Planisphere Download for Mac

Defense · COPPA

COPPA for defense AI workflows

COPPA in defense AI workflows: what compliance requires, who asks for evidence, and the records to keep.

Legal forceBinding law
Applies from2026-04-22 (compliance date for the 2025 amendments)
SectorDefense
Checked21 Oct 2026

01 / The rule

What COPPA requires

Operators of commercial websites, apps and online services (including AI chatbots) directed to children under 13, or with actual knowledge they collect personal information from children under 13.

  1. 01Post clear notice and get verifiable parental consent before collecting, using or disclosing a child's personal information.
  2. 02Get separate verifiable parental consent before disclosing a child's personal information to third parties, unless the disclosure is integral to the service.
  3. 03Keep and publish a written data retention policy; keep children's data only as long as reasonably necessary, never indefinitely.
  4. 04Establish, implement and maintain a written information security program suited to the sensitivity of children's data.
  5. 05Let parents review, delete and stop further use or collection of their child's information.

02 / In this sector

In a defense AI workflow

The FTC's 2025 rule preamble states that disclosing a child's personal information to train or otherwise develop AI is not integral to a service and needs separate parental consent. AI chatbots and voice features aimed at children are covered services.

Usually asked by

Program office leads and ATO-package owners.

Named alongside

NIST AI RMF · DoW RAI · OMB M-25-21.

Sector pagePlanisphere for defense

03 / Records

Records to keep

  1. 01Verifiable parental consent records, with separate third-party disclosure consent
  2. 02Written retention policy published in the online notice
  3. 03Written information security program and periodic risk assessments
  4. 04Inventory of third parties receiving children's data and their purposes

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES

Go back to the source

PRIMARY

RELATED

Related: COPPA: the full guide · COPPA for medicine · COPPA for law · COPPA for education