The month a teacher's email made me a COPPA operator (71K MRR)

The email arrived at 4:40 on a Thursday and it was, unambiguously, a nice email. A primary school teacher in Leeds, unprompted, telling me her class had adopted our collaborative whiteboard for their weekly project session. We were at $71,000 MRR, nine people, a general-audience product sold to design teams and small agencies. We had never marketed to schools, and never to children. I forwarded it to the team channel with a heart emoji, and then at about two in the morning I sat up in the dark because I had worked out what that email was.

Quick answer (2026): This diary is a composite, assembled from several real operator situations and one real support thread, with the company, the headcount, the revenue figure and the timeline changed. The law in it is not changed, and every figure below comes from the primary sources I have linked. What I learned is this. For a general-audience product, the thing that puts you inside the children's privacy rule is actual knowledge that you are collecting personal information from a child. The thing that lets the government price a violation at the top of the scale is a knowing violation. They are the same fact. The teacher's email was not a warning that I had a problem. It was the event that created the problem, and it arrived with a heart emoji attached.

Two doors, one fact

The rule is the Children's Online Privacy Protection Rule, 16 CFR Part 312. Its operative prohibition, section 312.3, reaches two kinds of business. The first is an operator of a service directed to children. The second is the one I had just walked into: "any operator that has actual knowledge that it is collecting or maintaining personal information from a child".

I had spent the evening assuming that phrase was a shield. General audience, no child-directed content, nothing in our marketing aimed below about twenty-five. Surely the rule was for the other people. It is not a shield. It is a switch, and somebody else flips it. Before 4:40 on Thursday I was outside the rule. At 4:41 I was inside it, and the only thing that had changed was what I knew.

Then the symmetry got worse. A violation of the rule is not punished by the rule. 15 U.S.C. 6502 bridges it across: "a violation of a regulation prescribed under subsection (a) shall be treated as a violation of a rule defining an unfair or deceptive act or practice". That lands you in the Federal Trade Commission Act, whose civil penalty provision, 15 U.S.C. 45(m)(1)(A), applies to a company that violates such a rule "with actual knowledge or knowledge fairly implied on the basis of objective circumstances that such act is unfair or deceptive and is prohibited by such rule".

Read those next to each other. Actual knowledge is the door in. Actual knowledge is also the element the penalty statute needs. There is no window in which you are inside the rule but not yet exposed to the top of the scale, because the fact that admits you is the fact that prices you.

The category I thought would save me

By Friday morning I had found the phrase I wanted. Mixed audience. We were plainly not a children's product, we plainly now had some children on it, and the rule has a defined term for exactly that. I assumed it was a milder category I could elect into. Here is the definition, and I would ask you to read it slowly, because I did not. A "mixed audience website or online service means a website or online service that is directed to children under the criteria set forth in paragraph (1) of the definition of website or online service directed to children, but that does not target children as its primary audience".

Mixed audience is not an alternative to being directed to children. It is a subset of it. The definition opens by telling you that you are in the first category, then narrows what follows. I had found the escape hatch and it was a room inside the building. What it actually buys is narrow, worth having, and stated per visitor rather than per site: "A mixed audience website or online service shall not be deemed directed to children with regard to any visitor not identified as under 13". The relief attaches one user at a time, to the users who are not children, and only if you asked. It does nothing for the thirty-one children in Leeds.

I looked for the small-company exemption for two hours

This is the part I would most like to save somebody else. I went through the entire rule looking for the thing every other regime has given me: a revenue floor, an employee count, some line below which a nine-person company is simply not the intended target. The count, across the whole of Part 312: "de minimis" appears zero times. "Small business", zero. "Small entity", zero. "Fewer than", zero. "Revenue threshold", zero. "Annual revenue", zero. "Number of employees", zero.

The word "exempt" appears exactly once, and I want to be precise rather than dramatic, because when I found it my heart lifted. It reads: "This definition does not include any nonprofit entity that would otherwise be exempt from coverage under Section 5 of the Federal Trade Commission Act". There is an exemption. It is addressed to nonprofits, and says nothing about a small commercial operator, which is what I am. I had been looking for my exemption. I found somebody else's.

The meter

The printed figure is modest. Section 45(m)(1)(A) says a violator "shall be liable for a civil penalty of not more than $10,000 for each violation". Stop reading there and you will price this wrong by a factor of five. The operative figure is set by regulation and adjusted for inflation: the January 2025 adjustment lists it under the heading for a "knowing violation of rule respecting unfair or deceptive acts or practices" as "Increase from $51,744 to $53,088". The printed ceiling of ten thousand dollars is operationally $53,088, which is 5.31 times the number in the United States Code.

Then the unit. Section 45(m)(1)(C): "each day of continuance of such failure shall be treated as a separate violation". Then the date. The amended rule's dates section says "The amended Rule is effective June 23, 2025" and that "regulated entities have until April 22, 2026 to comply". Four of the ten results I read while panicking still described that deadline as approaching. As I write, it is five months behind us: 153 days, which at $53,088 a day is $8,122,464. Our entire annual revenue is about $852,000.

