US State Law United States

State Children's Privacy Laws: The COPPA-Plus Layer

How states extend past COPPA: teen ad-targeting consent, Maryland and design codes, Connecticut's duty of care, social-media laws, and the litigation reshaping them.

Regulation

State minors' privacy provisions, age-appropriate design codes, and social-media laws (2023-2026)

Max Penalty

Varies by state; FDBR trebles to $150,000 per violation involving known minors; comprehensive-law penalties $2,500-$20,000

Enforcing Authority

State attorneys general; California CPPA for CCPA minors' provisions

Official Source

www.ftc.gov

Executive Summary

  • COPPA stops at 13; the states built the 13-17 layer: consent requirements for targeted advertising, sale, and profiling of known minors now exist in Connecticut, Delaware, New Jersey, Montana, Maryland, Minnesota, and others, with ages ranging from under-16 to under-18.
  • Two design codes lead the second front: California's CAADCA (enjoined in NetChoice v. Bonta litigation) and Maryland's Age-Appropriate Design Code (effective October 2024, facing its own challenge), imposing duty-of-care, default-privacy, and DPIA obligations on services likely to be accessed by minors.
  • Connecticut's 2023-2025 amendments created the most developed operating model: duty of reasonable care, default high-privacy settings, restrictions on engagement-prolonging features, and consent gates for minors' targeted advertising.
  • Social-media minor-access laws (Florida HB 3, Utah, Texas HB 18, Arkansas) add age-verification and parental-consent requirements, nearly all tied up in First Amendment litigation with mixed early results.
  • The compliance floor despite the litigation churn: no targeted advertising, sale, or consequential profiling for any user known or reasonably understood to be under 18, plus high-privacy defaults where minors are likely.

Children’s privacy law in the US is now a three-layer stack: COPPA for under-13 (federal, stable, newly amended), teen provisions in the comprehensive state laws (spreading, ratcheting toward 18), and design codes plus social-media laws (ambitious, litigated, partially surviving). The litigation noise obscures the signal: every layer converges on the same operational rule, know your minor audience, and stop monetizing it through targeted advertising and profiling.

The operational stack

Layer 1: COPPA under 13. Verifiable parental consent, the 2025 amendments’ unbundled ad-disclosure opt-in, retention limits, and security programs, covered in the COPPA guide. This layer preempts and anchors everything.

Layer 2: teen provisions, 13-17. Consent gates for targeted advertising, sale, and profiling at rising ages: Connecticut’s model, New Jersey to 16, Delaware to 18, Maryland’s outright ban, Montana’s 2025 adoption. The engineering answer is one flag: under-18 users exit the ad-monetization path.

Layer 3: design codes and access laws. Where surviving (Maryland’s code, portions of the social-media laws), they add DPIAs, high-privacy defaults, and feature restrictions; Florida’s FDBR adds penalty trebling. Track the dockets, but build to the floor that survives regardless.

Cross-cutting duties. Known-child data is sensitive data in every comprehensive law (consent rules); minors’ processing triggers assessments; and age-verification vendors introduce their own biometric exposure when face-estimation is used.

Ad pixels and trackers running on minor-likely surfaces are the most common violation and the most visible: check yours with a free scan.

Frequently Asked Questions

Which states require consent for teen ad-targeting, and at what ages?

Under the comprehensive laws' minors' provisions: Connecticut, New Hampshire, and Montana gate targeted advertising and sale for known 13-15-year-olds (consent from the teen); New Jersey extends to 13-16; Delaware to under-18; Maryland bans targeted advertising to known under-18s outright (no consent cure); Minnesota adds profiling limits. California's CCPA requires opt-in for sale/sharing of under-16 data (parental consent under 13). The trend in each amendment cycle is upward, toward 18.

What is the 'likely to be accessed by minors' standard?

The design-code trigger, broader than COPPA's 'directed to children': it captures general-audience services with meaningful minor audiences, evidenced by content type, advertising audience, design elements, or internal research. Maryland's code applies duties to such services: DPIAs, default high-privacy settings, no dark patterns, data minimization, and a best-interests duty of care. Even with the codes in litigation, the standard is spreading into comprehensive-law amendments (Connecticut, Montana), so audience analysis is now a compliance document.

Where does the design-code litigation stand?

California's CAADCA: preliminarily enjoined (NetChoice v. Bonta), with the Ninth Circuit affirming as to the DPIA provisions on First Amendment grounds and remanding the rest; not currently enforceable. Maryland's code: in effect since October 2024, facing a NetChoice challenge with the state defending a narrower drafting. Social-media access laws: Arkansas's struck down, Utah's revised after challenge, Florida's HB 3 partially enjoined, Texas's HB 18 partially enjoined. The pattern: data-protection provisions survive better than content/access restrictions.

What does Connecticut's minors' regime require operationally?

For services with actual knowledge or willful disregard of minor users: reasonable care to avoid heightened risk of harm; consent before targeted advertising, sale, or profiling of minors; consent before collecting precise geolocation (with an in-use signal); no dark patterns to prolong use (autoplay-style features restricted); default settings at the most protective level; and impact assessments. Montana copied this framework in its 2025 amendments, making it the template moving through legislatures.

What should a general-audience service do while the law churns?

Adopt the stable floor: (1) audience analysis documenting whether minors are 'likely'; (2) age signals treated honestly, birthdates, school context, and content skew defeat claimed ignorance; (3) no targeted advertising, sale, or consequential profiling for known or likely under-18s (Maryland makes this consent-proof anyway); (4) high-privacy defaults and no engagement dark patterns for minor experiences; (5) COPPA's 2025 requirements for under-13. This baseline survives every plausible litigation outcome and matches the amendment direction.

Regulatory Crosswalk

COPPACAADCAUK Children's Code

Organizations subject to this regulation often operate under these overlapping frameworks. BD Emerson maps controls across frameworks to reduce duplicated compliance effort.

Evaluate your compliance posture now

BD Emerson's automated scanner audits your public-facing properties against your applicable regulations in minutes, not weeks.

Run Free Scan Speak to an Expert