What Counts as Verifiable Parental Consent
Verifiable parental consent is the FTC's COPPA standard for confirming a real parent, not a checkbox, before a service can collect data from a child under 13. Here is what clears that bar under federal law, and what doesn't.
A thirteen-year-old typing a parent’s email into a signup box and checking “my parent agrees” has not given verifiable parental consent under federal law. Nobody has confirmed an adult did anything at all. Verifiable parental consent (VPC) is the standard the Children’s Online Privacy Protection Rule sets, at 16 CFR Part 312, for any online service that knowingly collects personal data from a child under 13: the method has to be reasonably designed, given available technology, to confirm the person consenting really is that child’s parent.
The Rule names five methods that satisfy this on their own: a signed form returned by mail, fax, or scan; a card charge that sends a transaction notice to the account holder; a toll-free or video call with trained staff; a government ID checked against a database, then deleted; or a knowledge-based identity check. A checkbox clears none of it. Neither does an email a parent never opens.
A 2025 amendment, fully in force since April 2026, raised the bar twice. It folded biometric identifiers into the data VPC now covers, a separate question from whether an ordinary photo counts as biometric data at all. And it added a second, separate round of consent before sharing a child’s data with outside companies for anything beyond running the service itself.
COPPA stops exactly at a thirteenth birthday, so a typical teenage user of a wake-up or accountability app never has to clear this bar at all. What’s worth checking before a fifteen-year-old opens one of those accounts is a different, looser set of questions entirely.