That number is theatre and I will not hand you a scare I cannot support. It is a maximum, not a prediction, it requires a knowing violation, and the same subsection tells the court to "take into account the degree of culpability, any history of prior such conduct, ability to pay, effect on ability to continue to do business, and such other matters as justice may require". Ability to pay is in the statute. A nine-person company does not get assessed eight million dollars. What the arithmetic is genuinely good for is this: at $53,088 a day, one single day of the ceiling is three quarters of a month of our revenue. You do not need the tail of that distribution to be frightened of the front of it.

The increase that did not happen

I assumed the $53,088 every advisory page quotes was stale. It is the 2025 figure, sitting on pages written in 2025, and these things go up every January. I went looking for the 2026 number so I could correct everybody.

There is no 2026 number. On 15 September 2026, seven days before I am writing this, the Commission published a notice stating that "civil penalty amounts will remain unchanged during 2026" and that "The FTC will continue to apply the 2025 civil penalty levels".

The reason is the best thing I found all week. The adjustment is formula-driven and the formula needs one input: the October Consumer Price Index. The notice explains that the Office of Management and Budget issued a memorandum titled "Cancellation of Penalty Inflation Adjustments for 2026", because "due to the government shutdown" the Bureau of Labor Statistics "was unable to produce the October 2025 CPI-U data, which is needed to make adjustments under the FCPIAA", so there "would be no updated cost-of-living adjustment multiplier for 2026".

The penalty did not rise this year because a shutdown stopped a statistics agency producing a number. Every page quoting $53,088 in 2026 is correct, not one states the reason, and I suspect most do not know it. At last year's 2.597 percent the figure would have been about $54,467, so the freeze is worth roughly $1,379 per violation.

Safe harbor does not mean what I assumed

One more inverted word. I went looking for the safe harbor expecting a good-faith defence I could satisfy myself and point at. Section 312.11 is not that. It describes a programme you join: "Industry groups or other persons may apply to the Commission for approval of self-regulatory program guidelines". Approval belongs to the Commission. And an approved programme must, "By October 22, 2025, and annually thereafter, submit a report to the Commission that identifies each subject operator", containing "copies of each consumer complaint related to each subject operator's violation of a safe harbor program's guidelines".

It is a pipeline carrying your name and your complaints to the regulator once a year. It may be worth joining. It is not a place to hide. Note the timing, too: the amended rule gave operators until April 2026 except for three provisions, and those three are the programmes' own reporting duties, first due October 2025. What bound first was addressed to the watchdogs.

What the fix actually is

The part I expected to be hardest, verifiable parental consent, is not the part that got me. Section 312.10 got me, because it is satisfied by a document and violated by the absence of one. It says personal information "may not be retained indefinitely", and that at a minimum "the operator must establish, implement, and maintain a written data retention policy that sets forth the purposes for which children's personal information is collected, the business need for retaining such information, and a timeframe for deletion of such information". Then it closes the loop: it must appear "in the notice on the website or online service".

You have to write it, and then publish it. So the violation is not a breach or a misuse or anything a customer would ever feel. It is a missing page. Our data handling was fine. Our published page did not exist, and on the reading above it had not existed for 153 days.

What actually happened

What I got wrong

Three things, and the second is the one I would have published if I had written this on Friday.

I was wrong that mixed audience was an escape. I read the phrase, not the definition, and the definition says the opposite of what the phrase suggests.

I was wrong that the widely quoted penalty figure was out of date, and wrong in the direction that would have made me look clever. I had a paragraph drafted correcting everyone. The figure is right. The interesting thing was never that the number was stale, it was why it had stopped moving.

And I was wrong about which obligation would be expensive. I had budgeted for consent flows. What I was actually in breach of was a page on the website.

Limits

This is one operator reading primary sources, not advice, and you should not act on it without someone qualified. Whether any of it applies to you turns on facts about your users I cannot see, and on a multi-factor assessment the Commission performs and I do not. I have priced the ceiling, not the outcome: I found no published enforcement action against a company our size on these facts, and I will not invent one to make the piece land harder. The maximum and the likely result are different quantities, and the statute itself says so. I have also deliberately not named the tools we use, because nothing here turns on a vendor's pricing or feature set.

The one thing I would tell you

Go and find out whether the sentence is true of you, and understand before you look that finding out is the event.

That sounds like an argument for not looking. It is the opposite. The standard in the penalty statute is "actual knowledge or knowledge fairly implied on the basis of objective circumstances", and the second half is doing real work: a studied refusal to look at what is plainly in front of you is not innocence, and is not drafted as though it were.

What you do get is the choice of when. I found out from an unsolicited email at 4:40 on a Thursday, on a schedule set by a teacher in Leeds. The alternative was never staying outside the rule. It was finding out from someone whose next letter has a number in it.

We published the retention policy the following Wednesday. It took an afternoon.