Section: Children’s privacy · Last updated: October 26, 2026
This guide is based on the FTC’s Children’s Online Privacy Protection Rule, 16 CFR Part 312, in the Electronic Code of Federal Regulations as of October 1, 2026, and the FTC’s final rule amending it (90 FR 16918, April 22, 2025). It is general information, not legal advice.
The Children’s Online Privacy Protection Rule, usually called the COPPA Rule, sets what websites, apps and online services must do before collecting personal information from children under 13. It was first issued in 1999, took effect in 2000 and was last amended in January 2013. In April 2025 the Federal Trade Commission published a new set of amendments.
The amended Rule took effect on June 23, 2025, and regulated companies had until April 22, 2026 to comply, except for certain Safe Harbor provisions in 312.11 that have their own timing. Those dates have now passed, so the changes below describe the Rule as it applies today.
1. The main changes at a glance
| Area | What the amended Rule says | Section |
|---|---|---|
| Personal information | Now lists government-issued identifiers and biometric identifiers usable for automated or semi-automated recognition | 312.2 |
| Online contact information | Includes a mobile phone number, if used only to text a parent to obtain consent | 312.2 |
| Mixed audience services | New definition, with a neutral age check before collecting personal information | 312.2 |
| Disclosure to third parties | Parents can consent to collection and use without consenting to third-party disclosure, unless that disclosure is integral to the service | 312.5(a)(2) |
| Direct notice to parents | Must name the third parties, or their specific categories, and the purposes of disclosure | 312.4(c) |
| Consent methods | Knowledge-based questions, face match to photo ID, and “text plus” added to the listed methods | 312.5(b)(2) |
| Security | A written information security program, with risk assessments at least annually | 312.8(b) |
| Retention | No indefinite retention, plus a written retention policy published in the online notice | 312.10 |
The FTC also proposed changes for ed tech and schools, but did not finalize them in this rule, citing pending changes to the federal student privacy rules (FERPA).
2. What now counts as personal information
The definition in 312.2 is a list. Two items were added in 2025:
- A government-issued identifier, such as a Social Security, State identification card, birth certificate or passport number.
- A biometric identifier that can be used for the automated or semi-automated recognition of an individual. The Rule’s examples are fingerprints, handprints, retina and iris patterns, genetic data including a DNA sequence, voiceprints, gait patterns, facial templates and faceprints.
Persistent identifiers, such as a cookie customer number, an IP address or a unique device identifier, remain on the list. Collecting one only to support the internal operations of the service is an exception to the consent requirement, but the definition of internal operations says such information cannot be used to contact a specific individual, “including through behavioral advertising”, or to build a profile.
3. Third parties and consent
Section 312.5(a)(2) requires operators to give parents the option to consent to collection and use of their child’s information without consenting to its disclosure to third parties, unless the disclosure is integral to the website or service. The FTC’s 2025 notice describes this as requiring separate verifiable parental consent for disclosures to third parties, and gives ad networks as an example of such a third party.
The direct notice that asks for consent must now state, where the operator discloses information to third parties, the identities or specific categories of those third parties, the purposes of disclosure, and that the parent can consent to collection and use without consenting to disclosure.
The FTC dropped proposed wording on not conditioning access on that consent. Its notice explains this was because the Rule already prevents operators from conditioning a child’s participation on consent to third-party disclosure.
4. Consent methods listed in the Rule
| Method in 312.5(b)(2) | Condition |
|---|---|
| Signed consent form | Returned by post, fax or electronic scan |
| Card or payment system | Used in a transaction that notifies the primary account holder of each transaction |
| Toll-free call or video conference | With trained personnel |
| Government ID check against databases | The ID is deleted promptly after verification |
| Knowledge-based authentication (new in the Rule text) | Dynamic multiple-choice questions, hard enough that a child 12 or younger in the household could not reasonably answer them |
| Face match to photo ID (new in the Rule text) | ID verified as authentic, compared with a camera image, confirmed by trained personnel, and both deleted promptly after the match |
| Email plus | Only if the operator does not disclose children’s information; confirmed by a follow-up email, letter or call |
| Text plus (new) | Same conditions as email plus, using text messages |
The FTC notes that the knowledge-based and face match methods had already been approved by the Commission in 2013 and 2015; the 2025 amendments write them into the Rule.
5. Security and retention in writing
Security (312.8). Beyond “reasonable procedures”, operators must establish, implement and maintain a written information security program scaled to the sensitivity of the data and the operator’s size and activities. It must:
- Name one or more employees to coordinate the program.
- Assess internal and external risks at least annually.
- Design and maintain safeguards for the risks identified.
- Regularly test and monitor those safeguards.
- Evaluate and update the program at least annually.
Before letting other operators, service providers or third parties collect or receive children’s information, the operator must take reasonable steps to check they can protect it and obtain written assurances that they will.
Retention (312.10). Children’s personal information may be kept only as long as reasonably necessary for the specific purpose it was collected for, and “may not be retained indefinitely”. Operators must keep a written data retention policy setting out the purposes of collection, the business need for retention and a timeframe for deletion, and must include it in the online notice.
6. Mixed audience services
A mixed audience service is one that meets the “directed to children” test but does not target children as its primary audience. Under the new definition it may not collect personal information from any visitor, other than for the limited purposes allowed in 312.5(c), before collecting age information or using another reasonable means to tell whether the visitor is a child. That age check must be neutral: it cannot default to a set age or encourage visitors to give a false age.
The “directed to children” factors now also mention evidence about audience composition and intended audience, such as marketing plans, representations to consumers or third parties, user or third-party reviews, and the age of users on similar services.
FAQ
Q. Does COPPA apply to teenagers?
No. The Rule defines a child as an individual under the age of 13. Other federal or state laws may cover older minors.
Q. Can a kids’ app still show ads?
Serving contextual advertising and capping ad frequency are listed as support for internal operations. Information collected for those purposes cannot be used for behavioral advertising or profiling unless the Rule’s consent requirements are met.
Q. A child asks a voice feature a question. Is parental consent needed?
Section 312.5(c)(9) allows collecting an audio file of a child’s voice without consent when no other personal information is collected, it is used only to respond to that request, it is not disclosed, and it is deleted immediately afterwards. The online notice must still describe this.
Q. What changed for Safe Harbor programs?
FTC-approved Safe Harbor programs have new reporting duties and must publicly list their current subject operators and each certified website or online service. Some of these provisions have a separate compliance timeline.
Official sources
- Electronic Code of Federal Regulations (ecfr.gov) — 16 CFR Part 312, Children’s Online Privacy Protection Rule
- Federal Register, 90 FR 16918 (April 22, 2025) — Children’s Online Privacy Protection Rule, final rule, Federal Trade Commission
This article is general information and not legal advice. Whether a service is directed to children, or has actual knowledge that it collects from children, depends on the facts; check the current rule text and FTC guidance.