Federal COPPA and CAN-SPAM checks for omnichannel campaigns aimed at Illinois audiences

What to take away

Why a federal checklist matters for Illinois campaigns

A Chicago brand that runs email, paid social, display and connected-TV ads shares one audience file across channels. The same record can drive an email, a retargeting audience and a mobile ad. Each channel inherits the legal duties of the data inside it. For that reason a campaign checklist has to run across channels, not channel by channel. The site's omnichannel marketing checklist is a good companion.

This article covers COPPA and CAN-SPAM as the FTC explains them. It does not review Illinois statutes, so check the Illinois General Assembly and Attorney General sources for state-level rules. The FTC's COPPA FAQ states that COPPA gives states and certain federal agencies authority to enforce compliance for entities under their jurisdiction, so a state attorney general can act as well as the FTC. For how Illinois and other states layer privacy law on top, see US privacy laws and state lines.

COPPA: who is covered

COPPA covers information collected from children under 13. The FTC's six-step plan says the rule applies to operators of websites or online services, including mobile apps, plug-ins, ad networks and connected toys, in three situations:

For ad networks, actual knowledge is likely when a child-directed content provider tells the network its site is child-directed, or when a representative recognizes that the content is child-directed, so exclude such sites and apps from your placement lists.

Mixed-audience services are a subset of child-directed services where children are not the primary audience. The FAQ says an operator can use a neutral age screen to apply COPPA protections to users under 13 only, and cannot block children from participating. A general-audience site does not become mixed-audience only because some children use it.

COPPA: personal information includes identifiers

The six-step plan lists names, physical addresses, online contact information, phone numbers, government IDs, photos or audio of a child, and biometric identifiers as personal information. It also includes persistent identifiers such as cookie numbers, IP addresses and device serial numbers or unique device IDs, which can recognize a user over time and across sites.

That last category is the one that catches omnichannel teams. A tracking pixel on a child-directed page can bring the collection inside COPPA even though no name is ever captured, so check how any audience was sourced.

COPPA: what an operator has to do

Where COPPA applies, the FTC's plan sets out these duties:

Parents must also be able to consent to collection and use without agreeing to third-party disclosure, unless the disclosure is integral to the service. That rule has direct consequences for sharing a child-directed audience with ad partners.

According to the FAQ, courts can impose civil penalties of up to $53,088 per violation, depending on egregiousness, prior violations, the number of children and company size. The FAQ also notes that the COPPA Rule was amended on April 22, 2025, and points readers to the revised rule. The compliance deadline for the amendments was not visible in the pages reviewed, so check the current rule text before launch.

CAN-SPAM: what every commercial email must carry

The FTC's compliance guide says CAN-SPAM covers any commercial email whose primary purpose is advertising or promoting a commercial product or service, including email that promotes content on commercial websites. There is no business-to-business exemption. An email to former customers announcing a new product line must comply.

The FTC lists eight main requirements:

Opt-outs must be honored within 10 business days. You cannot charge a fee or require more than an email address, and you cannot sell or transfer opted-out addresses except to a company helping you comply.

Penalties reach up to $53,088 per separate email in violation. More than one party can be liable, such as both the advertised company and the sending company. The FTC also notes that certain aggravated violations carry criminal penalties.

Transactional messages and mixed content

A message counts as transactional or relationship only if its primary purpose is one of five types listed by the FTC: facilitating or confirming an agreed transaction, providing warranty, recall, safety or security information, notifying of changes to an ongoing relationship, providing employment or benefit information, or delivering goods or services under an agreed transaction. The categories are read narrowly, and being a subscriber does not automatically make a message transactional.

For mixed messages, a commercial subject line or commercial content at the beginning makes the primary purpose commercial, and the full requirements apply, so review order-confirmation templates that carry a promotion.

Agencies, partners and referral programs

Rule 8 matters in an omnichannel stack with agencies, platforms and affiliates. The FTC says you cannot contract away legal responsibility. When several marketers appear in one email, one can be the designated sender if it is named in the "From" line, initiates the message for its own product and meets the initiator duties. If that sender fails, all marketers may be liable.

If a seller pays or offers a benefit such as money, discounts or sweepstakes entries for forwarding or referrals, the seller may have compliance obligations, so review referral mechanics too.

Before launch

Map every audience source and mark any that come from a child-directed site or app, then exclude those placements from retargeting and lookalike building. Confirm that every commercial email template has a physical address, accurate headers, an advertisement label and a working opt-out, and sync opt-outs to every sending system within 10 business days. Record who sends on your behalf and keep your privacy policy, retention schedule and consent records in one file.

For how these duties sit alongside FTC advertising rules, read the guide to FTC and SEC advertising rules in omnichannel planning, and for market context in Illinois, the Chicago and Austin channel mix comparison.

Common questions

Official sources