--- title: "16 CFR 312.8 COPPA: Confidentiality, security, and integrity of personal information collected from children" canonical: "https://dposchool.com/coppa/section/312.8" source: "https://www.ecfr.gov/current/title-16/section-312.8" source_note: "Source: United States Code, title 15, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 16 CFR 312.8 COPPA ยท Part 312: CHILDREN'S ONLINE PRIVACY PROTECTION RULE (COPPA RULE) # 16 CFR 312.8 COPPA: Confidentiality, security, and integrity of personal information collected from children eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 16 CFR 312.8(a) **(a)** The operator must establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children. ### 16 CFR 312.8(b) **(b)** At a minimum, the operator must establish, implement, and maintain a written information security program that contains safeguards that are appropriate to the sensitivity of the personal information collected from children and the operator's size, complexity, and nature and scope of activities. To satisfy this requirement, the operator must: #### 16 CFR 312.8(b)(1) **(1)** Designate one or more employees to coordinate the operator's information security program; #### 16 CFR 312.8(b)(2) **(2)** Identify and, at least annually, perform additional assessments to identify internal and external risks to the confidentiality, security, and integrity of personal information collected from children and the sufficiency of any safeguards in place to control such risks; #### 16 CFR 312.8(b)(3) **(3)** Design, implement, and maintain safeguards to control risks identified through the risk assessments required under paragraph (b)(2) of this section. Each safeguard must be based on the volume and sensitivity of the children's personal information that is at risk, and the likelihood that the risk could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information; #### 16 CFR 312.8(b)(4) **(4)** Regularly test and monitor the effectiveness of the safeguards in place to control risks identified through the risk assessments required under paragraph (b)(2) of this section; and #### 16 CFR 312.8(b)(5) **(5)** At least annually, evaluate and modify the information security program to address identified risks, results of required testing and monitoring, new or more efficient technological or operational methods to control for identified risks, or any other circumstances that an operator knows or has reason to know may have a material impact on its information security program or any safeguards in place to protect personal information collected from children. ### 16 CFR 312.8(c) **(c)** Before allowing other operators, service providers, or third parties to collect or maintain personal information from children on the operator's behalf, or before releasing children's personal information to such entities, the operator must take reasonable steps to determine that such entities are capable of maintaining the confidentiality, security, and integrity of the information and must obtain written assurances that such entities will employ reasonable measures to maintain the confidentiality, security, and integrity of the information. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. [16 CFR 312.8 on eCFR](https://www.ecfr.gov/current/title-16/section-312.8) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [COPPA Navigator](https://dposchool.com/coppa) / 16 CFR 312.8 Previous: [16 CFR 312.7 COPPA: Prohibition against conditioning a child's participation on collection of personal information](https://dposchool.com/coppa/section/312.7) Next: [16 CFR 312.9 COPPA: Enforcement](https://dposchool.com/coppa/section/312.9) ## For AI agents - Machine-readable index: https://dposchool.com/coppa/llms.txt - JSON API: https://dposchool.com/coppa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents