
FTC Finalizes Amendments to the Children's Online Privacy Protection Act Rule
On April 22, 2025, the Federal Trade Commission ("FTC") published the finalized amendments to the Children's Online Privacy Protection Act ("COPPA") Rule (the "Rule"), marking the first major update since 2013.
According to the FTC, the 2025 amendments are intended to reflect technological advancements and evolving online marketing and security practices. The FTC previously published a Notice of Proposed Rulemaking ("NPRM") in December 2023 to revise the Rule. The Rule goes into effect on June 23, 2025, and companies have until April 22, 2026, to comply.
Key features of the amendments include:
- Opt-in verifiable parental consent for targeted advertising. Operators must obtain separate and specific opt-in consent for target advertising before collecting or disclosing children's personal information. Marketing consent cannot be included in a general consent to data collection and use.
- Parental consent and notice. Operators must notify parents that consent to third-party sharing is voluntary and would not restrict the data collection and use by the operator, unless such disclosure is integral to the service (e.g., sharing for product delivery).
Notices to parents must identify third-party data recipients (by name or category), purposes for sharing, and provide clear explanations of data uses.
The Rule adds three new methods for obtaining verifiable consent: knowledge-based questions, use of government IDs, and facial recognition technology to match a parent's face, and, in certain circumstances, text messages to parents. - Policies. Operators must maintain a written data retention policy and information security program with the data retention policy being published in the operator's privacy notice.
- Third-party diligence. Operators must now take "reasonable steps" to ensure that third parties receiving children's personal information can maintain the information's "confidentiality, security, and integrity."
Notably, the Rule reflects some changes in the FTC's direction originally proposed in the NPRM, including:
- FTC did not adopt a proposed ban on engagement techniques (e.g., push notifications) that prolong children's time online, citing overbreadth and First Amendment concerns.
- The published Rule dropped some proposals relating to educational technology, citing a desire to avoid conflict with potential updates to the FERPA regulations.