What COPPA Actually Means for the Math App on Your Kid's Tablet

The law is shorter than the marketing around it

My daughter had a math app on her tablet for about three weeks before I sat down and read what it was doing in the background. I do this for a living, so it took me maybe twenty minutes with the network traffic tools. What I found wasn't dramatic. It was just a lot of small pings to ad networks and an analytics company I'd never heard of, every time she tapped a button. She was seven.

COPPA is the Children's Online Privacy Protection Act. It's a US law from 1998 that says companies can't knowingly collect personal information from kids under 13 without a parent's real, verifiable consent. That's the whole heart of it. A COPPA compliant math app is one that either doesn't collect that kind of data at all, or gets your actual permission before it does.

The confusing part is that "COPPA compliant" gets printed on app store pages the way "all natural" gets printed on cereal boxes. It's technically meaningful and also easy to say without doing much.

What counts as personal information

People hear "personal information" and picture a home address or a Social Security number. The law is broader than that, on purpose. Under COPPA, personal information about a child includes:

• Full name
• Home or email address
• Phone number
• A persistent identifier that can track them over time (this is the big one)
• Photos, video, or audio of the child
• Geolocation precise enough to identify a street

That fifth bullet, the persistent identifier, is where most of the action happens. When an app assigns your kid's device a tracking ID and hands it to an advertising network, that's collection. The kid never typed a single thing. The app just quietly labeled the device and started keeping notes.

What compliant actually requires

If a company knows it's dealing with kids under 13 and wants to collect that data, COPPA makes it do a few concrete things. It has to post a clear privacy policy. It has to get verifiable parental consent before collecting, not a checkbox that says "I am over 13" that any second grader can tap. It can't force a kid to hand over more information than the activity needs. And parents have the right to review what's been collected and tell the company to delete it.

There's a cleaner path, and the better apps take it. Collect nothing. If a math app never asks for a name, never phones home to an ad network, and stores your child's progress on the device itself, there's almost nothing for COPPA to govern, because there's almost no data changing hands. That's the version I wanted for my own kids, so when my wife and I built Math Prizes, progress lives on the device and there are no third-party ad trackers riding along. Not because a law made us. Because I'd already seen what the other way looked like on my daughter's tablet.

The tricks the label hides

Here's where fifteen years of building software makes me a little skeptical. A few things can all be true at once, and none of them protect your kid the way the badge implies.

An app can be "COPPA compliant" and still show ads, as long as those ads aren't targeted using the child's data. In practice, the line between contextual and behavioral advertising gets blurry, and the enforcement is thin.

An app can be run by a company that says the app "isn't directed at children," which lets them dodge COPPA entirely while marketing a cartoon interface full of talking animals. The FTC has gone after companies for exactly this, but only after the fact.

And an app can be genuinely compliant in the US and still ship your child's data somewhere you'd never approve of, because COPPA doesn't require the data to be useless or safe, only to be collected with consent. Consent isn't the same as protection.

How to actually check an app

You don't need my tools to get a decent read. Spend ten minutes before you hand over the tablet.

Read the privacy policy and search it for the words "third party," "advertising," "partners," and "analytics." If a math app for a six-year-old has a long list of advertising partners, that tells you the business model. The kid isn't the customer. The kid is the inventory.

Look at what permissions the app requests. A flashcard app that wants your location or your contacts is asking for things a flashcard app has no use for.

Check whether it works with the wifi off. If the whole thing runs offline, there's very little it can be quietly sending anywhere. That single test filters out a lot.

And watch for the account wall. If a kids app demands an email and a login before it'll show a single problem, ask why. A math game does not need a mailing list.

The part that actually matters

COPPA is a floor, not a ceiling. It's the least a company can do and still stay on the right side of the FTC. A truly good kids app clears that floor by a wide margin, usually by just not collecting the stuff in the first place.

So when you see the compliant label, treat it as the beginning of the question, not the answer. The real question is simpler and the law can't answer it for you. What is this app doing with my kid's attention, and what is it doing with her data when she's not looking? You can figure that out in an afternoon, and once you've done it for one app, you'll never look at the others the same way.