COPPA (Children's Online Privacy Protection Act)
Federal rule protecting children under 13 online. The FTC's 2025 amendments, fully effective 22 April 2026, add separate consent for third-party disclosures, written security programs, retention limits and an expanded definition of personal information.
| Jurisdiction | United States |
|---|---|
| Category | Privacy & Data Protection |
| Status | Active |
| Latest development | |
| Enforcement actions on record | 1 |
Analysis
Key Requirements
- Parental Consent: Operators must obtain verifiable parental consent before collecting, using, or disclosing personal information from children under 13. This includes direct collection and collection via third parties such as plug-ins or ad networks. Acceptable methods include signed forms, credit card verification, or other reliable means as outlined by the FTC. FTC COPPA Rule Summary FTC COPPA FAQ
- Privacy Policy Requirements: Websites and online services must post a clear and comprehensive privacy policy describing their information practices for children. The policy must include details about what information is collected, how it is used, disclosure practices, and parental rights. FTC COPPA Rule Summary Termly COPPA Guide
- Direct Notice to Parents: Operators must provide direct notice to parents before collecting information from children, detailing the types of information collected, intended uses, and disclosure practices. FTC COPPA FAQ Cookiebot COPPA Checklist
- Parental Rights: Parents must have the right to review, delete, and refuse further collection or use of their child’s personal information. FTC COPPA Rule Summary
- Data Minimization: Operators may not condition a child’s participation in an activity on the child providing more personal information than is reasonably necessary. FTC COPPA Rule Summary
- Data Security: Reasonable procedures must be in place to protect the confidentiality, security, and integrity of children’s personal information. FTC COPPA Rule Summary
- Third-Party Disclosure: If information is disclosed to third parties, operators must ensure those parties can maintain the confidentiality and security of the information. FTC COPPA Rule Summary
- Documentation: Maintain records of compliance efforts, including privacy policy updates, consent logs, and staff training. Cookiebot COPPA Checklist
Compliance Challenges
- Verifying Parental Consent: Ensuring parental consent is verifiable and not easily circumvented remains a technical and operational challenge. FTC COPPA FAQ
- Third-Party Data Sharing: Managing compliance when using third-party plug-ins, ad networks, or analytics tools that may collect data from children. Termly COPPA Guide
- Evolving Technology: Adapting to new technologies and platforms (e.g., mobile apps, IoT devices) that may inadvertently collect children’s data. Cookiebot COPPA Checklist
- Case Example: In 2019, YouTube and Google paid a $170 million settlement for alleged COPPA violations related to collecting personal information from children without parental consent. FTC Press Release on YouTube Settlement
- Maintaining Documentation: Keeping thorough records of compliance activities, especially as staff and processes change over time. Cookiebot COPPA Checklist
Implementation Best Practices
- Develop a COPPA-Compliant Privacy Policy: Use templates and guidance from the FTC to ensure all required disclosures are included and easy to find. FTC COPPA FAQ Termly COPPA Guide
- Implement Robust Parental Consent Mechanisms: Use approved methods such as credit card verification, signed consent forms, or government-issued ID checks. FTC COPPA FAQ
- Train Staff and Review Third Parties: Regularly train staff on COPPA requirements and review contracts with third-party vendors for compliance. Cookiebot COPPA Checklist
- Maintain Detailed Records: Document all compliance activities, including privacy policy updates, consent logs, and data deletion requests. Cookiebot COPPA Checklist
- Useful Tools and Resources:
- FTC COPPA Compliance Guide
- Cookiebot COPPA Checklist
- Termly COPPA Policy Generator
Recent Updates
- Ongoing Rule Review: The FTC has been reviewing COPPA for potential updates to address new technologies and business models. The most recent public comment period closed in 2023, with further updates expected. FTC COPPA Rulemaking Updates FTC COPPA FAQ
- No Major Amendments Effective in 2024: As of April 2025, no new amendments have taken effect, but organizations should monitor the FTC’s official page for announcements and compliance deadlines. FTC COPPA Rule Summary
Related Regulations
| Regulation | Description | Interaction/Overlap | Official Documentation | |------------|-------------|---------------------|-----------------------| | GDPR (General Data Protection Regulation) | EU regulation protecting children’s data, with parental consent required for children under 16 in most cases | Overlaps in consent and data minimization requirements for children | GDPR Text | | CalOPPA (California Online Privacy Protection Act) | Requires privacy policies for websites collecting personal data from California residents, including children | Broader scope but complements COPPA’s requirements | CalOPPA Text | | FERPA (Family Educational Rights and Privacy Act) | Protects student education records in schools | Applies to educational institutions, may overlap with COPPA for online educational services | FERPA Overview |
Industry Impact
- Online Services and Platforms: Increased compliance costs for platforms targeting or accessible to children, including investments in consent mechanisms and privacy controls. Termly COPPA Guide
- Advertising and Analytics: Restrictions on behavioral advertising and data analytics for children’s content, leading to changes in monetization strategies. FTC COPPA FAQ
