Children’s Online Privacy Protection Act (COPPA)

COPPA and the FTC’s COPPA Rule apply to operators of websites and online services directed to children under 13, and to any operator with actual knowledge it’s collecting personal information from a child. A mixed-audience site, directed to children but not mainly, is covered too. Ad networks and plugins are covered when they know they’re collecting from a child-directed site.

“Personal information” includes a persistent identifier that can recognize a user over time and across sites, such as a cookie ID, and since 2025 biometric identifiers.

You need verifiable parental consent before collecting, using or disclosing a child’s personal information. There’s an exception for a persistent identifier collected only to support internal operations, such as serving contextual ads or capping ad frequency, with notice. It never covers behavioral advertising or contacting a specific child.

The FTC says a child-directed site is responsible for collection by plugins and ad networks on it, whoever does the collecting.

The amended Rule took effect on June 23, 2025, with most compliance required by April 22, 2026. It requires:

• Separate parental consent before disclosing a child’s data to third parties, including for targeted advertising, unless the disclosure is integral to the service.
• A written data retention policy, published in your notice; children’s data can’t be kept indefinitely.
• A written information security program.
• New ways to get consent, such as knowledge-based questions, photo ID matched to the parent, and “text plus”.

The FTC enforces COPPA, and state attorneys general can sue on behalf of residents. Civil penalties are up to $53,088 per violation, unchanged for 2026. Recent cases include Disney’s $10 million settlement over videos not labeled “Made for Kids” on YouTube, and $20 million from the maker of Genshin Impact.

In February 2026 the FTC said it won’t bring COPPA actions over certain data collected only to verify age. Congress is considering COPPA 2.0, which would extend protections to teens; it isn’t law yet.