Is it safe to give my child’s information to a money app?

It is as safe as the app’s answers to five questions: who creates the account, what it stores, who else receives the data, whether voice and camera are off by default, and how you delete data. COPPA sets a legal minimum for children under 13, but it does not stop an app from collecting more than it needs.

What age does COPPA protect children until?

COPPA covers children under 13. From 13 the law’s parental consent rules no longer apply, so for a teenager the app’s own privacy policy and settings are the main protection. Look for the same things as for a younger child: what is stored, who receives it, and how to delete it.

What is verifiable parental consent?

It is a method the FTC recognises for confirming that a parent, and not the child, agreed to data collection. The FTC’s list includes a signed form, a payment transaction that notifies the account holder, a call with trained staff, a checked government ID, approved challenge questions, and a photo ID matched to a second photo.

What did the 2025 COPPA update change?

The amended rule requires separate parental consent before a child’s data is disclosed to third parties, unless the disclosure is integral to the service. It also requires a written information security program and a written data retention policy, and it bars keeping children’s data indefinitely. Most operators had until 22 April 2026 to comply.

Does a kids’ money app need a debit card or a bank link?

No. Some apps issue a card, and others only track spending that the family enters. A tracker with no card and no bank connection holds less of your child’s financial data. CapKin is one example: a child logs spending by typing or voice, and a parent approves it. It has no card and no bank connection.

By Artem Panasiuk · 4 November 2026 · 10 min read

Is a Kids’ Money App Safe? What COPPA Requires and 7 Things to Check

A money app for children collects more than it seems to: a name, a stream of purchases, sometimes a voice or a camera. In the US, one federal rule decides what an app may do with that data when the child is under 13, and its latest changes became enforceable in April 2026. This guide explains the rule in plain terms and gives you seven checks to run before your child opens a money app.

The short version

The Children’s Online Privacy Protection Act (COPPA) covers children under 13, and operators must get verifiable parental consent before collecting their personal information, which includes names, contact details, photos, audio of a child’s voice, geolocation and persistent identifiers (Federal Trade Commission, COPPA FAQ).
The amended COPPA Rule was published on 22 April 2025, took effect on 23 June 2025, and gave most operators until 22 April 2026 to comply (Federal Register). It requires separate parental consent for disclosing a child’s data to third parties, a written information security program, and a written data retention policy that rules out keeping data indefinitely.
Parents can review their child’s personal information, have it deleted and refuse further collection, and an operator must describe how in its privacy policy (FTC, COPPA FAQ). Courts can impose civil penalties of up to $53,088 per violation.
A rule-compliant app can still collect more than a money tracker needs. Check who creates the account, what is stored, who else receives it, whether voice and camera are off by default, and how deletion works.

A kids’ money app is as safe as its answers to a short list of questions: who can create the child’s account, what it stores, who else receives the data, how long it keeps it and how you delete it. COPPA sets the legal minimum for those answers in the US. This article covers that minimum, the 2025 changes, and a seven-point check you can run in ten minutes. It is general information and not legal advice.

What does COPPA protect in a kids’ money app?

COPPA protects the personal information of children under 13 that a website or online service collects. The Federal Trade Commission (FTC), which enforces the law, lists what counts as personal information in its COPPA FAQ. Several items on that list turn up in a money app without anyone intending it, so the table below pairs each with a place you would meet it.

What the FTC counts as personal information	Where it appears in a money app
First and last name, home address	A child profile that asks for a full name or a delivery address
Online contact information, or a screen name that works as contact information	An email address or username used to sign in
Persistent identifiers that recognise a user over time and across sites or services	Advertising IDs and cross-site trackers in the app
Photos, videos or audio files containing a child’s image or voice	A voice note used to log a purchase
Geolocation precise enough to identify a street and city	A “spent near here” feature
Information about the child or parents combined with an identifier	A purchase history tied to a named account

The FTC’s list continues past these rows to include phone numbers and Social Security numbers. A money app has no reason to ask a child for either. For a wider look at what different apps ask for, see our guide to money apps for kids without a debit card.

What changed in the COPPA rule in 2025 and 2026?

The FTC finalised the first major rewrite of the COPPA Rule in over a decade, and the deadline for operators to comply passed on 22 April 2026. The Commission approved the final rule on 16 January 2025 by a 5-0 vote. It appeared in the Federal Register on 22 April 2025, took effect on 23 June 2025, and gave regulated entities until 22 April 2026 to comply, with a few exceptions.

