COPPA vs State Minors' Privacy Laws: Mapping the Overlap

Only narrowly. 15 USC 6502(d) preempts state law 'inconsistent with' COPPA's treatment of the activities it covers, meaning states cannot relax COPPA or contradict its scheme for under-13 online data collection. States remain free to regulate what COPPA does not touch: teens 13 to 17, offline data, platform design duties, addictive features, and age verification for account access. Courts examining the design codes have generally analyzed them under the First Amendment rather than COPPA preemption, and where preemption arguments have been raised (NetChoice litigation against various state acts) they have not broadly nullified state minors' regimes. Planning assumption: preemption defends you against a state trying to re-run COPPA differently for under-13 collection, and against nothing else.

Four families. Design codes: California's AADC (impact assessments, high-privacy defaults, no dark patterns for under-18s, enforcement enjoined in significant part through NetChoice litigation) and Maryland's Kids Code (similar duties, drafted to dodge California's constitutional problems). Social-media minor-access laws: Utah, Arkansas, Texas HB 18, Florida HB 3, requiring parental consent or banning under-14 accounts, most tangled in injunctions. Addictive-design laws: California SB 976 and New York's SAFE for Kids Act, restricting algorithmic feeds and night-time notifications to minors without parental consent. Teen data provisions inside comprehensive privacy laws: CCPA's opt-in for sale/sharing for consumers known to be under 16; Connecticut, Colorado, and most newer state laws banning targeted advertising and sale for known under-16s or under-18s. The first three families are litigation-volatile; the fourth is stable and enforceable now.

COPPA: under 13, triggered by child-directed content or actual knowledge. CCPA: under-16 opt-in for sale/sharing, with 'willful disregard' of age counting as knowledge, broader than COPPA's actual-knowledge test. Connecticut and several newer laws: obligations for consumers a controller 'knows or wilfully disregards' are minors, with targeted-ad and sale bans to 18 in some. Design codes: under 18, keyed to services 'likely to be accessed' by minors, an audience-probability test far wider than child-directed. Social-media laws: various cutoffs (14 in Florida, 16, 18) with verification duties. The compounding effect: a general-audience service that could ignore teens under COPPA may owe them opt-ins under state privacy laws and design duties under design codes, and 'we did not know ages' fails wherever wilful disregard or likely-access standards govern.

Treat three tiers differently. Stable and enforced: COPPA (especially post-2025 amendments); teen targeted-ad and sale restrictions in comprehensive state privacy laws (CCPA under-16 opt-in and its analogs), enforced by state AGs and the CPPA through ordinary privacy enforcement. Partially operative: design-code duties, California's AADC injunction (affirmed in relevant part by the Ninth Circuit as to impact-assessment provisions) left pieces contested while Maryland's code proceeds; New York's SAFE Act and California SB 976 have survived early challenges in whole or part. Enjoined or unsettled: several social-media age-verification and parental-consent statutes (Arkansas, Utah's original act, portions of Texas and Florida laws) pending NetChoice/CCIA litigation, with the Supreme Court's 2025 decision in Free Speech Coalition v. Paxton (upholding Texas's adult-content age verification) recalibrating the doctrine. Compliance posture: build to the stable tier now, design for the contested tier, and track the dockets quarterly rather than assuming any injunction is permanent.

Six elements to the strictest common denominator. Age assurance proportionate to risk: neutral age screens at minimum, stronger assurance where content or state law demands it (the age-gating tradeoffs are their own discipline). Segmented treatment: under-13 users get full COPPA handling (verifiable parental consent, 2025 unbundled ad-consent); known 13-to-17s get no targeted advertising, no sale, no profiling defaults, satisfying CCPA, Connecticut, and design codes at once. High-privacy defaults for minors: geolocation off, private accounts, no message solicitation from unknown adults. Design review: dark-pattern audit and, for services likely accessed by minors, a documented impact assessment, the AADC-style artifact several states now expect. Retention discipline per the 2025 COPPA amendments. Governance: a single minors' data policy owner tracking litigation shifts. The unified build costs less than fifty state-specific ones and reads as good faith to every regulator watching.