COPPA Under-13 Collection Restriction

What it is

The Policy states that UnitedHealthcare will not intentionally collect personal information from children under 13 without parental consent, consistent with COPPA requirements, and provides a mechanism for reporting suspected under-13 data collection.

Why it matters (compliance & governance perspective)

This provision establishes COPPA compliance intent for Online Services that may be accessed by minors in the context of family health plan management or dependent benefit access. The qualifier 'intentionally' in the collection restriction, rather than an absolute prohibition, reflects standard COPPA framing but leaves open the question of how unintentional under-13 data collection would be identified and addressed operationally.

Consumer impact (what this means for users)

Under this clause, personal information from children under 13 will not be collected through UnitedHealthcare's Online Services without parental consent. Parents or guardians who believe a child's information has been collected should contact UnitedHealthcare directly using the contact information in the Policy.

Institutional analysis (regulatory & governance intelligence)

1. REGULATORY LANDSCAPE: This provision directly addresses the Children's Online Privacy Protection Act, enforced by the FTC. COPPA requires verifiable parental consent before collecting personal information from children under 13 and imposes data retention and deletion obligations. The qualifier 'intentionally' in the Policy language reflects standard COPPA operator framing where services are not directed at children but may be incidentally accessed by minors. 2. GOVERNANCE EXPOSURE: Low. For a health insurance platform primarily serving adult members, COPPA exposure is generally limited to incidental minor access scenarios. However, dependent coverage management features through which parents manage coverage for minor children may create contexts where minor personal information is processed, warranting a COPPA applicability analysis for those specific features. 3. JURISDICTION FLAGS: COPPA applies federally across the US. Several states have enacted children's privacy laws with broader age thresholds, including California's Age-Appropriate Design Code Act covering users under 18 and Connecticut's children's privacy provisions. These state frameworks may impose obligations beyond COPPA's under-13 scope. 4. CONTRACT AND VENDOR IMPLICATIONS: Third-party vendors and analytics providers operating on UnitedHealthcare's Online Services should be contractually restricted from collecting personal information from users identified as under 13. COPPA's operator and third-party service provider framework requires that such restrictions flow through to applicable vendors. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should assess whether dependent coverage management features or family health account tools on the Online Services constitute services directed at children for COPPA purposes, and whether additional verifiable parental consent mechanisms are required for those specific features. California's Age-Appropriate Design Code Act may impose broader obligations for users under 18 in that state.

Applicable agencies

Provision details

Other risks in this policy

• Combination of Online and Offline Information high
• Company May Change Policy at Any Time high
• Company Right to Remove or Edit Social Media Content high
• Consent to US Data Transfer Processing high
• Continued Use Constitutes Consent to Policy Changes high
• Do Not Track Signals Not Honored high