Timeline of the 2025 update to the COPPA Rule in four steps. On 16 January 2025 the Federal Trade Commission approved the final rule by a 5 to 0 vote. On 22 April 2025 it was published in the Federal Register. On 23 June 2025 it took effect. On 22 April 2026 the compliance deadline passed for most operators. Below the timeline, three new duties are listed: separate parental consent before a child’s data goes to third parties, a written information security program, and a written data retention policy that rules out keeping data indefinitely.

Three duties matter most to a parent choosing an app.

Separate consent for sharing. An operator must let a parent agree to collection and use of a child’s information without agreeing to disclosure to third parties, unless the disclosure is integral to the service. Where it is not, the operator needs separate verifiable parental consent for it (16 CFR 312.5, as amended).
A written security program. Operators must establish, implement and maintain a written information security program for the personal information they hold (16 CFR 312.8).
A written retention policy. Children’s personal information may not be retained indefinitely. Operators keep it only as long as reasonably necessary for the purpose it was collected for, and they must maintain a written data retention policy (16 CFR 312.10; FTC press release, 16 January 2025).

These duties apply to an app because of what it does with data, whatever its marketing says. They are also the three places a privacy policy is easiest to check: look for who receives data, how it is protected and how long it is kept.

Is a child’s voice recording personal information?

Yes. Under COPPA an audio file that contains a child’s voice is personal information, so an app that lets a child speak a purchase aloud is collecting it. The FTC has a limited enforcement policy for audio used only as a replacement for typed words, such as a voice search. It requires a clear online notice, brief retention and no other use of the file.

That policy gives you three things to look for in a money app with voice entry: a plain notice at the point where voice is switched on, a statement of how long the recording is kept, and a promise that it is used only to produce text. CapKin handles voice this way for children: it is off until the parent turns it on, and the audio is deleted as soon as it has been transcribed. Our post on voice expense tracking explains the transcription step.

An app must get verifiable parental consent before it collects a child’s personal information, using a method the FTC recognises. The FTC’s COPPA FAQ lists several. The FAQ also lists “email plus” for operators that use the information only internally. A simple email that only links to the privacy policy does not meet the direct notice requirement.

Consent method listed by the FTC	What the parent does
Signed consent form	Returns it by mail, fax or electronic scan
Payment system for a monetary transaction	Makes a payment, and the account holder is notified of each transaction
Phone or video call	Speaks to trained personnel on a toll-free number or a video conference
Government-issued ID	Has it checked against databases, and the ID is deleted promptly afterwards
Knowledge-based challenge questions	Answers questions approved by the Commission
Photo ID with facial recognition	Compares a photo ID with a second photo, a method approved by the Commission

The direct notice to a parent has its own content rules. It says what is collected, that nothing will be collected without consent, how to give consent and where the privacy policy is. CapKin’s approach is structural: only the household owner, who is an adult with an account, can create a child profile, and CapKin records when and by whom that was done. CapKin describes this as built to comply with COPPA. That is the company’s own statement and not a certification.

What can you ask a kids’ money app to do with your child’s data?

You can ask it to show you the data, delete it and stop collecting more. The FTC’s COPPA FAQ names these as parents’ rights: review the child’s personal information, have it deleted, and refuse further collection or use. Operators must state the procedures for exercising them in their privacy policy.

In practice, test it once. Find the section of the privacy policy that explains how a parent requests deletion, and see whether there is a button in settings or only an email address. A named contact and a plain process are better signs than a long policy with no procedure. The FTC’s six-step compliance plan for businesses uses the same order: post a privacy policy, notify parents directly, get consent, honour parents’ ongoing rights and protect security.

What should you check before your child uses a money app?

Run seven checks, in this order. Each one maps to a COPPA duty or to a point where money apps differ. The last two are editorial advice: COPPA does not require them, but they show how much of your family’s data the app holds.

Who creates the child’s account? It should be a parent. If a child can sign up alone with an email address, ask how the app knows a parent agreed.
What does it store about the child? Compare the privacy policy with the FTC’s list above. A money tracker needs a display name and the entries the child logs. A full name, address, phone number or precise location needs a reason.
Who else receives the data? Look for advertising, analytics partners and “affiliates” in the privacy policy. Since the amended rule, disclosure to third parties that is not integral to the service needs its own parental consent.
Are voice, camera and location off by default? A child profile should not switch them on by itself. A parent should make that choice.
How long is data kept, and how do you delete it? Look for a retention statement and a deletion route that you can use without a phone call.
What does the app connect to? A bank login, a card or a payment account adds another company that holds your child’s data. An app that connects to none of them has fewer places for it to travel.
Who is behind it, and can you reach them? Look for a named company or person and a contact address you can email with a question.

