FTC Updates COPPA to Strengthen Children’s Online Privacy Protections
If you're a parent, you've probably heard “Can I download this game?” more times than you can count. It may seem harmless, but behind that button lies a world of data collection—especially when the user is a child. To address this, the Federal Trade Commission (FTC) rolled out major updates to the Children’s Online Privacy Protection Act (COPPA) on April 22, 2025, aiming to give parents greater control over how personal information is collected from children under 13 online.
Key Highlights:
New and Updated Definitions
A new term, “mixed audience website or online service,” clarifies how platforms serving both children and adults must handle age verification.
The definition of “online contact information” now includes mobile numbers. Operators can text parents to initiate the parental consent process, but only for that purpose.
“Personal information” now explicitly includes biometric identifiers like fingerprints, retina scans, and facial data, recognizing modern risks tied to automated identification.
Stronger Data Practices
Operators must have clear policies for data security, retention, and deletion of children’s information.
The Rule reaffirms that parental consent is required before collecting, using, or disclosing a child’s data except in limited, clearly defined situations.
Notice Requirements and Parental Control
Updates ensure that parents receive direct, accessible notices about data practices.
Parents retain the right to review and delete their child's information and to refuse further data collection.
Ed Tech Delayed
Although changes were proposed regarding educational technology platforms, those amendments were postponed to avoid conflict with anticipated updates to Family Educational Rights and Privacy Act (FERPA) regulations from the Department of Education.
Safe Harbor Adjustments
COPPA Safe Harbor programs must now meet stricter transparency and reporting requirements.
The Rule becomes effective June 23, 2025, but most entities have until April 22, 2026, to comply.