COPPA works like this: Let’s say your child wants to use features on a site or download an app that collects their personal information. Before they can, you should get a plain language notice about what information the site will collect, how it will use it, and how you can provide your consent. For example, you may get an email from a company letting you know your child has started the process for signing up for a site or service that requires your child to give personal information. Or you may get that notice on the screen where you can consent to the collection of your child’s personal information.

The notice should link to a privacy policy that’s also plain to read — and in language that’s easy to understand. The privacy policy must give details about the kind of information the site collects, and what it might do with the information — say, if it plans to use the information to target advertising to a child or give or sell the information to other companies. In addition, the policy should state that those other companies have agreed to keep the information safe and confidential, and how to contact someone who can answer your questions.

That notice also should have directions on how to give your consent. Sites and services have some flexibility in how to do that. For example, some may ask you to send back a permission slip. Others may have a toll-free number you can call.

If you agree to let the site or service collect personal information from your child, it has a legal obligation to keep it secure.