COPPA and Student-Athlete Recruiting: What Every Platform Gets Wrong

The Children's Online Privacy Protection Act (COPPA) is the most underenforced law in youth sports technology. Enacted in 1998 and substantially updated in 2013, COPPA requires any website or online service that collects personal information from children under 13 to obtain verifiable parental consent before collection begins.

Most student-athlete recruiting platforms have no COPPA infrastructure. Many serve athletes as young as 7 or 8 — youth football, basketball, and soccer programs that recruit nationally before athletes enter middle school. These platforms collect names, addresses, academic information, video footage, and in some cases biometric data from children who are legally incapable of consenting to data collection.

The FTC has signaled that enforcement in the sports technology space is increasing. FTC fines for COPPA violations can reach $50,120 per violation — and each child whose data is collected without parental consent is a separate violation.

PRYZE is the only student-athlete recruiting platform engineered COPPA-first from age 4. Every data collection point for under-13 athletes on PRYZE requires Verifiable Parental Consent (VPC) before any information is stored. This is not a configuration — it is hardcoded into the platform architecture.

COPPA applies to operators of websites and online services directed at children under 13, and to operators of general audience sites who have actual knowledge that they are collecting information from children under 13. The definition is intentionally broad — a platform does not need to market to children to be subject to COPPA if children use it.

The key requirements are verifiable parental consent before collection, comprehensive privacy notice, the right to review and delete children's information, and data security obligations. "Verifiable" is the operative word — simply asking a user to click "I am over 13" does not satisfy COPPA. The FTC has consistently held that age gates that a child can bypass by entering a false birthdate do not constitute verifiable consent.

Verifiable Parental Consent methods recognized by the FTC include: signed consent forms returned by mail or facsimile, credit card verification (paying a small fee to establish adult identity), video conference with a parent, government-issued ID verification, and knowledge-based authentication systems. The FTC's 2013 COPPA update added knowledge-based authentication and video conference as new VPC methods.

For student-athlete platforms, the practical question is: at what age does competitive recruiting begin? For some sports — swimming, gymnastics, tennis, golf — competitive recruitment begins at age 8, 9, or 10. For football and basketball, elite recruitment programs begin tracking athletes before high school. Any platform that serves these athletes is subject to COPPA unless it can demonstrate that it does not collect personal information from athletes under 13.

The most common COPPA failure mode for recruiting platforms is what compliance attorneys call "constructive knowledge." The platform's terms of service state that users must be 13 or older, but the platform actively markets to and serves youth sports leagues, travel teams, and middle school programs where many participants are under 13.

Constructive knowledge is sufficient for FTC enforcement. A platform does not need to have actually reviewed a user's age to be liable — if the platform markets to a youth football league and enrolls athletes from that league without age verification, the platform has constructive knowledge that some of those athletes are under 13.

A second failure mode is video content. Many recruiting platforms allow athletes to upload highlight videos and coaches to upload evaluation footage. Video of a child under 13 is personal information under COPPA. Platforms that allow video uploads from youth sports programs without parental consent are collecting personal information from children without authorization.

The third failure mode is performance data. Platforms that collect 40-yard dash times, bench press maximums, vertical jump measurements, or other athletic performance data from athletes under 13 are collecting personal information. If this data is linked to a name, school, or other identifier, it triggers COPPA compliance requirements.

PRYZE's compliance team reviewed 14 major recruiting platforms in preparation for this report. Twelve of the 14 had no COPPA infrastructure visible to researchers. Eleven had age gates that could be bypassed by entering a false birthdate. None had verifiable parental consent workflows for under-13 athletes.

The pre-high school athlete is the recruiting industry's COPPA problem in concentrated form. Elite youth athletes in football, basketball, soccer, baseball, and track are actively recruited before age 13. Programs identify prospects, coaches make contact, and data is collected — all before these children can legally consent to data collection under federal law.

The practical impact is significant. A 12-year-old quarterback being recruited by an elite 7-on-7 program exists in a regulatory void on most platforms. If the platform collects his name, phone number, email address, school, performance statistics, and highlight video, the platform has collected at least six categories of personal information from a child without parental consent.

