Children's Online Privacy Protection Act (COPPA)

The law and the rule. Congress enacted the Children's Online Privacy Protection Act in 1998, and the Federal Trade Commission's COPPA Rule has been in effect since April 21, 2000. The Rule applies to operators of websites or online services directed to children under 13, or that have actual knowledge they are collecting personal information from children under 13. Those operators must give parents notice and obtain verifiable parental consent before collecting, using or disclosing a child's personal information.

The 2025 amendments. The FTC published amendments to the Rule in the Federal Register on April 22, 2025. The amended Rule took effect on June 23, 2025, and regulated entities have until April 22, 2026 to comply, apart from certain safe-harbor provisions.

Why it matters in advertising. Under the amendments, operators must obtain separate verifiable parental consent before disclosing children's personal information to third parties. The FTC says this means parents will have to consent to disclosures to third parties such as ad networks.

What else changed. The definition of personal information now includes government-issued identifiers and biometric identifiers that can be used to recognize a person. Operators may keep children's personal information only as long as reasonably necessary for the purpose it was collected for, and must maintain a written data retention policy. They also need a written information security program for children's personal information.