COPPA's Updated Rule: Children's Privacy Meets Age Checks

The United States is tightening the rules for online services used by children, just as age checks are becoming a central feature of digital policy. The updated Children’s Online Privacy Protection Act rule, known as COPPA, requires operators to reconsider not only what they collect from children but also how they determine whether a user is a child in the first place.

That creates a familiar privacy trade-off. A service that does too little to establish a user’s age may fail to identify children who need COPPA protections. A service that does too much may collect identity documents, facial data, dates of birth or other information that creates its own privacy and security risks.

What COPPA covers

COPPA is a US federal privacy law administered by the Federal Trade Commission. It applies to operators of websites and online services directed to children under 13, as well as general-audience operators that have actual knowledge they are collecting personal information from a child under 13.

At its core, COPPA generally requires clear notice and verifiable parental consent before an operator collects, uses or discloses a child’s personal information. The rule has defined personal information broadly, covering obvious identifiers such as names, email addresses and persistent identifiers, as well as certain location information and other data linked to a child. There are limited exceptions, including some activities needed to support internal operations or protect security.

COPPA is not a general US age-verification mandate, and it does not impose a single technical method for proving age or parental status. Its focus is on services within its scope and on the handling of under-13 users’ information. That distinction matters as US states, the European Union and the United Kingdom pursue wider age-assurance rules for social platforms, adult content and other online services.

What the FTC changed

The FTC finalised amendments to the COPPA Rule in January 2025. The revision modernises a rule written for an earlier internet and reflects concern about advertising technology, data brokers, biometric systems and long-lived data stores.

• Separate parental consent is required in covered circumstances before an operator discloses a child’s personal information to a third party, including disclosures connected to advertising. This is distinct from consent to collect the information in the first place.
• Operators face stronger data-retention requirements. They must not retain children’s personal information for longer than reasonably necessary for the specific purpose for which it was collected, and their retention practices must be documented.
• Biometric identifiers are added to the definition of personal information when used to identify an individual. Depending on the system, this can include data derived from a face, voice, fingerprint, iris or other biological characteristic.
• The amendments also reinforce limits on conditioning a child’s participation in an activity on providing more information than is reasonably necessary.

The advertising provision is especially significant because children’s data can move through a complex chain of analytics, advertising and measurement vendors. In practice, operators will need to map those disclosures, identify which recipients are third parties under the rule, and determine when separate parental permission is required. The precise analysis can depend on the service, the recipient’s role and the purpose of the disclosure.

The compliance clock

The amended rule has a staged implementation schedule. Most of the new obligations are generally required by April 2026. Companies should not treat that date as a reason to delay: compliance work often involves revising notices, consent flows, vendor contracts, retention schedules and internal data inventories, all of which can take time.

Operators should also monitor FTC guidance and any relevant court or regulatory developments. COPPA compliance is fact-specific, and related state, federal and international requirements may apply independently to the same product.

Age assurance can conflict with data minimisation

Age assurance is the umbrella term for methods used to estimate or establish whether someone is above or below an age threshold. It ranges from a simple age gate, where a user enters a birth date, to document checks, payment-card signals, facial age estimation and verification through a parent or trusted third party.

Each method has limitations. A self-declared age is easy to evade. Stronger checks can be more reliable, but they can also require the collection of highly sensitive data. Facial age estimation may involve biometric processing even when a provider says it does not identify a person. Identity-document checks can expose names, addresses and document numbers that a child-focused service may not otherwise need.

For COPPA-covered services, the policy goal is therefore not simply to collect more evidence of age. It is to use a proportionate method, limit collection to what is reasonably necessary, separate age-assurance data from unrelated uses where possible, and delete it on a defined schedule. Providers must also examine what their age-assurance vendors receive, retain and disclose.

A narrower rule with wider consequences

The revised COPPA Rule is aimed at children under 13, but its effects may extend beyond child-directed products. Services that seek to screen out underage users, or that offer different experiences based on age, may redesign onboarding and identity workflows around the same principles: data minimisation, purpose limitation, parental involvement and accountable vendor management.

The unresolved challenge is operational. Regulators want meaningful safeguards for children, while privacy advocates warn against normalising identity checks for everyone online. The strongest compliance approach will not necessarily be the most intrusive one. It will be one that can show why an age-checking method is necessary, how its data flows are limited and how children’s information is protected after the check is complete.

This article is for general information and is not legal advice. Organisations should seek qualified legal counsel for advice on their specific services, data practices and jurisdictions.