The COPPA Final Rule (2025)
In January 2025 the FTC amended the COPPA Rule, tightening how operators handle children's data. The update requires opt-in (express, verifiable) parental consent for targeted advertising, limits data retention, and expands the Personal Information definition to cover biometric and government-issued identifiers.
In January 2025 the FTC issued a final rule amending the COPPA Rule. The headline change is that an operator must now obtain opt-in, express, verifiable parental consent specifically to use a child's personal information for targeted advertising. Without that separate consent, a platform cannot share or monetize children's information for ad targeting.
The amended rule also limits retention of children's personal data: information may be kept only for the specific purpose it was collected and for a reasonable duration, with no indefinite storage. It expands the definition of personal information to include biometric identifiers and government-issued identifiers, and it encourages age-verification methods beyond self-declaration. Transparency obligations for FTC-approved Safe Harbor programs are strengthened.
Regulated entities have 365 days from publication in the Federal Register to come into compliance with the amended rule.
COPPA covers operators of sites or services directed to children under 13, and general-audience services with actual knowledge they collect personal information from under-13s. It is enforced by the FTC and state attorneys general, not by a dedicated children's privacy agency.