- Case Study: The YouTube settlement led to significant changes in how children’s content is monetized and managed, with stricter controls and reduced ad revenue for creators. FTC Press Release on YouTube Settlement
Sources
- FTC COPPA Rule Summary
- FTC COPPA FAQ
- Cookiebot COPPA Checklist
- Termly COPPA Guide
- FTC Press Release on YouTube Settlement
- GDPR Text
- CalOPPA Text
- FERPA Overview
Recent developments
- — The amended COPPA Rule took full effect; the FTC has signalled COPPA as an enforcement priority. (source)
- — Toy Association highlights that updated COPPA rule requirements, adopted by the FTC in 2025, must be fully implemented by companies by April 22, 2026, with expanded obligations around collecting, using, and disclosing children’s personal information, including broader definitions and stricter consent and retention rules.[1] (source)
- — Bloomberg Law reports that companies are preparing for increased FTC enforcement as the updated COPPA rule compliance deadline of April 22, 2026 approaches, noting expanded “personal information” definitions (e.g., biometric and government IDs), required data retention policies, and new parental consent and vendor-disclosure obligations that heighten enforcement and litigation risk.[8] (source)
- — Dark Reading details that new COPPA rules effective June 23, 2025 add restrictions on online services collecting data from children under 13, including expanded coverage of biometric identifiers and requirements for separate parental consent before sharing children’s data with partners, with civil penalties of up to $53,088 per violation driving significant compliance concerns in online services.[7] (source)
- — Loeb & Loeb analyzes the April 22, 2025 amended COPPA Rule, emphasizing broader definitions of personal and online contact information, new standards for mixed‑audience services, enhanced parental notice and separate consent for non‑integral third‑party disclosures (including marketing and AI training), stricter data retention and security obligations, and greater safe harbor transparency, all requiring operational changes by April 22, 2026.[6] (source)
- — K‑12 Dive explains that COPPA updates effective June 23, 2025 require parental consent before using children’s data for targeted advertising or third‑party disclosures, while allowing school districts to consent on parents’ behalf for purely educational uses; the article highlights expected impacts on ed‑tech transparency, data retention limits, and strengthened cybersecurity measures for services used in schools.[3] (source)
- — Finnegan provides a detailed overview of the FTC’s updated COPPA rule, noting new separate verifiable parental consent requirements for third‑party disclosures, expanded protections for children under 13, specific treatment of audio files (e.g., voice interactions) and their deletion, and reinforced limits on internal and external uses of children’s data, with most obligations effective by April 22, 2026.[5] (source)
- — FTC’s press release announces finalized changes to the COPPA Rule that limit companies’ ability to monetize kids’ data by requiring opt‑in parental consent for targeted advertising and third‑party disclosures, imposing data‑retention limits, expanding “personal information” to include biometrics and government IDs, and increasing transparency in COPPA Safe Harbor programs, with entities given one year from Federal Register publication to comply.[2] (source)
- — Loeb & Loeb notes the amended COPPA rule’s new verifiable parental consent methods (including “text plus,” knowledge‑based authentication, and limited facial recognition verification with immediate deletion), which online services must integrate into their consent flows, creating technical and UX changes across kids’ platforms and mixed‑audience services.[6] (source)
- — BBB National Programs discusses the reintroduction of the federal COPPA 2.0 bill, which would raise the protected age to under 17 and ban targeted advertising to minors, requiring opt‑in consent from teens aged 13–16 and signaling potential future legislative changes that could further tighten requirements for online services beyond the current FTC rule.[4] (source)
- — Bloomberg Law highlights industry reaction that online services are revisiting vendor contracts, ad‑tech integrations, and privacy notices in light of COPPA updates, with particular concern over the need to identify and disclose all third‑party recipients of children’s data, implement retention and security controls, and adjust monetization strategies that rely on behavioral advertising to minors.[8] (source)
Enforcement actions
| Date | Authority | Entity | Fine | Summary |
|---|---|---|---|---|
| Federal Trade Commission | The Walt Disney Company | 10,000,000 USD | Court-approved settlement over mislabelled child-directed YouTube videos that allowed collection of children's data without parental consent. (source) |
Read the full guide to COPPA (Children's Online Privacy Protection Act)
Related regulations
- NIST AI Risk Management Framework (AI RMF 1.0) — United States, Active, effective 2023-01-26
- Blueprint for an AI Bill of Rights — United States, Active
- Cybersecurity Maturity Model Certification — United States, Phased, effective 2025-11-10
- SEC Cybersecurity Disclosure Rules — United States, Active, effective 2023-12-18
- Executive Order 14365 - Ensuring a National Policy Framework for Artificial Intelligence — United States, Active, effective 2025-12-11
- TAKE IT DOWN Act — United States, Active, effective 2026-05-19
- SEC Regulation S-P Amendments (Customer Data Incident Response) — United States, Active, effective 2026-06-03
- CIRCIA Cyber Incident Reporting Rule (CISA) — United States, Proposed
Put it into practice
- Generate the policy: COPPA policy generator (generatepolicy.com)
- Buy the policy pack: Privacy Program Bundle (cyberpolicy.shop)
- Build it yourself: 2026 US Privacy Program Workbook (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates