{"site":{"name":"Koji","description":"AI-native customer research platform that helps teams conduct, analyze, and synthesize customer interviews at scale.","url":"https://www.koji.so","contentTypes":["blog","documentation"],"lastUpdated":"2026-07-28T13:29:22.684Z"},"content":[{"type":"documentation","id":"36dac471-3ff8-43a1-b0c3-7be865505c1b","slug":"user-research-with-children-teens","title":"User Research With Children and Teens: COPPA, Parental Consent, and Assent","url":"https://www.koji.so/docs/user-research-with-children-teens","summary":"COPPA requires verifiable parental consent before collecting personal information from children under 13, including audio recordings of a child voice. The amended COPPA Rule (published 22 April 2025, effective 23 June 2025, full compliance 22 April 2026) requires a SEPARATE verifiable parental consent before a child personal information is disclosed for training or developing AI technologies, and prohibits indefinite retention. Parental consent and child assent are distinct requirements - both are needed. For most product teams the recommended approach is parent-mediated research: interview the parent about purchase decisions and observed child behavior, use analytics for behavior, and run properly consented child sessions only when a question genuinely requires the child voice. COPPA stops at 13 but state privacy laws and GDPR Article 8 (age 16, lowerable to 13 by member state) impose duties for teens.","content":"## The short answer\n\n**If you collect personal information from children under 13, COPPA requires verifiable parental consent before collection — not after, and not as a checkbox the child clicks.** For 13–17 year olds COPPA does not apply, but a growing number of state privacy laws impose their own duties around minors, and ethical obligations apply at every age.\n\nFor most product teams, the right answer is not \"build a COPPA-compliant child research pipeline.\" It is:\n\n**Research the parent. Bring the child in deliberately, rarely, and with proper consent in place.**\n\nParents are usually the buyer, the payer, the installer, and the person who churns. In family products, the purchasing decision very often lives entirely with the adult — so a great deal of the insight you need is available without touching child data at all.\n\n> Not legal advice. COPPA enforcement is active and the Rule was recently amended; confirm your specific approach with counsel before collecting from minors.\n\n## What COPPA covers\n\nCOPPA applies to operators of websites and online services **directed to children under 13**, and to any operator with **actual knowledge** that it is collecting personal information from an under-13 user. \"Personal information\" is broad: name, email, phone, persistent identifiers, photos, video, and **audio recordings of a child's voice**.\n\nThat last item matters for research. A recorded voice interview with a 10-year-old is squarely personal information.\n\n**The Rule was amended recently.** The FTC published final amendments in the Federal Register on **22 April 2025**, effective **23 June 2025**, with a full compliance deadline of **22 April 2026** — so the amended requirements are now fully operative. The changes most relevant to research teams:\n\n- **A separate verifiable parental consent is required before disclosing a child's personal information to third parties for targeted advertising *or for training or developing AI technologies*.** Read that twice if you run research through any AI platform. Consent to participate in a study is not consent to use that child's data for model training.\n- **Retention is explicitly limited.** Operators may keep a child's personal information only as long as reasonably necessary for the specific purpose it was collected for, and may **not** retain it indefinitely. A written, published retention policy is expected.\n- **Consent methods were expanded**, including knowledge-based authentication, photo-identification matching by phone or web, and using a mobile telephone number for text-message consent.\n\nThere are eight approved methods for obtaining verifiable parental consent under the amended Rule. All of them are meaningfully more work than an email checkbox — and that friction is the point.\n\n## Consent vs assent: two different things\n\nThis distinction is the mark of a team that knows what it is doing.\n\n- **Parental consent (permission)** is the legal instrument. A parent or guardian authorizes the child's participation.\n- **Assent** is the child's own affirmative agreement, in language they actually understand.\n\nYou need both. A parent cannot consent away a child's unwillingness. If an 8-year-old goes quiet, gets restless, or says they would rather stop, the session ends — regardless of what the consent form says or whether the incentive has been paid.\n\nPractical assent script, at the child's reading level: *\"We're trying to make this app better for kids your age. I'll ask some questions about what you liked and what was confusing. There are no right answers, and you can skip anything or stop whenever you want. Is that okay with you?