What Is COPPA?

What is COPPA?

COPPA stands for Children's Online Privacy Protection Act. It is a US privacy law that protects children under 13 years old.

If a user is identified as a child, companies cannot collect personal data or track that user for advertising without parental consent. In practical AdTech terms, that means the ecosystem must move away from user-level targeting and rely on contextual advertising.

What COPPA means in advertising

If inventory is child-directed, the following restrictions apply:

• No personalized ads
• No behavioral targeting
• No interest-based targeting
• No tracking cookies
• No device IDs for targeting
• Only contextual ads allowed

So COPPA = no user tracking -> only contextual ads.

Simple AdTech definition

Where COPPA appears in AdTech

COPPA matters because the privacy signal travels all the way through the ad stack:

User -> App/Website -> SSP -> Exchange -> DSP

If COPPA is on, the DSP must treat the impression as child-directed inventory and avoid personal data use.

COPPA in OpenRTB bid requests

In OpenRTB, the relevant field is:

{
  "regs": {
    "coppa": 1
  }
}

This means:

• The impression is from a child-directed environment
• The DSP must not use personal data
• The DSP should bid only contextual ads

If regs.coppa = 0, then normal advertising rules apply.

How COPPA works step by step

Step 1: Publisher identifies child-directed content

Examples include:

• Kids gaming app
• Cartoon website
• Kids learning app
• Toy website
• Kids YouTube channel
• Kids OTT app

The publisher marks that inventory as COPPA = TRUE.

Step 2: SSP adds the COPPA flag

The SSP sends the bid request with the COPPA flag set:

{
  "regs": {
    "coppa": 1
  }
}

This tells the DSP that the impression comes from a child user environment.

Step 3: DSP receives the COPPA request

Now the DSP must change its behavior.

DSP cannot use:

• Third-party audience data
• Retargeting
• Behavioral targeting
• Device ID matching
• Interest segments
• Frequency capping based on user identity
• Lookalike audiences

DSP can use:

• Contextual targeting
• Keyword targeting
• Category targeting
• Content targeting
• Time-of-day targeting
• Broad geo targeting only

In other words, the DSP switches from audience targeting to contextual targeting.

Step 4: DSP decides whether to bid

Many DSPs do not bid aggressively on COPPA inventory because:

• There is no user-level targeting
• CPMs are usually lower
• Available data is limited

That is one reason fill rate may drop.

Real examples

Example 1: Kids gaming app

App: Kids Puzzle Game

User: 8-year-old child

The SSP may send a request like:

regs.coppa = 1
device.ifa = null
user.id = null

The DSP sees:

• No device ID
• No user ID
• COPPA = 1

So the DSP cannot retarget or use audience data. It can only bid contextual ads such as:

• Toys
• Education
• Cartoon movies
• Kids clothing

Example 2: YouTube Kids or Kids OTT

Inventory: cartoon video

SSAI sends the COPPA flag.

The DSP may be allowed to show:

• Lego ads
• Disney ads
• Cartoon movie ads
• School learning apps

The DSP should not show:

• Credit card ads
• Dating apps
• Alcohol ads
• Gambling ads
• Retargeting ads
• Behavior-based ads

COPPA in GAM

In Google Ad Manager, a relevant setting is:

Inventory -> Child-directed treatment

If enabled:

• GAM treats the request as COPPA inventory
• Personalized ads are disabled
• Only contextual line items are eligible
• AdX demand becomes more restricted

COPPA vs GDPR vs CCPA

COPPA is only for children, not adults.

Technical changes when COPPA = 1

Revenue impact

COPPA inventory usually has:

• Lower CPM
• Lower fill rate
• Only contextual demand
• Limited DSP participation

Because there is no user-level targeting, advertisers usually pay less for COPPA inventory.

How SSPs and DSPs handle COPPA

SSP responsibilities

An SSP handling child-directed inventory should:

• Detect child-directed content
• Remove user IDs
• Remove device IDs
• Remove cookies
• Send regs.coppa = 1
• Allow only contextual buyers

If the SSP fails to do this correctly, there is legal and policy risk.

DSP responsibilities

A DSP receiving COPPA inventory should:

• Do not use user data
• Do not retarget
• Do not build user profiles
• Do not store child user information for targeting
• Use only contextual targeting
• Filter restricted ad categories

Full flow diagram

Child User
   ↓
Kids App / Kids Website
   ↓
Publisher Ad Request
   ↓
SSP adds COPPA = 1
   ↓
Exchange
   ↓
DSP receives COPPA request
   ↓
DSP removes audience targeting
   ↓
DSP bids contextual ads only
   ↓
Ad served

Interview questions you may get

One-line summary

COPPA means the impression belongs to a child-directed environment, so DSPs cannot use personal data and can only run contextual ads.