As we recently reported, the Federal Trade Commission (FTC or Commission) finalized updates to the Children’s Online Privacy Protection Rule (COPPA Final Rule or Rule) on January 16, 2025, and the updates were due to take effect 60 days after publication in the Federal Register. However, an Executive Order issued by President Trump on January 20, 2025, freezes “proposing or issuing any rule or publishing any rule to the Office of the Federal Register until a new agency head appointed or designated by the President reviews and approves the rule.” The Executive Order means that publication of the amended COPPA rule will likely be delayed, and the Rule may still be subject to change.

FTC Commissioner and now FTC Chair Andrew Ferguson may want to use President Trump’s Executive Order to press the pause button on rules in general and to consider whether further clarifications to the COPPA Final Rule are merited. While Chair Ferguson voted in favor of the COPPA Final Rule updates prior to Trump’s 2025 inauguration, he took exception to three “major problems” with the Final Rule that he identified in a concurring statement.

• First, Chair Ferguson contended that what constitutes a “material change” to privacy terms, especially as they relate to categories of third parties with whom data is shared, requires clarification, “since not all additions or changes to the identities of third parties should require new (parental) consent.”
• Next, he objected to the Rule’s prohibition on keeping personal information collected online indefinitely, arguing that while well-intentioned, the result could be undesirable and incentivize disclosure of lengthy retention times. Section 312.10 of the Children’s Online Privacy Protection Act allows retention of children’s data only for “as long as is reasonably necessary to fulfill the purpose for which the information was collected.” This language is identical to language in the old COPPA Rule. Thus, “as long as the data continued to serve the same important function for which it was collected,” indefinite retention would be appropriate.
• Finally, Chair Ferguson stated that “the Commission missed the opportunity to clarify that the Final Rule is not an obstacle to the use of children’s personal information solely for the purpose of age verification.” He argued that “The old COPPA Rule and the Final Rule contain many exceptions to the general prohibition on the unconsented collection of children’s data, and these amendments should have added an exception for the collection of children’s personal information for the sole purpose of age verification, along with a requirement that such information be promptly deleted once that purpose is fulfilled.”

Businesses with an interest in children’s privacy should stay tuned for possible further action.