ESRB Privacy Certified
What is ESRB Privacy Certified?
ESRB Privacy Certified (EPC) is one of the FTC-approved Children's Online Privacy Protection Act (COPPA) Safe Harbor programs (16 CFR Part 312, Section 312.11), operated by the Entertainment Software Rating Board since 1999. Members enter a contractual agreement with ESRB, submit each product/service for review, and undergo ESRB's comprehensive privacy assessment process plus at least two ongoing compliance reports per year and spot audits. It comprises 20 controls organised across 5 domains, and applies in the United States (ESRB / FTC).
How ESRB Privacy Certified maps to other frameworks
All 20 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 5 domains ESRB Privacy Certified groups its controls into
Frameworks that share controls with ESRB Privacy Certified
Each of these has at least one control mapped to a control in ESRB Privacy Certified. The number is how many ESRB Privacy Certified controls are shared, counted from the mapping graph.
Implementation guides for frameworks that overlap ESRB Privacy Certified
Training on frameworks that overlap ESRB Privacy Certified
There is no course on ESRB Privacy Certified itself. These cover frameworks that share controls with it, so the material carries across even though the standard named is different.
Where ESRB Privacy Certified overlaps with the standards you already hold
What ESRB Privacy Certified means in your sector
What ESRB Privacy Certified means for your job
Questions people ask about ESRB Privacy Certified
What is ESRB Privacy Certified?
How many controls does ESRB Privacy Certified have?
Where does ESRB Privacy Certified apply?
What frameworks does ESRB Privacy Certified map to?
How do I get started with ESRB Privacy Certified compliance?
Query ESRB Privacy Certified programmatically
ESRB Privacy Certified, its 20 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
ESRB Privacy Certified API reference and MCP config →What ESRB Privacy Certified requires, control by control
Each page carries the requirement text for one ESRB Privacy Certified control and what an assessor expects to see as evidence.
- ESRB-PC-01 COPPA Safe Harbor program eligibility and Seal selection
- ESRB-PC-03 Ongoing compliance reports, spot audits and annual recertification
- ESRB-PC-06 Online Privacy Notice (privacy policy)
- ESRB-PC-07 Direct Notice to parents
- ESRB-PC-08 Verifiable Parental Consent (VPC)
- ESRB-PC-10 Data minimisation for child personal information
- ESRB-PC-11 Internal Operations Exception scope
- ESRB-PC-12 Parental access, review and deletion rights
- ESRB-PC-13 Data retention and secure deletion
- ESRB-PC-15 Confidentiality, security and integrity of child PI
How ready are you for ESRB Privacy Certified?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.