What's Happening?
The Federal Trade Commission (FTC) has finalized significant amendments to the Children's Online Privacy Protection Act (COPPA) Rule, marking the first substantive revision since 2013. These amendments, which took effect on June 23, 2025, with full compliance
required by April 22, 2026, introduce four key changes directly impacting media buying and data collection from children under 13. Operators must now obtain separate parental consent for disclosing children's data to third parties, including advertisers, unless such disclosure is integral to the service. Biometric identifiers, such as voiceprints and facial templates, have been added to the definition of personal information. Indefinite retention of children's data is now unlawful, requiring a written retention policy. Additionally, operators relying on the 'internal operations' exception must disclose the specific operations involved and the measures taken to prevent behavioral use of identifiers. These changes aim to strengthen privacy protections for children online.
Why It's Important?
These COPPA amendments are crucial for safeguarding the privacy of children in the U.S. digital landscape. By expanding the definition of personal information to include biometric identifiers and requiring separate consent for third-party data sharing, the FTC is addressing evolving technological capabilities and closing potential loopholes in data collection practices. This will significantly impact online services, apps, and ad tech vendors that interact with child-directed content or have knowledge of users under 13. The new rules aim to prevent behavioral advertising to this cohort, effectively limiting how companies can target young audiences and build profiles based on their online activities. For parents, these changes offer greater control and transparency over their children's digital footprint. For businesses, compliance will necessitate substantial adjustments to data handling, consent mechanisms, and advertising strategies, potentially increasing operational costs but also fostering greater trust with consumers.
What's Next?
With the full compliance deadline set for April 22, 2026, online operators and ad tech vendors must ensure their systems and practices align with the amended COPPA Rule. This includes updating privacy policies, implementing new consent mechanisms for parental approval, and revising data retention schedules. The FTC has also issued an enforcement policy statement shielding age-verification technology, indicating a proactive approach to facilitating compliance while maintaining privacy standards. The agency's 2026 to 2030 strategic plan names children's privacy as an institutional priority, suggesting continued vigilance and potential future enforcement actions. The ongoing debate around proposed legislation like COPPA 2.0, which seeks to raise the protected age to under 17 and ban targeted advertising for that cohort, indicates that the regulatory landscape for children's online privacy will continue to evolve, potentially leading to further changes and stricter requirements.
Beyond the Headlines
The COPPA amendments reflect a broader societal concern about the ethical implications of data collection from vulnerable populations, particularly children. The inclusion of biometric identifiers as personal information highlights the increasing sophistication of data capture and the need for robust protections against its misuse. The shift away from indefinite data retention and towards explicit consent for third-party sharing underscores a move towards greater data stewardship and accountability. This regulatory evolution also prompts a re-evaluation of business models that rely on extensive data harvesting, pushing companies towards more privacy-centric approaches. The challenge lies in balancing effective privacy protection with the continued innovation of online services and the economic realities of the digital advertising ecosystem. Ultimately, these changes contribute to a larger conversation about digital ethics, parental rights, and the responsibility of technology companies in shaping the online experiences of future generations.