\"*\n\n## The parent-mediated pattern (start here)\n\nFor the large majority of consumer, edtech, and family-product research, this sequence answers the business question without collecting child data:\n\n1. **Interview the parent about the purchase and the friction.** Why they chose it, what nearly stopped them, what would make them cancel. This is standard adult research with standard consent.\n2. **Have the parent report observed child behavior.** What the child actually does, where they get stuck, what they abandon. Parents are imperfect but useful proxies for behavior, and excellent sources on *their own* decision-making.\n3. **Use product analytics for behavior** rather than asking children to self-report it.\n4. **Only then**, if a specific question genuinely requires the child's own voice — comprehension, delight, confusion at a particular step — run a small, properly consented child session, ideally moderated and observed.\n\nSteps 1–3 answer most roadmap questions. Teams skip to step 4 far too quickly, and it is both the most expensive and the most legally loaded option.\n\n## If you do research directly with children\n\n**Get verifiable parental consent using an approved method, before any collection.** Not a click-through, not an email to an address the child typed in.\n\n**Collect as little as possible.** Prefer text over voice — a voice recording is biometric-adjacent and a stronger category of data. See [interview recording consent laws](/docs/interview-recording-consent-laws) for why voice raises the stakes. Skip anything you do not need: no full names, no schools, no photos.\n\n**Go through the school when relevant — and expect two gatekeepers.** School districts approve separately, and student education records fall under FERPA. School approval is not a substitute for parental consent, nor the reverse.\n\n**Expect IRB involvement in regulated or published work.** Federally regulated research with children falls under additional protections (Subpart D of the Common Rule). See [IRB approval for user research](/docs/irb-approval-user-research).\n\n**Design for the age, not for adults:**\n\n| Age | Session design |\n|---|---|\n| Under 6 | Observation with caregiver present; almost no verbal interviewing |\n| 6–9 | 15 minutes maximum, concrete tasks, show-me rather than tell-me, caregiver nearby |\n| 10–12 | 20–25 minutes, concrete language, avoid hypotheticals entirely |\n| 13–17 | Closer to adult sessions, but expect strong social-desirability effects |\n\nTwo persistent methodological problems with young participants. **Acquiescence** — children are primed by school and home to give adults the answer they seem to want, so avoid leading questions and yes/no framings where a \"yes\" is the agreeable answer. **Hypotheticals do not work** — \"would you use a feature that...\" produces noise. Ask about what happened yesterday, and watch them do the task.\n\nFor teenagers, social desirability is the dominant risk. A 15-year-old will underreport anything embarrassing to an adult moderator, which is exactly where an AI interviewer earns its keep: participants disclose more candidly to a non-judging interviewer, a pattern documented across sensitive-topic research. See [social desirability bias](/docs/social-desirability-bias).\n\n## Teens, and the laws that are not COPPA\n\nCOPPA stops at 13, but obligations do not. Most of the 20 US state comprehensive privacy laws now treat certain minor data as **sensitive**, requiring opt-in consent, and several restrict targeted advertising and data sales involving minors up to 16 or 18. Under **GDPR Article 8**, the digital age of consent is 16, though member states may lower it to as low as 13 — so the threshold genuinely varies by country. If you research teens across the EU, check per-country.\n\n## How to run this on Koji\n\nBe clear-eyed about what the platform is for: **Koji is built for business and consumer research with adults, and the parent-mediated pattern above is the intended path.** Use it to interview parents, teachers, administrators, and teens at scale — and treat direct under-13 collection as a specialist exercise requiring verifiable parental consent machinery you have deliberately put in place, plus a review of platform terms with your legal team.\n\nWhere it fits well:\n\n- **Parent and caregiver research at volume.** [AI voice interviews](/docs/ai-voice-interviews) let you run 50 parent conversations in the time a moderator would run six, which is what makes the parent-mediated pattern practical rather than aspirational.\n- **Teacher and administrator research** for edtech — see [AI research for edtech](/docs/ai-research-for-edtech) and [student satisfaction surveys](/docs/student-satisfaction-survey-guide).\n- **Text mode for younger or sensitive participants**, avoiding audio collection entirely. [Voice vs text interviews](/docs/voice-vs-text-interviews) covers the tradeoff.\n- **Structured questions keep sessions short and age-appropriate.** The six types — `open_ended`, `scale`, `single_choice`, `multiple_choice`, `ranking`, `yes_no` — let you ask a 12-year-old to pick or rank rather than compose a paragraph, with AI follow-up probing only where an open answer adds something. Capping follow-ups keeps a session inside a young participant's attention span. See the [structured questions guide](/docs/structured-questions-guide).