COPPA Compliance Guide: The 2025 Amended Rule

Two coverage paths: services directed to children under 13, and general-audience services with actual knowledge they collect personal information from under-13 users. 'Directed to children' is a totality test the rule enumerates: subject matter, visual and audio content, use of animated characters or child-oriented activities, music, child celebrities or celebrities appealing to children, advertising on or promoting to children, and empirical evidence of audience composition. YouTube's $170 million settlement turned on channel content and the platform's own audience statements to advertisers. A 'mixed audience' subcategory lets services that are child-appealing but not primarily child-targeted use a neutral age screen and apply COPPA only to users identifying as under 13, but the screen must not encourage misstatement (no pre-filled adult birthdates, no 'you must be 13' hints).

Approved methods include: signed consent forms (mail, fax, scan), credit or debit card transactions with notice, toll-free calls or video conferences with trained staff, government-ID verification against databases, knowledge-based authentication with adequately difficult questions, and facial-recognition matching against verified ID. The 2025 amendments added text-message-plus-confirmation ('text plus') for internal-use consent and blessed knowledge-based authentication and facial matching formally. The 'email plus' method survives for internal uses. Critically, the amendments also unbundled consent: operators must now obtain separate, opt-in consent before disclosing children's personal information to third parties for targeted advertising or other non-integral purposes, a parent can consent to collection while refusing ad-tech disclosure, and the service (unless disclosure is integral) must offer that split.

Notice: a clear, prominent direct notice to parents before collection describing what is collected, how used, and disclosure practices, plus an online privacy policy listing all operators collecting through the service, updated for the 2025 disclosure details (including identities or categories of third parties and, under the amendments, more specific retention information). Retention: the amendments hardened the rule, children's data may be kept only as long as reasonably necessary for the specific purpose collected, indefinite retention is expressly prohibited, and operators must maintain a written data retention policy. Security: a written children's data security program with safeguards appropriate to sensitivity, plus diligence obligations before releasing data to third parties capable of maintaining it. These convert what were general reasonableness duties into auditable artifacts the FTC can demand.

Yes, since the 2013 amendments, and it is the single most consequential fact in the rule. Personal information includes persistent identifiers that can recognize a user over time and across services: cookies, device identifiers, advertising IDs, and IP addresses. The 'support for internal operations' exception permits their use without consent for contextual advertising, frequency capping, analytics, security, and legal compliance, but NOT for behavioral/targeted advertising or cross-service profiling. That is the theory behind YouTube (serving behavioral ads on child-directed channels), Musical.ly, and Epic: no registration data needed, the ad stack itself was the violation. The 2025 amendments added biometric identifiers (fingerprints, voiceprints, facial templates) and government IDs to the definition, extending the same logic to the newest identifier classes.

FTC actions are penalty-eligible from the first violation, per child, per day, which is how numbers scale: Epic Games $275 million (2022, default-on voice chat and collection without consent), Google/YouTube $170 million (2019, split with New York), Microsoft/Xbox $20 million (2023, registration flow), Amazon/Alexa $25 million (2023, voice recordings and retention), Musical.ly $5.7 million (2019). Orders impose deletion (including of models trained on children's data in some matters), consent re-engineering, and long-term compliance monitoring. State attorneys general have parallel COPPA authority and use it, and the states are layering their own regimes on top, age-appropriate design codes and minors' social-media laws, so under-13 compliance is now the floor, not the ceiling. Safe harbor programs (FTC-approved self-regulatory bodies) offer a compliance pathway with their own audit requirements.