submit proposed modifications to their guidelines. ### 16 CFR 312.11(h) **(h)** Operators' participation in a safe harbor program. An operator will be deemed to be in compliance with the requirements of §§ 312.2 through 312.8, and 312.10 if that operator complies with Commission-approved safe harbor program guidelines. In considering whether to initiate an investigation or bring an enforcement action against a subject operator for violations of this part, the Commission will take into account the history of the subject operator's participation in the safe harbor program, whether the subject operator has taken action to remedy such non-compliance, and whether the operator's non-compliance resulted in any one of the disciplinary actions set forth in paragraph (b)(3) of this section. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[78 FR 4008, Jan. 17, 2013, as amended at 78 FR 76986, Dec. 20, 2013\] [16 CFR 312.11 on eCFR](https://www.ecfr.gov/current/title-16/section-312.11) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [COPPA Navigator](https://dposchool.com/coppa) / 16 CFR 312.11 Previous: [16 CFR 312.10 COPPA: Data retention and deletion requirements](https://dposchool.com/coppa/section/312.10) Next: [16 CFR 312.12 COPPA: Voluntary Commission approval processes](https://dposchool.com/coppa/section/312.12) ## For AI agents - Machine-readable index: https://dposchool.com/coppa/llms.txt - JSON API: https://dposchool.com/coppa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents