--- title: "16 CFR 312.4 COPPA: Notice" canonical: "https://dposchool.com/coppa/section/312.4" source: "https://www.ecfr.gov/current/title-16/section-312.4" source_note: "Source: United States Code, title 15, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 16 CFR 312.4 COPPA · Part 312: CHILDREN'S ONLINE PRIVACY PROTECTION RULE (COPPA RULE) # 16 CFR 312.4 COPPA: Notice eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 16 CFR 312.4(a) **(a)** General principles of notice. It shall be the obligation of the operator to provide notice and obtain verifiable parental consent prior to collecting, using, or disclosing personal information from children. Such notice must be clearly and understandably written, complete, and must contain no unrelated, confusing, or contradictory materials. ### 16 CFR 312.4(b) **(b)** Direct notice to the parent. An operator must make reasonable efforts, taking into account available technology, to ensure that a parent of a child receives direct notice of the operator's practices with regard to the collection, use, or disclosure of personal information from children, including notice of any material change in the collection, use, or disclosure practices to which the parent has previously consented. ### 16 CFR 312.4(c) **(c)** Content of the direct notice to the parent—(1) Content of the direct notice to the parent for purposes of obtaining consent. The direct notice to obtain the parent's affirmative consent to the collection, use, or disclosure of a child's personal information (including under § 312.5(c)(1)) shall set forth: ##### 16 CFR 312.4(c)(i) **(i)** If applicable, that the operator has collected the parent's or child's online contact information from the child, and, if such is the case, the name of the child or the parent, in order to obtain the parent's consent; ##### 16 CFR 312.4(c)(ii) **(ii)** That the parent's consent is required for the collection, use, or disclosure of personal information, and that the operator will not collect, use, or disclose any personal information from the child if the parent does not provide such consent; ##### 16 CFR 312.4(c)(iii) **(iii)** The items of personal information the operator intends to collect from the child, how the operator intends to use such information, and the potential opportunities for the disclosure of personal information, should the parent provide consent; ##### 16 CFR 312.4(c)(iv) **(iv)** Where the operator discloses personal information to one or more third parties, the identities or specific categories of such third parties (including the public if making it publicly available) and the purposes for such disclosure, should the parent provide consent, and that the parent can consent to the collection and use of the child's personal information without consenting to the disclosure of such personal information to third parties except to the extent such disclosure is integral to the website or online service; ##### 16 CFR 312.4(c)(v) **(v)** A hyperlink to the operator's online notice of its information practices required under paragraph (d) of this section; ##### 16 CFR 312.4(c)(vi) **(vi)** The means by which the parent can provide verifiable consent to the collection, use, and disclosure of the information; and ##### 16 CFR 312.4(c)(vii) **(vii)** If the operator has collected the name or online contact information of the parent or child to provide notice and obtain parental consent, that if the parent does not provide consent within a reasonable time from the date the direct notice was sent, the operator will delete the parent's or child's online contact information and the parent's or child's name from its records. #### 16 CFR 312.4(c)(2) **(2)** Content of the direct notice to the parent of a child's online activities not involving the collection, use or disclosure of personal information. Where an operator chooses to notify a parent of a child's participation in a website or online service, and where such site or service does not collect any personal information other than the parent's online contact information, the voluntary direct notice to the parent of a child's online activities not involving the collection, use or disclosure of personal information (required under § 312.5(c)(2)) shall set forth: ##### 16 CFR 312.4(c)(2)(i) **(i)** That the operator has collected the parent's online contact information from the child in order to provide notice to, and subsequently update the parent about, a child's participation in a website or online service that does not otherwise collect, use, or disclose children's personal information; ##### 16 CFR 312.4(c)(2)(ii) **(ii)** That the parent's online contact information will not be used or disclosed for any other purpose; ##### 16 CFR 312.4(c)(2)(iii) **(iii)** That the parent may refuse to permit the child's participation in the website or online service and may require the deletion of the parent's online contact information, and how the parent can do so; and ##### 16 CFR 312.4(c)(2)(iv) **(iv)** A hyperlink to the operator's online notice of its information practices required under paragraph (d) of this section. #### 16 CFR 312.4(c)(3) **(3)** Content of the direct notice to the parent of operator's intent to communicate with the child multiple times. The direct notice to the parent of the operator's intent to communicate with the child multiple times (required under § 312.5(c)(4)) shall set forth: ##### 16 CFR 312.4(c)(3)(i) **(i)** That the operator has collected the child's online contact information from the child in order to provide multiple online communications to the child; ##### 16 CFR 312.4(c)(3)(ii) **(ii)** That the operator has collected the parent's online contact information from the child in order to