What Extra Rules Apply If My Business Works With Kids or Vulnerable Adults?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

If your business works with children, seniors, or adults who need care, expect extra rules on three things: screening the people you hire, protecting personal information, and keeping people safe. Many of these rules come from your state, such as childcare licensing and background check laws. Two federal rules matter for many businesses: the Fair Credit Reporting Act (FCRA) when you use a company to run background checks, and the Children’s Online Privacy Protection Act (COPPA) if you collect information online from kids under 13.

What this means

Screening. Many states require background checks for people who work with children or vulnerable adults, especially in childcare, schools, camps, and home care. When you use a background check company, the Federal Trade Commission (FTC) says you must:

Give the person a written notice, in a separate document, that you may use a background report
Get their written permission
Before rejecting them based on the report, give them a copy of it and a summary of their rights, so they can respond
After rejecting them, send an adverse action notice with the details the FTC lists

The FTC also reminds employers to apply the same standards to everyone and to follow equal opportunity laws.

Privacy. The FTC says COPPA applies to websites, apps, and other online services that are aimed at children under 13 and collect personal information from them, or that know they collect it from kids under 13. Covered businesses need a compliant privacy policy, direct notice to parents, and verifiable parental consent before collecting the information. Offline, keep records about children and care clients locked down and share them only as needed (see 11.6.2 Sensitive Information).

Safety. This is mostly state law and good practice. It can include childcare licensing and staff ratios, rules about who can pick up a child, never leaving one adult alone with one child out of sight, incident reporting, and reporting suspected abuse. Every state has rules on who must report suspected abuse of children, and many have rules for vulnerable adults. Check your state.

Made-up example: Blue Heron Swim School teaches kids’ swim lessons. The owner checks the state rules and finds the program doesn’t need a childcare license, but does need lifeguard-certified instructors. She uses a background check company and follows the FTC’s notice and permission steps. She writes a pick-up policy, sets a rule that lessons happen in view of parents, and keeps her online sign-up aimed at parents, not kids.

Why it matters

Harm. The people you serve may not be able to protect themselves.
Licensing. Running an unlicensed childcare or care business can bring fines or closure.
Lawsuits and insurance. Claims involving children or vulnerable adults are serious. Many insurers ask about screening and policies.
FTC enforcement for background check or COPPA violations.

Who this applies to

Childcare, preschools, after-school programs, and camps
Tutors, coaches, music and art teachers, and youth sports
Home care, senior services, and disability services
Businesses that send workers into homes where children or vulnerable adults live
Websites and apps aimed at kids under 13

How to do it

Check your state’s licensing rules for your type of program. Ask whether you need a license, ratios, or training.
Check state background check requirements for your industry.
If you use a background check company, follow the FTC’s steps: separate notice, written permission, pre-adverse action notice, and adverse action notice.
Write a safety policy covering supervision, pick-up, transport, incidents, and reporting suspected abuse.
Train staff on the policy and your state’s reporting rules.
Review your website and forms. If any part is aimed at kids under 13 and collects information, follow COPPA or redesign it to collect from parents only.
Talk to your insurer about abuse and molestation coverage and what policies they expect.
Add licenses, checks, and renewals to your requirement matrix (see 9.3 Requirement Matrix).

What proof to keep

Licenses and inspection reports
Background check notices, permissions, and results, stored securely
Written safety and reporting policies
Training records
Incident reports
Parental consent records, if COPPA applies

Common mistakes

Running a background check without separate notice and written permission.
Putting the background check notice inside the job application. The FTC says it must stand alone.
Assuming a short camp or class doesn’t need a license. Some states license them.
Letting staff be alone with one child out of view.
Collecting kids’ names or photos through an online form without thinking about COPPA.

When to get help from a pro

An attorney can review your screening process, policies, and COPPA questions. Your state licensing agency can tell you what license and ratios apply. An insurance professional can explain the coverage you need. Questions to ask:

Does my program need a state license?
Which background checks does my state require, and how do I run them legally?
What are my reporting duties if I suspect abuse?

Bill’s note

[Bill: add a short opinion. For example, how businesses that serve kids or seniors can show their safety policies on their website in a way that builds trust with parents and families.]

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: whether SiteSmarty serves children or vulnerable adults, and whether the website collects any data from kids]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the requirement matrix row for these rules]
[Result so far:]

Questions people ask

Do I need background checks for staff who work with kids? Many states require them in childcare, schools, camps, and care work. Even where not required, many businesses run them.

What do I need to do before running a background check? If you use a background check company, the FTC says to give a separate written notice and get written permission first.

What is COPPA? A federal law about collecting personal information online from children under 13. It requires notice to parents and parental consent.

Do I need a childcare license for a camp or class? It depends on your state and the program. Ask your state childcare licensing agency.

What should a child safety policy include? Supervision rules, pick-up rules, transport, incident reporting, and how staff report suspected abuse.

Audit check

Question: Does the business meet licensing, screening, privacy, and safety rules for the children or vulnerable adults it serves?
Pass looks like: Required licenses current. Background checks done the legal way. Written safety and reporting policy. Staff trained. No online collection from kids under 13 without COPPA steps.
Fail looks like: No license where required. Checks done without notice or permission. No written policy. Kids’ information collected online without parental consent.
Evidence to collect: Licenses, screening records, policies, training logs, incident reports, and website form review.

Where this fits

Do this first: 9.3 Requirement Matrix, 9.5.2 State Licenses

Do this next: 9.7.1 Physical Accessibility

Sources

Federal Trade Commission (FTC), "Background Checks: What Employers Need to Know" (checked October 17, 2026)
FTC, "Children's Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.