We want to integrate Mixpanel for an kids & family app. We fall into mixed audience category on Appstore and kids category on Playstore. Since we are focusing on US and India markets, we want to remain COPPA compliant. However, we are unsure of what information can be shared with Mixpanel while remaining COPPA compliant. Are there any resources that can help with this particular use case?
Rinitha R. has opened ticket #585
Hi Rinitha, Ashley here from Mixpanel Support, I'd be happy to address this. To be upfront and set the right expectations, I must highlight that Mixpanel does not have a dedicated COPPA compliance guide, but we can certainly help you with tools and resources to implement data tracking in compliance with COPPA. From my research, I found a list here which details what types of personal information are covered under COPPA. It includes names, addresses, contact numbers, geolocation information, and much more. Given the legal intricacies, I'd recommend:
Reviewing FTC's COPPA FAQ in detail as it's the most authoritative source for what's required.
Consulting with a privacy attorney for advice specific to your app's classification and user flows.
Reviewing our Privacy Policy on the Legal web page.
Potentially reach out to our Compliance team at compliance@mixpanel.com for any questions about Mixpanel's data handling practices.
In the meantime, here are some Mixpanel resources worth going through to better understand how Mixpanel works, and how we can help you achieve COPPA compliance:
Mixpanel data model: Mixpanel is built on three key concepts: Events, Users, and Properties.
Tracking methods: Client-side tracking, server-side tracking, integrations.
Identity management: ID management is the process of assigning IDs and maintaining ID mappings to ensure data are attributed to your users accurately.
Default properties: Mixpanel tracks certain default properties (event and user) depending on how you're tracking data. You could blacklist these default properties if you do not want them to be collected.
Data clean-up: When you want to delete data which was unintentionally sent.
End user data management: Exporting user data or submitting GDPR deletions to delete all data (event and user) ever associated with a user.
I hope this information helps! Please let me know if you have any further questions after going through the resources shared above. 🙏🏻
