Children's Online Privacy Protection Rule - 2025 Amendments
United States · Regulation · Federal Trade Commission
Our summary
The Federal Trade Commission amended the Children's Online Privacy Protection Rule to strengthen protections for children's personal information in light of evolving technology and online practices. The amendments add new definitions covering mixed audience services and expanded categories of personal information including biometric identifiers and mobile numbers, and modify requirements for parental consent, notice, data security, and information retention. Operators of websites and online services directed to children under 13 must comply by April 22, 2026.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
22 sections
Jump to a chapter
§ 312 5(b)(2)(ix)
Personal information includes biometric identifiers used for automated or semi-automated recognition such as fingerprints, handprints, retina or iris patterns, genetic data, voiceprints, gait patterns, facial templates or faceprints, and government-issued identifiers such as Social Security numbers, state identification card numbers, birth certificate numbers or passport numbers. Biometric identifiers may be collected and used temporarily for age verification or parental consent with prompt deletion. Operators must disclose in direct parent notices the specific personal information to be collected, how it will be used, the third-party recipients by name or category and their purposes, that parents may consent to collection and internal use without consenting to third-party disclosure except when disclosure is integral to the service, and their data retention policy; in online notices, operators must identify third-party recipients by both names and specific categories, describe in general terms how they use persistent identifiers for internal operations without disclosing security details, and explain the purposes for collecting audio files containing children's voices and that they delete them after fulfilling requests.
§ 312.2 ’s definition of the ‘‘support for
Approves a text plus method enabling operators to send messages to a parent's mobile phone to obtain verifiable parental consent, modeled on the existing email plus approach. This method addresses parental convenience and mobile phone familiarity, with comparable security and storage considerations to email-based consent. The Commission determined that security risks for text messaging are comparable to email, that storing consent forms on mobile devices is manageable similar to email, and that text messages can be forwarded to email accounts for easier storage and organization.
Part II B.2.b, based on the record, the
3 sections
Finds that text and email present comparable security risks and storage difficulties. Parents reading consent documents via text message or email on mobile devices face similar experience, and text messages can be forwarded to email for retention, supporting the validity of text-based consent methods.
§ 312.8 ’s requirements. In particular, as
Operators must retain children's personal information only as long as reasonably necessary to fulfill the purposes for which it was collected, and must delete it when no longer reasonably necessary for those original purposes; indefinite retention is prohibited. Operators must establish written data retention policies specifying the purposes for collection and corresponding deletion timeframes, and include these policies in notices to parents.
§ 312.10 The IAB asked the
Operators may gather children's personal information for disclosed purposes including service improvement, content personalization, and internal website operations without restricting privacy or security-enhancing uses, and must list each purpose with justification and removal timeframe in their online notice. Operators must retain data only as long as reasonably needed for stated purposes, though may retain it for a documented business need after a child stops using the service or subscription ends, and must establish and maintain written policies stating collection purposes, business justification for retention, and deletion timeframes; a general policy covering both children's and other personal information satisfies this if published in the online notice. Indefinite or permanent retention is barred.
§ 312.7 ’s prohibition against collecting
FTC-approved COPPA Safe Harbor programs must review operators' information privacy and security practices, not just privacy practices. The programs do not need to conduct assessments using a separate children-only security program, and assessment costs may differ based on operators' size, complexity, and scope of activities.
Section 312 11(d) of the Rule sets
1 section
FTC-approved COPPA Safe Harbor programs must submit annual reports identifying each subject operator and approved websites or services, copies of consumer complaints against operators, and disciplinary processes. They must maintain records for at least three years and publicly post lists of their subject operators.
§ 312.8.689 Clarifications on compliance burden
Operators of children-directed websites or online services that collect personal information (estimated 6,140 subject operators, 94-98% small businesses) must establish and maintain a written comprehensive information security program and disclose data retention policies, with flexibilities including designating an employee coordinator with other duties, maintaining a single general retention policy, and tailoring security programs to their operations. Third-party disclosure recipients may be identified by name or category, safe harbor programs must list current operators and update every six months plus submit three-year reports on technological assessment capabilities, and verifiable parental consent is not required for persistent identifiers in contextual advertising. Compliance requires legal and technical personnel with costs varying by operational factors and participation choices.
Part 312 Children’s online
13 sections
This part establishes the COPPA Rule framework with 13 sections covering scope, definitions, regulation of unfair or deceptive practices in collection and disclosure of children's personal information, parental notice and consent, parental review rights, restrictions on conditioning participation on data collection, security and confidentiality, enforcement, data retention and deletion, safe harbor programs, and voluntary Commission approval processes.
§ 312.1 Scope of regulations in this part
These regulations enforce the 1998 Children's Online Privacy Protection Act, which makes illegal any unfair or deceptive conduct involving the gathering, application, and distribution of personal data about and from minors on the internet.
