--- title: "16 CFR 312.5 COPPA: Parental consent" canonical: "https://dposchool.com/coppa/section/312.5" source: "https://www.ecfr.gov/current/title-16/section-312.5" source_note: "Source: United States Code, title 15, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 16 CFR 312.5 COPPA · Part 312: CHILDREN'S ONLINE PRIVACY PROTECTION RULE (COPPA RULE) # 16 CFR 312.5 COPPA: Parental consent eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 16 CFR 312.5(a) **(a)** General requirements. (1) An operator is required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented. #### 16 CFR 312.5(a)(2) **(2)** An operator must give the parent the option to consent to the collection and use of the child's personal information without consenting to disclosure of his or her personal information to third parties, unless such disclosure is integral to the website or online service. An operator required to give the parent this option must obtain separate verifiable parental consent to such disclosure. ### 16 CFR 312.5(b) **(b)** Methods for verifiable parental consent. (1) An operator must make reasonable efforts to obtain verifiable parental consent, taking into consideration available technology. Any method to obtain verifiable parental consent must be reasonably calculated, in light of available technology, to ensure that the person providing consent is the child's parent. #### 16 CFR 312.5(b)(2) **(2)** Existing methods to obtain verifiable parental consent that satisfy the requirements of this paragraph include: ##### 16 CFR 312.5(b)(2)(i) **(i)** Providing a consent form to be signed by the parent and returned to the operator by postal mail, facsimile, or electronic scan; ##### 16 CFR 312.5(b)(2)(ii) **(ii)** Requiring a parent, in connection with a transaction, to use a credit card, debit card, or other online payment system that provides notification of each discrete transaction to the primary account holder; ##### 16 CFR 312.5(b)(2)(iii) **(iii)** Having a parent call a toll-free telephone number staffed by trained personnel; ##### 16 CFR 312.5(b)(2)(iv) **(iv)** Having a parent connect to trained personnel via video-conference; ##### 16 CFR 312.5(b)(2)(v) **(v)** Verifying a parent's identity by checking a form of government-issued identification against databases of such information, where the parent's identification is deleted by the operator from its records promptly after such verification is complete; ##### 16 CFR 312.5(b)(2)(vi) **(vi)** Verifying a parent's identity using knowledge-based authentication provided: ###### 16 CFR 312.5(b)(2)(vi)(A) **(A)** the verification process uses dynamic, multiple-choice questions, where there are a reasonable number of questions with an adequate number of possible answers such that the probability of correctly guessing the answers is low; and ###### 16 CFR 312.5(b)(2)(vi)(B) **(B)** the questions are of sufficient difficulty that a child age 12 or younger in the parent's household could not reasonably ascertain the answers; ##### 16 CFR 312.5(b)(2)(vii) **(vii)** Having a parent submit a government-issued photographic identification that is verified to be authentic and is compared against an image of the parent's face taken with a phone camera or webcam using facial recognition technology and confirmed by personnel trained to confirm that the photos match; provided that the parent's identification and images are promptly deleted by the operator from its records after the match is confirmed; or ##### 16 CFR 312.5(b)(2)(viii) **(viii)** Provided that, an operator that does not “disclose” (as defined by § 312.2) children's personal information, may use an email coupled with additional steps to provide assurances that the person providing the consent is the parent. Such additional steps include: Sending a confirmatory email to the parent following receipt of consent, or obtaining a postal address or telephone number from the parent and confirming the parent's consent by letter or telephone call. An operator that uses this method must provide notice that the parent can revoke any consent given in response to the earlier email. ##### 16 CFR 312.5(b)(2)(ix) **(ix)** Provided that, an operator that does not “disclose” (as defined by § 312.2) children's personal information, may use a text message coupled with additional steps to provide assurances that the person providing the consent is the parent. Such additional steps include: Sending a confirmatory text message to the parent following receipt of consent, or obtaining a postal address or telephone number from the parent and confirming the parent's consent by letter or telephone call. An operator that uses this method must provide notice that the parent can revoke any consent given in response to the earlier text message. #### 16 CFR 312.5(b)(3) **(3)** Safe harbor approval of parental consent methods. A safe harbor program approved by the Commission under § 312.11 may approve its member operators' use of a parental consent method not currently enumerated in paragraph (b)(2) of this section where the safe harbor program determines that such parental consent method meets the requirements of paragraph (b)(1) of this section. ### 16 CFR 