CoAP is a lightweight RESTful application layer protocol devised for the IoT. Operating on top of UDP, CoAP must handle congestion control by itself. The core CoAP specification defines a basic congestion control mechanism, but it is not capable of adapting to network conditions. However, IoT scenarios exhibit significant resource constraints, which pose new challenges on the design of congestion control mechanisms. In this article we present CoCoA, an advanced congestion control mechanism for CoAP being standardized by the Internet Engineering Task Force CoRE working group. CoCoA introduces a novel round-trip time estimation technique, together with a variable backoff factor and aging mechanisms in order to provide dynamic and controlled retransmission timeout adaptation suitable for the peculiarities of IoT communications. We conduct a comparative performance analysis of CoCoA and a variety of alternative algorithms including state-of-the-art mechanisms developed for TCP. The study is based on experiments carried out in real testbeds. Results show that, in contrast to the alternative methods considered, CoCoA consistently outperforms the default CoAP congestion control mechanism in all evaluated scenarios.