\n- **Minimal data by design.** Scope studies to avoid identifiers, and set a retention limit that satisfies COPPA's \"not indefinitely\" requirement — see [research data retention and deletion](/docs/research-data-retention-deletion) and [anonymizing customer interview data](/docs/anonymizing-customer-interview-data).\n\nOn AI training specifically: the amended COPPA Rule requires **separate** verifiable parental consent before a child's personal information is disclosed for training or developing AI technologies. Before running any study involving minors, confirm in writing how your platform and its sub-processors handle research data with respect to model training, and document the answer — see [enterprise security for AI research platforms](/docs/enterprise-security-ai-research-platforms).\n\n## Common mistakes\n\n1. **Treating a child's click as consent.** COPPA requires *verifiable parental* consent through an approved method.\n2. **Getting parental consent and skipping the child's assent.** Ethically insufficient, and it produces bad data from an unwilling participant.\n3. **Assuming study consent covers AI training.** The amended Rule requires a separate consent for that disclosure.\n4. **Recording voice when text would do.** Audio of a child's voice is personal information with a higher risk profile.\n5. **Assuming school permission covers parental consent.** Two separate gatekeepers, plus FERPA.\n6. **Asking children hypothetical questions.** Ask about yesterday; observe the task.\n7. **Keeping child data indefinitely.** The amended Rule prohibits it and expects a published retention policy.\n8. **Going straight to child sessions** when parent interviews and analytics would have answered the question.\n\n## Related Resources\n\n- [Structured Questions Guide](/docs/structured-questions-guide) — short, age-appropriate instruments with controlled probing\n- [Interview Recording Consent Laws](/docs/interview-recording-consent-laws) — why voice raises the stakes with minors\n- [IRB Approval for User Research](/docs/irb-approval-user-research) — when vulnerable-population protections apply\n- [Research Data Retention and Deletion](/docs/research-data-retention-deletion) — meeting the \"not indefinitely\" requirement\n- [AI Research for EdTech](/docs/ai-research-for-edtech) — teacher, administrator, and institutional research\n- [Social Desirability Bias](/docs/social-desirability-bias) — the dominant risk with teen participants\n- [Trauma-Informed User Research](/docs/trauma-informed-user-research) — for sensitive topics with young participants\n- [Research Consent Form Templates](/docs/research-consent-form-templates) — consent language to adapt","category":"Research Operations","lastModified":"2026-07-27T03:19:42.141406+00:00","metaTitle":"User Research With Children and Teens: COPPA and Parental Consent","metaDescription":"Researching under-13s requires COPPA verifiable parental consent - plus a separate consent before child data trains AI. The compliance path, the parent-mediated alternative, and age-appropriate session design.","keywords":["user research with children","coppa compliance research","parental consent user research","research with teens","child assent research","coppa verifiable parental consent","ux research kids","interviewing children research","minors data privacy research","edtech student research consent"],"aiSummary":"COPPA requires verifiable parental consent before collecting personal information from children under 13, including audio recordings of a child voice. The amended COPPA Rule (published 22 April 2025, effective 23 June 2025, full compliance 22 April 2026) requires a SEPARATE verifiable parental consent before a child personal information is disclosed for training or developing AI technologies, and prohibits indefinite retention. Parental consent and child assent are distinct requirements - both are needed. For most product teams the recommended approach is parent-mediated research: interview the parent about purchase decisions and observed child behavior, use analytics for behavior, and run properly consented child sessions only when a question genuinely requires the child voice. COPPA stops at 13 but state privacy laws and GDPR Article 8 (age 16, lowerable to 13 by member state) impose duties for teens.","aiPrerequisites":["Experience running adult user interviews with standard consent","Awareness of whether your product is directed to children under 13"],"aiLearningOutcomes":["Determine whether COPPA applies to your research and what verifiable parental consent requires","Distinguish parental consent from child assent and obtain both correctly","Apply the parent-mediated research pattern to answer most questions without collecting child data","Design age-appropriate sessions that avoid acquiescence and hypothetical questions","Handle the amended COPPA requirement for separate consent before AI training use"],"aiDifficulty":"intermediate","aiEstimatedTime":"16 min read"}],"pagination":{"total":1,"returned":1,"offset":0}}