A child-directed service owes the full COPPA notice
The requirementstatement
Where the service is directed at children, the policy must carry the COPPA online-notice elements, including the categories of third parties that receive children's data and the purpose.
- Severityseverity
- BlockingBLOCKINGBreaking this rule gets the submission rejected. There is no partial credit.
- When it bitesphase
- Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
- What is checkedobject
- privacy policy children's section
- Where it liveslayer
- Policy pagesPOLICY_PAGE
- How Ekas settles itdetectability
- AI · formAI_FORM
- A semantic question about what you wrote: whether a description matches a use case, whether a name looks like a filed entity. Judged by a model against written criteria.
- What the fix involvesfailureClass
- Fix the policyTERMINAL_POLICY
- The fix lives in your privacy policy or SMS terms. Ekas can generate the missing clauses.
- Who requires itauthorities
- FTC
- When it appliesapplicabilityText
- Applies to every 10DLC registration.
Why this rule existsrationale
A general "we do not target children" section is not a COPPA notice, and a service that is child-directed needs the full one — including the third-party disclosure, which is precisely what the messaging non-sharing clause has to be reconciled with. The FTC enforces this directly, so it is the one place in this layer where the regulator rather than the carrier is the risk.
How to fix itremediation
Publish the COPPA online notice: what is collected from children, how it is used, every category of third party that receives it and why, the parental-consent mechanism, and the parental review and deletion routes. Done when each element is present and specific.
Common mistakespitfalls
- The third-party categories element and the SMS non-sharing clause have to agree. If the notice lists recipients of children's data, exclude messaging opt-in data from that list explicitly, or the two contradict.
Notesnotes
Conditional on the service being child-directed, which no applicability dimension expresses. The criteria pass immediately where nothing in the registration indicates a child-directed service, and record the condition rather than leaving the rule looking universal.
Rules you will hit next
Other policy pages rules at the same severity. A registration is judged as a whole, not rule by rule.
POL-001A privacy policy URL is required on the campaignBlockingBLOCKINGPOL-002A terms and conditions URL is required on the campaignBlockingBLOCKINGPOL-003An uploaded policy document must fit the provider file constraintsBlockingBLOCKINGPOL-005The terms and conditions attestation must be setBlockingBLOCKINGPOL-010Both policy URLs must resolve and return content anonymouslyBlockingBLOCKINGPOL-015The policy host must serve a valid certificate of its ownBlockingBLOCKING
POL-114 is one of 157 policy pages rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.