Websites and online services covered by COPPA must obtain verifiable parental consent before collecting personal information from children under 13. They must also have a privacy policy that is clearly stated and easily accessible to parents.