COPPA Redaction: How to Protect a Child's Personal Information

By the SladdPDF team · Published September 12, 2026 · Updated September 12, 2026

A school enrollment form, a youth sports registration, a pediatric intake packet, a summer-camp waiver — records that include a child's data move between schools, camps, healthcare providers, and edtech vendors constantly, and most of that movement has nothing to do with the Children's Online Privacy Protection Act (COPPA) directly. But COPPA's own definition of a child's "personal information" is the most authoritative list available of exactly which fields in those documents need to be minimized before you forward a copy, and the FTC's newly amended COPPA Rule raises the stakes for anyone who operates a service directed at children. This guide covers what the Rule actually protects, what changed in the 2025 amendments, and how to redact a document containing a child's information before it leaves your hands.

What COPPA is, and who it covers

The Children's Online Privacy Protection Act, enforced through the FTC's COPPA Rule at 16 CFR Part 312, applies to operators of commercial websites and online services directed at children under 13, and to any operator with actual knowledge it is collecting personal information from a child under 13. It requires notice to parents, verifiable parental consent before collecting most personal information, and limits on how long that information can be retained and how it can be used or disclosed.

COPPA is narrower than it sounds: it governs online operators, not every school, pediatrician, or camp that happens to hold a paper or PDF record about a child. But the schools, healthcare providers, and youth programs generating those records are frequently the same entities feeding data into COPPA-covered edtech and health platforms, and the Rule's definitions are the clearest available standard for what data about a child deserves the most caution when a document containing it gets shared.

What the 2025 amendments changed

On January 16, 2025, the FTC finalized the first substantive amendments to the COPPA Rule since 2013. The amended Rule was published in the Federal Register on April 22, 2025, took effect June 23, 2025, and set a compliance date of April 22, 2026 for most provisions (a small subset — the Rule's provisions on mixed-audience sites, the definition changes at § 312.11(d)(1) and (d)(4), and § 312.11(g) — took effect earlier, on the Rule's effective date itself).

The amendments respond to how differently children use online services than they did in 2013: they add a standalone parental consent requirement specifically for disclosing a child's personal information to third parties for targeted advertising, tighten data retention so information can only be kept as long as reasonably necessary for the purpose it was collected for (not indefinitely), and add new obligations for the FTC-approved COPPA Safe Harbor self-regulatory programs, including public disclosure of which operators they cover.

What counts as a child's personal information

The amended Rule's definition of "personal information" at 16 CFR § 312.2 is broader than most people expect. It covers the obvious fields — first and last name, home or other physical address, online contact information, telephone number, and Social Security number — but also a photograph, video, or audio file containing a child's image or voice, geolocation information sufficient to identify a street name and city or town, and persistent identifiers that can be used to recognize a user over time and across sites or services, such as a customer number in a cookie, an IP address, a device serial number, or a unique device identifier. The 2025 amendments explicitly add biometric identifiers — fingerprints, voiceprints, retina patterns, and similar data usable for automated recognition of a specific individual — to that list.

Our guides to FERPA redaction for student education records and HIPAA redaction of protected health information cover the two frameworks most likely to overlap with a child's record — a pediatric visit note or a school file will often carry FERPA- or HIPAA-covered fields alongside the categories above.

What to redact from documents involving a child

Most people handling a child's records aren't COPPA-covered operators deciding whether to collect data in the first place — they're a school office, a coach, a camp director, or a parent forwarding a form to someone else. The practical question is what to strip before a copy of that document leaves the original file.

• Full name paired with address or school — redact when sharing with anyone who doesn't already have a legitimate reason to locate the child.
• Photo or video containing the child's face or voice — redact or crop out of a document going to a vendor, printer, or third party outside the original program.
• Social Security number — redact from any copy except the one going to the government agency or financial institution that specifically requires it.
• Device identifiers and account numbers — redact from any usage report or export shared for a purpose other than the original service (a support ticket, a billing dispute).
• Medical or behavioral details — redact unless the recipient is a treating provider or has a documented need to know, consistent with FERPA's or HIPAA's disclosure rules where those apply.

A black box doesn't meet a "cannot be recovered" bar

School and camp forms are often filled out digitally and saved as PDFs with a live, searchable text layer, or scanned as flat images with an attached photo. A rectangle drawn over a name or photo in a markup tool or annotation app typically sits on top of the page content — the text underneath is often still selectable and extractable with copy-paste, and an image behind a drawn box can sometimes be recovered by deleting the annotation layer. That's the opposite of the kind of durable removal a child's data deserves. Our explainer on why a black box is not redaction covers exactly what stays behind.

What actually works is deleting the underlying text and image objects, or rasterizing the page — flattening it into a fresh image with no text layer, no separate annotation objects, and nothing recoverable underneath the mark. That's the approach in our guide to rasterization as the gold standard of PDF redaction, and it's what SladdPDF's Secure mode applies automatically on export.

How to redact a document with a child's data, step by step

A form or record naming a minor is exactly the kind of file that shouldn't be routed through an upload-based "free PDF redactor" — sending a child's name, photo, and address to a third-party server defeats the purpose before you've redacted anything. SladdPDF processes the file entirely on your own device with JavaScript and WebAssembly; nothing is sent anywhere, and it keeps working offline once the page has loaded.

1. Open the document at sladdpdf.com. Load the enrollment form, registration packet, or record in your browser. The file never leaves your device.
2. Decide what the recipient actually needs. A vendor confirming enrollment status needs far less than a treating physician or a school administrator handling the original request.
3. Redact the child's name where it isn't required, plus SSN, address, and any photo or video containing their face or voice. Check every page — the same fields often repeat in a header or an attached form.
4. Export in Secure mode. Secure mode rasterizes each page to a flat image, destroying the text layer and any hidden objects underneath the redactions.
5. Remove the metadata. Enable metadata removal on export so author, title, and originating software are stripped before you send the file.
6. Verify before sending. Open the exported PDF and try to select and copy text over the redacted areas. If nothing is selectable, the redaction held.

This article is general guidance, not legal advice. If you operate a service that may be "directed to children" under COPPA, or you need to determine your own compliance obligations under the amended Rule, consult current FTC guidance or counsel.