Last update:
COPPA compliance
Aug 21, 2026
The Children’s Online Privacy Protection Act (COPPA) is a U.S. privacy law that protects children under the age of 13. In digital products, COPPA applies when an online service is used by children under 13 or collects personal information from them. In the Aikyam Identity Platform, COPPA is implemented as a product policy. Portals must support age‑based protections and, where required, parental or guardian consent workflows.
At a glance
Each portal must select one COPPA mode:
- Restrictions: Blocks users under 13 from creating an account.
- Consent: Requires parental or guardian approval for users under 13.
COPPA compliance journey
This section describes the end‑to‑end journey a portal owner follows to understand, configure, and enforce COPPA on portals implemented on the Aikyam Identity Platform.
The journey connects compliance understanding, policy decisions, configuration, and automatic enforcement into a single, complete flow.
Scope and audience
This content is intended for:
- Portal owners
- Solution architects
- Identity and security onboarding teams
It applies to any portal that:
- Collects Date of Birth (DOB) or Year of Birth (YOB), and
- May be accessed by users under the age of 13
This guidance applies regardless of portal type (B2B or B2C) or tenant model (OHID, HSID, or non HSID).
Step 1: Onboard a portal on the Aikyam Identity Platform
Portals are onboarded to the Aikyam Identity Platform to provide centralized identity, authentication, and access management.
The platform provides foundational capabilities, including:
- Enterprise grade security and scalability
- Alignment with healthcare and enterprise compliance requirements (for example, HIPAA)
- Standardized registration, login, and identity lifecycle services
At this stage, no COPPA‑specific configuration is required.
Step 2: Review security and compliance requirements
Before onboarding users, portal owners review applicable security and compliance requirements, including:
- Data protection and encryption standards
- Healthcare and enterprise regulatory requirements
- Age‑based privacy regulations, including COPPA
COPPA becomes applicable when age‑related attributes are collected and under‑13 users may attempt to access the portal.
Step 3: Confirm COPPA applicability
COPPA applicability is based on user’s age and collected attributes, not on tenant type or deployment model.
COPPA enforcement is required when both conditions are met:
- The portal collects DOB or YOB
- The portal allows access by external users, including potential under‑13 users
This applies across:
- B2B and B2C portals
- OHID, HSID, and non‑HSID tenants
Step 4: Select a COPPA mode
Each portal must enable one COPPA mode at the portal policy level.
- COPPA restrictions (default)
- Blocks users under 13 from account creation
- Intended for portals not designed for child access
- COPPA consent
- Allows under‑13 users to proceed only after parental or legal guardian consent
- Requires DOB capture to determine eligibility
- COPPA disabled
- Permitted only with documented legal approval
Only one COPPA mode can be active at a time.
Step 5: Configure COPPA in the Aikyam Identity Console
COPPA is configured at the portal policy level in the Aikyam Identity Console.
Configuration includes:
- Enabling DOB or YOB collection
- Selecting one COPPA mode
- Completing a legal review when COPPA is disabled
After the configuration is saved, no additional application‑level logic is required.
Step 6: COPPA enforcement across user flows
After configuration, the Aikyam Identity Platform enforces COPPA automatically and consistently across the user lifecycle. Enforcement occurs at the points where age information is evaluated:
- Registration: Evaluates DOB and applies restriction or consent based on policy
- Fast track registration: Applies COPPA validation through platform APIs
- Single Sign‑On (SSO) and step‑up flows: Enforces COPPA when DOB is collected after initial onboardingApplies to non-members step-up login , portal-initiated step-up flow
- Profile updates: Re‑evaluates COPPA when DOB or YOB is added or updated
Enforcement remains consistent across all applications that share the same identity profile.
Outcome
After completing this journey:
- COPPA is configured once at the portal level
- Enforcement is centralized and policy driven
- User flows remain consistent across registration, authentication, and profile updates
Result: The portal meets COPPA requirements through platform level enforcement without custom implementation or duplicated logic.
Previous:
Security during registration
Next:
User verification (TMX)
Share additional feedback to help us improve.
0/255
|
Powered by Aikyam @2025 All rights reserved
+1 866 451 2735
+1 866 451 2735
+1 855 819 5909