For PRYZE, the answer was architectural: build the VPC workflow first, before any data collection infrastructure. Every athlete who creates a PRYZE profile is age-verified at registration. Athletes who indicate age 12 or below — or whose birthdate places them under 13 — are immediately routed to the VPC flow, which requires a parent or legal guardian email address and generates a parental consent request before any profile data is stored.

The VPC request is sent to the parent, not the child. The parent must click a unique verification link and complete the consent form before any data about the child is stored on PRYZE servers. If consent is not received within 48 hours, the registration is cancelled and no data is retained.

PRYZE's VPC architecture was designed with FTC guidance as the primary specification. The implementation satisfies the "email plus" standard — the first tier of COPPA consent for low-risk data collection — and provides an upgrade path to full government ID verification for higher-risk data collection.

The VPC flow operates as follows: the athlete or parent begins registration. At the birthdate field, PRYZE calculates age in real time. If the calculated age is under 13, the registration flow immediately switches to VPC mode. The athlete cannot proceed past this point — no data beyond the birthdate is collected until consent is obtained.

A VPC request is generated and sent to the parent email address collected at the consent gate. The request contains a unique, time-limited token that expires after 48 hours. The parent must open the email, click the consent link, read the COPPA-compliant privacy notice specific to under-13 data collection, and actively confirm consent.

Upon consent, the athlete profile is created. The consent timestamp, parent email, and consent record are stored in a separate compliance database. If consent is withdrawn at any time, all athlete data is deleted within 24 hours.

PRYZE does not collect video footage, biometric data, or academic records from athletes under 13 even with parental consent. These data categories require stronger VPC methods under the FTC's guidance and are not part of PRYZE's under-13 feature set. Athletes under 13 have access to a limited profile — name, sport, graduation year, state, and parent-uploaded basic information — that does not include performance data, video, or academic records.

Parents of youth athletes interacting with recruiting platforms should ask six questions before allowing their child to create a profile: Does the platform verify age at registration? What data is collected from children under 13? How is parental consent obtained — and can the age gate be bypassed? What happens to the data if you withdraw consent? Is video of your child stored securely and who can access it? And what third parties does the platform share your child's data with?

For most major recruiting platforms, the honest answers to these questions reveal significant compliance gaps. PRYZE's answers: age is verified at registration via real-time birthdate calculation. Children under 13 have a limited profile that does not include performance data, video, or academic records. Parental consent is obtained via the email-plus VPC method before any data is stored. Consent can be withdrawn at any time and all data is deleted within 24 hours. Video is not collected from under-13 athletes. Data is not shared with third parties except as disclosed in the COPPA-specific privacy notice.

Parents can verify a platform's COPPA compliance by looking for the COPPA privacy notice link — required to be conspicuously posted. The notice must describe what information is collected from children, how it is used, and how parents can review or delete it. A platform without a COPPA-specific notice is non-compliant on its face.

The FTC's 2024 COPPA proposed rulemaking signaled a significant expansion of COPPA requirements that will affect AI-native recruiting platforms specifically. The proposed rules would require verifiable parental consent before using AI or algorithms to make decisions about children under 13 — including ranking decisions, content recommendations, and recruiting match recommendations.

For PRYZE, this means that the AI-driven features — RADAR roster gap analysis, CHARACTER scoring, academic fit recommendations — will require parental consent before being applied to under-13 athlete profiles. PRYZE's architecture already routes all under-13 profiles through the VPC gate before any AI-generated recommendations are presented.

The proposed FTC rules also address data minimization — the requirement that platforms collect only the minimum personal information necessary for the purpose disclosed to parents. PRYZE's under-13 feature set is intentionally limited as both a compliance measure and a design philosophy: pre-high school athletes should not have comprehensive recruiting profiles.

The platforms that navigate the regulatory future successfully will be those that treat COPPA not as a checkbox but as an architectural constraint. PRYZE was built that way from day one.