COPPA
COPPA (Children's Online Privacy Protection Act) is a privacy flag that signals to all auction participants that an impression transaction involves a user under 13 years old in the United States. This triggers strict compliance rules that prohibit behavioral targeting, profiling, and personal data collection.
How it works
When a request includes the coppa flag, DSPs must:
- Ignore identifiers: Do not read IDFA, Google Advertising ID, or cookies.
- Disable tracking: Do not store user data for future retargeting.
- Switch to contextual targeting: Select ads based only on app content, such as serving an ad that features building block toys inside a kids' game.
Examples
Bid Request
The coppa flag is passed in the regs object (regulations).
{
"id": "req_12345",
"imp": [{
"id": "1",
"banner": { "w": 320, "h": 50 }
}],
"device": {
"ua": "Mozilla/5.0...",
"ip": "192.168.1.0" // IP address is typically masked (last octet zeroed out)
},
"regs": {
"coppa": 1
},
"user": {
// The id, buyeruid, and eids fields should be absent or empty
}
}
Bid Response
DSPs usually don't need to return the coppa flag in their response (they only have to comply with it). However, they can pass an extension in ext if the exchange's protocol requires proof of compliance. The response looks standard, except that any tracking pixels collecting personal data are prohibited.
{
"id": "req_12345",
"seatbid": [{
"bid": [{
"id": "bid_987",
"impid": "1",
"price": 1.5,
"adm": "<html>...ads without tracking...</html>"
}]
}]
}
Yandex DSP supports the COPPA (Children's Online Privacy Protection Act) signal.