Children's Online Privacy Protection Rule (16 CFR Part 312), as amended in 2025 (COPPA Rule)

What it requires

The Children's Online Privacy Protection Act (15 U.S.C. §§ 6501–6506) and the rule apply to operators of websites and online services directed to children under 13, and to any operator with actual knowledge that it is collecting personal information from a child under 13. Such operators must obtain verifiable parental consent before any collection, use or disclosure of a child's personal information (§ 312.5(a)(1)). The 2025 amendments require a separate verifiable parental consent before a child's personal information is disclosed to third parties, unless the disclosure is integral to the service (§ 312.5(a)(2)); the FTC summarised this as requiring parents to opt in to third-party advertising. Personal information now expressly includes biometric identifiers and government-issued identifiers, alongside persistent identifiers such as device identifiers (§ 312.2). Persistent identifiers collected without consent to support internal operations, which include serving contextual advertising and capping ad frequency, may not be used for behavioural advertising or to build a profile of a specific individual, and the online notice must name the specific internal operations (§ 312.4(d)). Operators must maintain a written information security programme (§ 312.8) and a written data retention policy with a timeframe for deletion, and may keep a child's data only as long as reasonably necessary (§ 312.10). Evidence of whether a service is directed to children now includes marketing materials, representations to third parties, user reviews and the age of users on similar services, and a mixed-audience service may screen ages only in a neutral manner that does not default to a set age. The FTC declined to adopt a proposed bar on using such identifiers to encourage or prompt use of a service, noting that the exception covers only uses necessary for the listed operations. Violations are treated as violations of an FTC trade regulation rule (§ 312.9).

Why it bears on this field

An app that is not directed to children comes within the rule once its operator has actual knowledge that it is collecting personal information from a child under 13. In the Sendit case the complaint alleged that the operator knew numerous users were under 13, citing more than 116,000 users who reported an age under 13 in 2022 and complaints from parents, and paired the COPPA counts with ROSCA counts over a weekly paid membership. For child users the amendments bear on the advertising that funds free episodes: disclosing personal information, including device identifiers, to third parties such as ad networks requires separate parental consent unless integral to the service, while contextual advertising and frequency capping remain available under the internal-operations exception. The amendments add no express bar on using persistent identifiers to send prompts or push notifications that encourage continued viewing; the FTC considered one and dropped it, while stating that it may pursue section 5 enforcement against practices encouraging prolonged use that increase risks of harm to children. The rule does not regulate coin pricing or subscription terms, and it protects children under 13 only; teenagers are outside it.

Open questions

• Does age-category data that app stores pass to developers under the Texas, Utah, Louisiana and Alabama app-store statutes give a developer actual knowledge, for COPPA purposes, that a particular user is under 13?
• What will the review of the rule on age verification, announced in the February 2026 policy statement, propose, and when?
• Will the FTC return to engagement prompts and push notifications aimed at children, which it declined to address expressly in the 2025 amendments while saying it remained concerned about them?

Timeline

• 2025-01-16The FTC announces final amendments to the COPPA Rule by a 5-0 vote, including an opt-in requirement for third-party advertising. Source (opens in a new tab)
• 2025-04-22The amended rule is published in the Federal Register (90 FR 16918). Source (opens in a new tab)
• 2025-06-23The amended rule takes effect. Source (opens in a new tab)
• 2025-09-29The Department of Justice, on referral from the FTC, sues Iconic Hearts Holdings, operator of the Sendit app, alleging COPPA Rule violations alongside FTC Act and ROSCA counts. Source (opens in a new tab)
• 2026-02-25The FTC issues a policy statement that it will not bring COPPA enforcement actions against general-audience and mixed-audience operators that collect personal information solely to determine a user's age, subject to conditions, and says it intends to review the rule on age verification. Source (opens in a new tab)
• 2026-04-22The compliance date for the amended rule passes. Source (opens in a new tab)