312.5(c) **(c)** Exceptions to prior parental consent. Verifiable parental consent is required prior to any collection, use, or disclosure of personal information from a child except as set forth in this paragraph: #### 16 CFR 312.5(c)(1) **(1)** Where the sole purpose of collecting the name or online contact information of the parent or child is to provide notice and obtain parental consent under § 312.4(c)(1). If the operator has not obtained parental consent after a reasonable time from the date of the information collection, the operator must delete such information from its records; #### 16 CFR 312.5(c)(2) **(2)** Where the purpose of collecting a parent's online contact information is to provide voluntary notice to, and subsequently update the parent about, the child's participation in a website or online service that does not otherwise collect, use, or disclose children's personal information. In such cases, the parent's online contact information may not be used or disclosed for any other purpose. In such cases, the operator must make reasonable efforts, taking into consideration available technology, to ensure that the parent receives notice as described in § 312.4(c)(2); #### 16 CFR 312.5(c)(3) **(3)** Where the sole purpose of collecting online contact information from a child is to respond directly on a one-time basis to a specific request from the child, and where such information is not used to re-contact the child or for any other purpose, is not disclosed, and is deleted by the operator from its records promptly after responding to the child's request; #### 16 CFR 312.5(c)(4) **(4)** Where the purpose of collecting a child's and a parent's online contact information is to respond directly more than once to the child's specific request, and where such information is not used for any other purpose, disclosed, or combined with any other information collected from the child. In such cases, the operator must make reasonable efforts, taking into consideration available technology, to ensure that the parent receives notice as described in § 312.4(c)(3). An operator will not be deemed to have made reasonable efforts to ensure that a parent receives notice where the notice to the parent was unable to be delivered; #### 16 CFR 312.5(c)(5) **(5)** Where the purpose of collecting a child's and a parent's name and online contact information, is to protect the safety of a child, and where such information is not used or disclosed for any purpose unrelated to the child's safety. In such cases, the operator must make reasonable efforts, taking into consideration available technology, to provide a parent with notice as described in § 312.4(c)(4); #### 16 CFR 312.5(c)(6) **(6)** Where the purpose of collecting a child's name and online contact information is to: ##### 16 CFR 312.5(c)(6)(i) **(i)** Protect the security or integrity of the website or online service; ##### 16 CFR 312.5(c)(6)(ii) **(ii)** Take precautions against liability; ##### 16 CFR 312.5(c)(6)(iii) **(iii)** Respond to judicial process; or ##### 16 CFR 312.5(c)(6)(iv) **(iv)** To the extent permitted under other provisions of law, to provide information to law enforcement agencies or for an investigation on a matter related to public safety; and where such information is not used for any other purpose; #### 16 CFR 312.5(c)(7) **(7)** Where an operator collects a persistent identifier and no other personal information and such identifier is used for the sole purpose of providing support for the internal operations of the website or online service. In such case, the operator shall provide notice under § 312.4(d)(3); #### 16 CFR 312.5(c)(8) **(8)** Where an operator covered under paragraph (2) of the definition of website or online service directed to children in § 312.2 collects a persistent identifier and no other personal information from a user who affirmatively interacts with the operator and whose previous registration with that operator indicates that such user is not a child. In such case, there also shall be no obligation to provide notice under § 312.4; or #### 16 CFR 312.5(c)(9) **(9)** Where an operator collects an audio file containing a child's voice, and no other personal information, for use in responding to a child's specific request and where the operator does not use such information for any other purpose, does not disclose it, and deletes it immediately after responding to the child's request. In such case, there also shall be no obligation to provide a direct notice, but notice shall be required under § 312.4(d). ## Source Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. [16 CFR 312.5 on eCFR](https://www.ecfr.gov/current/title-16/section-312.5) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [COPPA Navigator](https://dposchool.com/coppa) / 16 CFR 312.5 Previous: [16 CFR 312.4 COPPA: Notice](https://dposchool.com/coppa/section/312.4) Next: [16 CFR 312.6 COPPA: Right of parent to review personal information provided by a child](https://dposchool.com/coppa/section/312.6) ## For AI agents - Machine-readable index: https://dposchool.com/coppa/llms.txt - JSON API: https://dposchool.com/coppa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents