Privacy by Design Starts at Home: What the New COPPA Rules Teaches Us About Raising Privacy-Literate Kids

Earlier this week, I read Privacy, Please! by Lorrie Faith Cranor with my daughter — an appropriately timed read, given that the Federal Trade Commission’s updated Children’s Online Privacy Protection Rule reached its compliance deadline. Two moments. One shared lesson on methods to enhance protections for children.

As a privacy consultant, I aim to help organizations build programs that meet regulatory expectations. As a mom, I spend my evenings teaching my daughter to recognize those same concepts in her own life. What has struck me lately is how much the two roles overlap, and how much earlier we should begin teaching the latter.

What Just Changed in the Industry

If you have not been following the COPPA rewrite, here is the short version. The FTC’s updated rule, which took effect last June and became enforceable this week, raises the minimum standard for how companies handle children’s data. A few of the most consequential changes include:

• The definition of “personal information” now expressly includes biometric identifiers and government-issued IDs, closing gaps left in the 2013 rule.

• Companies must obtain separate, opt-in parental consent before using children’s data for targeted advertising or sharing it with third parties. Bundling consent into a single checkbox is no longer acceptable.

• Operators are required to maintain a written data retention policy and an information security program, ensuring children’s data is not stored indefinitely without purpose.

• Parents must be informed of third-party vendors before their child’s information is shared with them.

  
  

My take: Regulators are enforcing rules that require privacy to be a priority designed into the

product or service from the beginning, considered at every layer, and revisited continuously as products and people evolve. This is a push for privacy by design, which coincidently turns out to be excellent parenting advice too.

The Same Principles, a Different Audience

The principles privacy professionals use at work translate directly to the conversations we should be having with our children at home.

• Data minimization is the principle that you should collect only what you need, and nothing more. At home, it sounds like: you don’t have to answer every question someone asks you. A child who learns early that responding“I have nothing to say” is an acceptable response.

• Purpose limitation means information collected for one reason should not be repurposed for another. At home, if you share something with a friend, it is for that friend, not for a group chat, not for a video, and not for a stranger your friend met online.

• Consent in regulation means meaningful, informed, and revocable agreement. In more familiar terms, permission is required and you have the right to decline. At home, it begins with body autonomy. You decide who hugs you, who photographs you, and what happens to images of you. Digital consent is the same muscle applied in a different context.

• Retention limits require that data not be kept longer than necessary. At home, the internet has a long memory, so choose carefully what is worth remembering.

• Vendor oversight requires knowing who data is shared with. At home, this looks like understanding which apps, games, and platforms your child uses, and recognizing that your child’s privacy is only secure if their friends follow the same rules. 

  
  

None of these translations are a stretch, they are simply the same principles written for a different audience.

Why Starting Early Is the Real Compliance Strategy

During my experience supporting privacy initiatives in big tech, I have seen what happens when organizations treat privacy as an afterthought. Systems are rebuilt. Launches are delayed. Fines are paid.

The most effective privacy programs are always the ones designed correctly from the beginning. Children are no different.

A child who first encounters privacy only after something has gone wrong such as a photo shared without permission, learns the lesson too late. What is shared online becomes part of a child’s digital DNA — often permanent, often beyond their control. In contrast, a child who grows up with privacy vocabulary and awareness, who has been asked from an early age what they want to share and what they want to keep, approaches every new app and interaction with stronger instincts already in place.

The earlier a child has the words, the sooner they can use them to protect themselves from platforms, from peers, and sometimes from their own decisions.

Where to Begin at Home

You do not need a law degree or a certification to raise a privacy-literate child. You need consistent habits and simple conversations. Privacy, Please! by Lorrie Faith Cranor is a great entry point for early readers. It introduces personal boundaries, body autonomy, and digital safety in language children can understand, while giving parents a shared vocabulary to build on.

Consider new habits worth building alongside the book:

• Run a simple family data inventory once a year. Which apps have your child’s name, photo, voice, or location? Delete what is not necessary.

• Teach three simple questions before sharing anything online:Who will see this? How long will it last? What could it be used for later?

• Treat privacy settings as a shared activity, not a parental override. When children help configure them, they learn those controls exist and that they are theirs to use.

  
  

Regulators are raising the standard for how companies handle data. Our children deserve that same standard at home. The earlier we start the conversation, the better prepared they are for every platform, every friendship, and every decision ahead.

Explore the FairFacts Privacy & Digital Safety Toolkit for curated resources that support privacy and responsible digital behavior at home, at work, and while traveling, including the book Privacy, Please! by Lorrie Faith Cranor.