Seven numbered checks for a kids’ money app, laid out as cards. One, who creates the child’s account: it should be a parent. Two, what the app stores about the child. Three, who else receives the data. Four, whether voice, camera and location are off by default. Five, how long data is kept and how to delete it. Six, what the app connects to, such as a bank, card or payment account. Seven, who is behind the app and how to reach them. A bar at the bottom says checks one to five map to COPPA duties and checks six and seven show how much of your family’s data the app holds.

If a debit card is the main feature of an app you are considering, read whether kids need a debit card to learn about money first. It explains what a card adds and what a spending tracker covers without one.

How does CapKin answer those seven checks?

CapKin is a shared household budgeting app where a child logs what they spent by typing, or by voice if the parent turns it on, and a parent approves each entry. The table gives CapKin’s answer to each check, taken from its product facts (verified 30 October 2026) and its children’s privacy page (reviewed 4 August 2026).

Check	CapKin’s answer
1. Who creates the account	Only the household owner, an adult with an account. The child cannot sign up alone, and CapKin logs when and by whom each child account was created.
2. What is stored	A display name, the child’s entries, savings goals, and lesson and quiz activity. A birth year, year only, if the owner sets it. No full name, home address or phone number.
3. Who else receives data	No advertising and no sale of data. CapKin uses Vercel for hosting and the OpenAI API for transcription and parsing, on a tier where content is not retained or used for training.
4. Voice, camera, location	Voice is off for children until the parent turns it on, and the audio is deleted once transcribed. Receipt photos are deleted once read.
5. Retention and deletion	Parents can review, export and delete a child’s data. The owner can delete the whole account with a confirmation step.
6. What it connects to	No bank connection, no card and no money movement.
7. Who is behind it	An independent product in beta. A legal entity has not yet been formed. Contact: getcapkin@proton.me.

Read the OpenAI part of row three twice. When a child types or speaks an expense, the text goes to a third-party service to be parsed. That is a real data flow even though the content is not retained. CapKin also keeps a child’s own ledger out of its weekly insights, and children receive no push notifications or email from the app.

Set up a household where you approve every entryFree during beta · No card · No bank connection

What happens when an app breaks COPPA, and does compliance mean private?

A violation can cost an operator up to $53,088 per violation in civil penalties, according to the FTC’s COPPA FAQ, and the amount depends on how serious the violation was, how many children were affected and the size of the company. Compliance sets a floor. An app can follow the rule and still collect more than a budgeting tool needs, so the seven checks matter even when an app says it is COPPA compliant.

COPPA is a US law. It protects children under 13, so for a teenager the app’s own privacy policy is the main guide. This article does not cover privacy rules outside the US. If you live in the UK or the EU, check your national data protection regulator’s guidance on children’s data. For the other side of money-app privacy, the choice about linking a bank, see is it safe to link a bank account to a budgeting app.

Sources

Frequently asked questions

Is it safe to give my child’s information to a money app?: It is as safe as the app’s answers to five questions: who creates the account, what it stores, who else receives the data, whether voice and camera are off by default, and how you delete data. COPPA sets a legal minimum for children under 13, but it does not stop an app from collecting more than it needs.
What age does COPPA protect children until?: COPPA covers children under 13. From 13 the law’s parental consent rules no longer apply, so for a teenager the app’s own privacy policy and settings are the main protection. Look for the same things as for a younger child: what is stored, who receives it, and how to delete it.
What is verifiable parental consent?: It is a method the FTC recognises for confirming that a parent, and not the child, agreed to data collection. The FTC’s list includes a signed form, a payment transaction that notifies the account holder, a call with trained staff, a checked government ID, approved challenge questions, and a photo ID matched to a second photo.
Can I make an app delete my child’s data?: Yes, if the child is under 13 and the app is covered by COPPA. The FTC lists three parental rights: review the child’s personal information, have it deleted, and refuse further collection or use. The app’s privacy policy must say how to do this. Try the process once, so you know it works before you need it.
What did the 2025 COPPA update change?: The amended rule requires separate parental consent before a child’s data is disclosed to third parties, unless the disclosure is integral to the service. It also requires a written information security program and a written data retention policy, and it bars keeping children’s data indefinitely. Most operators had until 22 April 2026 to comply.
Does a kids’ money app need a debit card or a bank link?: No. Some apps issue a card, and others only track spending that the family enters. A tracker with no card and no bank connection holds less of your child’s financial data. CapKin is one example: a child logs spending by typing or voice, and a parent approves it. It has no card and no bank connection.