On April 22, 2025, the Federal Trade Commission (FTC) published final updates to the Children's Online Privacy Protection Act Rule (COPPA Rule). The final COPPA Rule goes into effect on June 23, 2025, 60 days after its publication; however, regulated entities have until April 22, 2026, to comply with all provisions except with respect to certain annual reporting and notice requirements related to the COPPA Safe Harbor programs, which have earlier compliance deadlines.
If you provide services that are directed at children or collect personal information from children, then now is the time for you to review what data you are collecting and ensure that your data collection, data retention policies, and consumer-facing notices comply with these new requirements. This analysis may entail taking stock of which third-party companies access children's data and whether such access is integral to the website or online service provided.
These updates to the COPPA Rule are designed to give parents more control over their children's data, specifically allowing them to protect and control what data about their children is shared with and monetized by third parties. The updates mark a significant step taken by the FTC to strengthen the COPPA Rule in the light of technological developments and increasing use of smartphones and social media platforms by kids.
The final rule includes the following key updates.
Expanded definition of personal information: The COPPA Rule defines "personal information" as individually identifiable information about an individual collected online. The definition of personal information has been expanded to include "[a] biometric identifier that can be used for the automated or semi-automated recognition of an individual, including fingerprints or handprints; retina and iris patterns; genetic data, including a DNA sequence; or data derived from voice data, gait data, or facial data."
Requirement to maintain a written security policy: Companies subject to the COPPA Rule must establish, implement, and maintain a written information security program. The updated COPPA Rule details several requirements of the written information security policy, including the designation of an employee to coordinate the security program. The FTC has stated that these updates aim "to include flexibility that will help ensure small businesses do not face undue burdens."
Requirement to obtain opt-in consent for targeted advertising and other disclosures to third parties: Companies subject to the COPPA Rule must obtain separate verifiable parental consent prior to disclosing children's personal information to third parties for targeted advertising or other purposes that are not integral to the website or online service. The FTC stated that this change "enhances transparency and enables parents to make more deliberate and meaningful choices" about the data practices affecting their children.
Limits on data retention: Companies subject to the COPPA Rule can retain children's personal information for only as long as reasonably necessary to fulfill a specific purpose for which it was collected. Companies must establish and maintain a written children's data retention policy laying out the purposes for collecting and retaining the data and the time frame for deleting the data, which cannot be indefinite. The FTC has clarified that companies do not need to make a new policy if they maintain an existing data retention policy that addresses children's data and otherwise meets the requirements of these updates.
Increasing Safe Harbor programs' transparency: COPPA Safe Harbor programs are self-regulatory industry groups regulated by the COPPA Rule that implement protections that are substantially the same as or greater than those in the COPPA Rule. The FTC has adopted several amendments to enhance the transparency and oversight of these programs, including a requirement that they publicly disclose a list of participating companies and their certified websites and services.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
