1. Do you know who's on your platform?
- Do you have a process for identifying when children under 13 are present?
- Do you apply COPPA obligations when you have "actual knowledge" that a user is a child – even if they haven't self-declared their age?
- Do you treat mixed-audience platforms (adults and minors) with the same obligations as child-directed platforms?
What regulators ask: "Did you know children were present – and what did you do about it?"
2. Data collection and consent
- Do you obtain verifiable parental consent before collecting personal information from children under 13?
- Is your consent process separate and explicit – not buried in general terms of service?
- Have you mapped all third-party tools and integrations that may collect children's data (analytics, advertising, AI systems)?
- Do you have a clear data retention policy for minors' data?
- Can you delete a child's data on request?
What regulators ask: "What data did you collect, and did you have consent?"
3. Risk detection and documentation
- Can you show how risk developed across a conversation – not just that something was flagged?
- Do you have structured records of what was detected, when, and what action was taken?
- Can you explain why a specific intervention was or wasn't made?
- Is your moderation output audit-ready – meaning it can be presented to regulators or legal counsel?
What regulators ask: "What did you know – and when did you know it?"
This is where most platforms fail. They can show a flag. They cannot show the sequence of events that led to it.
This is the difference between content moderation and behavioral detection.
4. Safety by design
- Are the strongest privacy settings enabled by default for minor users?
- Have you assessed which platform features create risk for minors – messaging, comments, live video, direct contact with adults?
- Do you have mechanisms to detect harmful behavior patterns – not just harmful content?
- Can you demonstrate active protection, not just reactive moderation?
What regulators ask: "How did you design your platform to protect minors?"
5. Incident response
- Do you have a documented process for responding to child safety incidents?
- Can you show law enforcement actionable evidence if required?
- Do you have a process for reporting to NCMEC when required?
- Can you demonstrate what you did – and how quickly – if an incident occurred?
What regulators ask: "What happened, and how did you respond?"
The gap most platforms miss
Moderation tools catch what’s already explicit.
The highest-risk situations – grooming, coercive control, manipulation – don’t start that way.
At first, it looks harmless. A compliment. A joke. A private message.
By the time it becomes explicit, the pattern has already played out.
COPPA compliance isn’t just about having policies. It’s about being able to show what you detected, when, and what you did.
That requires behavioral detection – not just content moderation.
Want to see how your platform would hold up under audit?
Tuteliq helps platforms detect behavioral risk as it develops – across text, voice, images and video – and generate structured, audit-ready output that supports COPPA, DSA and UK Online Safety Act compliance.
Read more or get a 15-minute walkthrough: https://tuteliq.ai/coppa No prep needed. No commitment.