§ 312.2 Definitions
A child is an individual under 13 years old; collection includes requesting or encouraging submission of personal information, enabling children to make it publicly available, and passive online tracking, but operators are not collectors if they delete personal information from children's public posts before publication and from records. Personal information means individually identifiable information including names, addresses, online contact information, screen names, phone numbers, government identifiers, persistent identifiers, photographs or audio/video with a child's image or voice, geolocation information, biometric identifiers, or information combined online with an identifier. An operator is a person operating a commercial website or online service collecting or maintaining user personal information, excluding qualifying nonprofits; a parent includes legal guardians; release means sharing, selling, renting or transferring to a third party; support for internal operations covers activities to maintain or analyze the website, perform network communications, authenticate users, personalize content, serve contextual advertising or cap ad frequency, protect security or integrity, ensure compliance, or fulfill child requests, but collected information cannot be used otherwise or to contact individuals, create profiles, or conduct behavioral advertising; and a website or online service directed to children is commercial content targeted to children, determined by subject matter, visual content, animated characters, audio content, model age, child celebrities, language, advertising, audience composition evidence, or actual knowledge of collecting from children's site users.
§ 312.3 Regulation of unfair or deceptive
Operators of children-directed websites or those knowingly collecting data from minors must comply with five core requirements: disclose what personal data they gather and how they handle it; secure parental permission before gathering or sharing information; let parents access and control their child's information; avoid conditioning participation in games or activities on disclosing unnecessary information; and put in place protective measures to safeguard confidentiality, safety, and reliability of collected data.
§ 312.4 Notice
Operators must provide clear, complete notice and obtain verifiable parental consent before collecting, using or disclosing children's personal information, specifying contact information collected, that parent consent is required, specific personal information items and uses, third-party recipient identities or categories and disclosure purposes (noting parents may consent to use without consenting to disclosure unless integral to service), a privacy practices hyperlink, consent means, and deletion of contact information and names if consent is not provided within reasonable time; when notifying parents of child activities, explain contact data use and opt-out rights, and disclose child contact information collected for communications will not be shared or combined with other data; for safety purposes disclose collection of child and parent contact information and its sole use accordingly. Operators must display a visible, distinctly identified privacy notice link on website entry pages and at each information collection section for minors, listing names, addresses, phones and emails of all collectors or maintainers (with one designated contact point), describing information collected, use, third-party sharing, whether children can make information public, retention practices, and procedures for parental review, deletion and opt-out rights.
§ 312.5 Parental consent
Operators must obtain verifiable parental consent before collecting, using or disclosing personal information from children, allowing separate consent for collection/use and third-party disclosure unless disclosure is integral to the service. Acceptable methods include signed forms, credit/debit card or online payment, staffed toll-free numbers, video-conference, government-issued ID verification, knowledge-based authentication, facial recognition, and for non-disclosing operators email or text message with confirmatory contact, with notice of revocation rights; Commission-approved safe harbor programs may approve other methods meeting baseline requirements. Operators may collect parent or child name and contact information to obtain consent without prior consent, deleting it if consent is not obtained after reasonable time, and need not obtain prior consent for safety, security, integrity, legal compliance, law enforcement, or persistent identifiers for internal operations support.
§ 312.6 Right of parent to review personal
Operators must provide parents with a description of types of personal information collected from their child, allow parents to refuse future collection and direct deletion, and provide a means to review the collected information. Parents must be verified using available technology and the review process must not be unduly burdensome to parents. Operators may terminate services if a parent refuses continued collection or demands deletion.
§ 312.7 Prohibition against conditioning a
Operators are prohibited from requiring children to disclose more personal information than is reasonably necessary in order to participate in games, win prizes, or engage in other activities.
§ 312.8 Confidentiality, security, and
Operators must establish reasonable procedures protecting children's personal information and implement a written security program with safeguards appropriate to the sensitivity and volume of data. They must designate security coordinators, conduct annual risk assessments, design and test safeguards, and evaluate the program annually. Before allowing third parties to handle children's information, operators must verify their capability and obtain written assurances of protection.
§ 312.9 Enforcement
§ 312.10 Data retention and deletion
Operators must retain children's personal information only as long as reasonably necessary for the purposes collected and must delete it using reasonable protective measures. Operators must establish and maintain a written data retention policy specifying purposes for collection, business need for retention, and deletion timeframes, which must be disclosed in the privacy notice.
§ 312.11 Safe harbor programs
Industry groups may apply to the FTC for approval of self-regulatory guidelines providing protections substantially equivalent to or greater than this rule; approved programs must include annual independent compliance assessments, discipline mechanisms, and annual reporting to the FTC, with Commission approval decisions issued within 180 days. Approved programs must describe their business model and services, provide consumer complaints and disciplinary records, post a public list of all current operators and certified services by July 21, 2025 and update it every six months, respond promptly to Commission requests, and maintain records for at least three years; modifications to guidelines require Commission approval. An operator complies with the main privacy requirements if it follows Commission-approved safe harbor guidelines; the Commission will consider participation history, remediation of non-compliance, and safe harbor disciplinary actions when deciding whether to investigate or enforce.
§ 312.12 Voluntary Commission Approval
§ 312.13 Severability
The regulatory provisions are independent of one another, and if any provision is stayed or declared invalid, the remaining provisions are intended to continue in effect.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.