COPPA Compliance: Children's Online Privacy Rules

The FTC weighs subject matter, visual and audio content, use of animated characters or child celebrities, ads on the service, and empirical evidence about audience composition. A service need not be exclusively for children; a 'mixed audience' service may age-screen and apply COPPA only to identified under-13 users, but the screen must be neutral (no encouraging false ages). General-audience services acquire obligations the moment they have actual knowledge of an under-13 user, including via third-party notice, the YouTube theory.

Methods reasonably calculated to ensure the person consenting is the parent: signed consent forms, credit-card or other payment transactions with notice, toll-free calls or video conference with trained staff, government-ID checks, knowledge-based authentication, and (added over time) facial-comparison matching. Email-plus (email consent with follow-up confirmation) remains available only where data is used internally and not disclosed. The 2025 amendments require separate, distinct consent for third-party disclosure for advertising.

Four operational shifts: (1) targeted advertising to children now requires its own opt-in consent, unbundled from general consent, ending the default flow of children's persistent identifiers to ad tech under the 'support for internal operations' rationale; (2) operators must maintain and publish a written data-retention policy and may not retain children's data indefinitely; (3) a written children's-data security program with safeguards proportional to sensitivity is mandatory; (4) direct notices must name third-party recipients or categories. Biometric identifiers joined the personal-information definition.

Epic ($275M): default-on voice and text chat for children plus dark-pattern purchase flows; design choices are COPPA facts. Google/YouTube ($170M): serving behavioral ads on child-directed channels while claiming general-audience status; content-level knowledge counts. Amazon Alexa ($25M): retaining children's voice recordings indefinitely against deletion promises; retention is now codified. Microsoft ($20M): collecting data during account creation before parental consent; sequence matters. The common thread is architecture, not paperwork.

COPPA preempts inconsistent state law for under-13 online data collection, but states legislate around it: teen protections (13-17) in the comprehensive state laws, age-appropriate design codes (California's, currently enjoined; Maryland's in litigation), and social-media access laws. The practical stack for a youth-facing service is COPPA for under-13, state teen ad-targeting consent rules for 13-17, and design-code duty-of-care requirements where they survive review. Our state children's privacy guide maps the layer above COPPA.