notify the parent that the child has registered to receive multiple online communications from the operator; ##### 16 CFR 312.4(c)(3)(iii) **(iii)** That the online contact information collected from the child will not be used for any other purpose, disclosed, or combined with any other information collected from the child; ##### 16 CFR 312.4(c)(3)(iv) **(iv)** That the parent may refuse to permit further contact with the child and require the deletion of the parent's and child's online contact information, and how the parent can do so; ##### 16 CFR 312.4(c)(3)(v) **(v)** That if the parent fails to respond to this direct notice, the operator may use the online contact information collected from the child for the purpose stated in the direct notice; and ##### 16 CFR 312.4(c)(3)(vi) **(vi)** A hyperlink to the operator's online notice of its information practices required under paragraph (d) of this section. #### 16 CFR 312.4(c)(4) **(4)** Content of the direct notice to the parent in order to protect a child's safety. The direct notice to the parent in order to protect a child's safety (required under § 312.5(c)(5)) shall set forth: ##### 16 CFR 312.4(c)(4)(i) **(i)** That the operator has collected the name and the online contact information of the child and the parent in order to protect the safety of a child; ##### 16 CFR 312.4(c)(4)(ii) **(ii)** That the information will not be used or disclosed for any purpose unrelated to the child's safety; ##### 16 CFR 312.4(c)(4)(iii) **(iii)** That the parent may refuse to permit the use, and require the deletion, of the information collected, and how the parent can do so; ##### 16 CFR 312.4(c)(4)(iv) **(iv)** That if the parent fails to respond to this direct notice, the operator may use the information for the purpose stated in the direct notice; and ##### 16 CFR 312.4(c)(4)(v) **(v)** A hyperlink to the operator's online notice of its information practices required under paragraph (d) of this section. ### 16 CFR 312.4(d) **(d)** Notice on the website or online service. In addition to the direct notice to the parent, an operator must post a prominent and clearly labeled link to an online notice of its information practices with regard to children on the home or landing page or screen of its website or online service, and, at each area of the website or online service where personal information is collected from children. The link must be in close proximity to the requests for information in each such area. An operator of a general audience website or online service that has a separate children's area must post a link to a notice of its information practices with regard to children on the home or landing page or screen of the children's area. To be complete, the online notice of the website or online service's information practices must state the following: #### 16 CFR 312.4(d)(1) **(1)** The name, address, telephone number, and email address of all operators collecting or maintaining personal information from children through the website or online service. Provided that: The operators of a website or online service may list the name, address, phone number, and email address of one operator who will respond to all inquiries from parents concerning the operators' privacy policies and use of children's information, as long as the names of all the operators collecting or maintaining personal information from children through the website or online service are also listed in the notice; #### 16 CFR 312.4(d)(2) **(2)** A description of what information the operator collects from children, including whether the website or online service enables a child to make personal information publicly available; how the operator uses such information; the operator's disclosure practices for such information, including the identities and specific categories of any third parties to which the operator discloses personal information and the purposes for such disclosures; and the operator's data retention policy as required under § 312.10; #### 16 CFR 312.4(d)(3) **(3)** If applicable, the specific internal operations for which the operator has collected a persistent identifier pursuant to § 312.5(c)(7); and the means the operator uses to ensure that such identifier is not used or disclosed to contact a specific individual, including through behavioral advertising, to amass a profile on a specific individual, or for any other purpose (except as specifically permitted to provide support for the internal operations of the website or online service); #### 16 CFR 312.4(d)(4) **(4)** Where the operator collects audio files containing a child's voice pursuant to § 312.5(c)(9), a description of how the operator uses such audio files and that the operator deletes such audio files immediately after responding to the request for which they were collected; and #### 16 CFR 312.4(d)(5) **(5)** If applicable, that the parent can review or have deleted the child's personal information, and refuse to permit further collection or use of the child's information, and state the procedures for doing so. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. [16 CFR 312.4 on eCFR](https://www.ecfr.gov/current/title-16/section-312.4) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [COPPA Navigator](https://dposchool.com/coppa) / 16 CFR 312.4 Previous: [16 CFR 312.3 COPPA: Regulation of unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children on the internet](https://dposchool.com/coppa/section/312.3) Next: [16 CFR 312.5 COPPA: Parental consent](https://dposchool.com/coppa/section/312.5) ## For AI agents - Machine-readable index: https://dposchool.com/coppa/llms.txt - JSON API: https://dposchool.com/coppa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents