Kids' clubs and family promotions: the federal privacy and email rules to check first

What to take away

Why family promotions need their own check

Local promotion often leans on families. A bakery runs a birthday club, a pizzeria prints a coloring sheet with a web address, a bookshop hosts a reading night with a prize draw. Each can move a child's details into your email list, your website forms or your advertising tags. Our email marketing guide assumes adult subscribers, and the picture changes when the person behind the address is a child.

This article covers United States federal law only, drawn from the FTC's business guidance and the rule text. State statutes can add duties and are outside the sources used here.

Step one: who is the form talking to?

Sort each promotion by who fills in the form and what is collected. The rows reflect the FTC guidance described below.

On the paper row: the FTC's COPPA FAQ describes the rule as covering personal information collected online from children. Editorial suggestion: if staff copy paper cards into an email tool, record that step, because from then on you run an email list and CAN-SPAM governs what you send. The FTC's CAN-SPAM guide does not address text messages, which are governed by separate rules; our note on FTC rules for local ads touches on consent for promotional texts.

CAN-SPAM: the core duties for every promotional email

The FTC's CAN-SPAM guide for business sets out these requirements for commercial email in the United States. The guide numbers eight points; the list below groups related ones:

The FTC page states that each separate email in violation is subject to penalties of up to $53,088. The page carries a note that it was edited in January 2024 for inflation-adjusted penalty amounts, and the maximum is adjusted over time, so read the current figure before quoting it.

Two details matter here. The guide builds its duties around opt-out and sets no general rule that a recipient must agree before the first message arrives. It also says a message whose primary purpose is transactional or about an existing relationship is exempt from most provisions, though it may not carry false or misleading routing information, and it describes the transactional categories as narrow. Editorial suggestion: a birthday message that is mostly a coupon is promotional, so give it the full set of duties.

COPPA: when a promotion reaches children

The FTC's six-step COPPA plan begins with coverage. You are covered if your website or online service is directed to children under 13 and you collect personal information from them or let others collect it. You are also covered if you run a general-audience service and have actual knowledge that you collect it from a child under 13.

No single feature decides whether a page is directed to children. The FTC FAQ says the agency considers the totality of the circumstances, including subject matter, visual content, animated characters and child-oriented activities or incentives, music, the age of models, child celebrities, language, whether advertising on the service appeals to children, audience data and evidence of the intended audience. A page with cartoon mascots, games and a "kids' club" box reads differently from a catering page that mentions a children's menu.

"Personal information" goes beyond a name and address. The plan lists names, physical addresses, online contact information, screen names that work as contact information, telephone numbers, government identifiers, geolocation precise enough to identify a street and city, persistent identifiers that recognize a user over time and across sites, photos, video or audio of a child, and biometric identifiers. The FAQ's examples of persistent identifiers include a cookie-held customer number, an IP address and a device serial number. Because persistent identifiers count, a third-party advertising tag on a child-directed page can amount to collection even if no child types anything; the FTC plan also lists ad networks and plug-ins that know they collect from a child-directed site among covered parties.

What a covered operator must do

The 2025 amendments

The FTC announced final COPPA Rule changes on January 16, 2025. Operators must obtain separate verifiable parental consent before disclosing a child's personal information to third parties, unless the disclosure is integral to the service (16 CFR 312.5(a)(2)). Under 16 CFR 312.10, personal information collected online from a child may be kept only as long as reasonably necessary for the purpose it was collected, and not indefinitely. The Federal Register notice gives June 23, 2025 as the effective date and April 22, 2026 as the compliance date, except for a few safe-harbor provisions. Editorial suggestion: find out which ad platforms and analytics vendors receive data from any child-directed page you run.

Exceptions that fit small promotions

Section 312.5(c) lists situations where collection can proceed without full prior parental consent. Three suit a local business:

Editorial suggestion: when in doubt, collect less. A birthday club needs a parent's email and a birth month more than a child's surname.

Mixed audiences, age screens and photos

If your site is aimed at everyone, children may still sign up. The FAQ says a general-audience site does not become "mixed audience" just because some children use it. A mixed-audience service must ask age before collecting personal information, and cannot collect an under-13 user's information without notice and verifiable parental consent. It cannot simply block children.

The age screen must be neutral: let users enter their age accurately, such as a free entry of month and year of birth, with no default of 13 or older and no hint that features are unavailable to younger users. FTC staff suggest a cookie to stop a child from going back and changing the answer. A math problem alone is inadequate.

Photo walls and drawing contests raise a separate point. The FAQ treats a photo, video or audio file showing a child's image or voice as personal information. A child-directed site must either pre-screen and delete such content from children's submissions or get parental notice and consent first. The FAQ says the rule does not cover information collected from adults that happens to concern children, but a child-directed site has to assume an uploader may be a child.

Enforcement and vendors

The FTC states that it enforces CAN-SPAM and the CAN-SPAM Rule, and the COPPA Rule is an FTC regulation. States have a route too: under 15 U.S.C. 6504, a state attorney general who has reason to believe that residents' interests are threatened or harmed by a practice that violates the FTC's COPPA regulation may bring a civil action in a federal district court. The attorney general must give the FTC written notice and a copy of the complaint, or do so at the same time as filing if earlier notice is not feasible.

Using an agency or email platform does not move your responsibility elsewhere; the FTC's CAN-SPAM guide says you cannot contract away your legal responsibility. Editorial suggestion: ask each vendor in writing who processes opt-outs and which tags load on child-facing pages. Our email marketing mistakes article covers what goes wrong when opt-outs do not carry across systems.

A short review for each family promotion

This article is general information, not legal advice. Penalty amounts and compliance dates change, so confirm them on the current FTC pages and in the rule text before you act.

Sources