On January 16, 2025, the Federal Trade Commission (FTC) issued a press release confirming that it has finalized changes to the Children’s Online Privacy Protection Rule (COPPA Rule). These changes will set new requirements around the collection, use and disclosure of children’s personal information and give parents new tools and protections to help them control what data is provided to third parties about their children.
The COPAA Rule first went into effect in 2000 and requires certain websites and other online services to obtain verifiable parental consent before collecting, using or disclosing personal information from children under 13. It also provides other important rights for parents, including the right to require operators to delete personal information collected from their children, and imposes independent obligations on covered operators, for example, with respect to data minimization and data retention.
In January 2024, the FTC proposed changes to the COPPA Rule to ensure it keeps pace with changes in the marketplace. The final rule requires parents to opt-in to third-party advertising and includes other changes to address the emerging ways that consumers’ data is collected and used by companies—particularly how children’s data is being shared and monetized. In a notice that will soon be published in the Federal Register, the FTC made several amendments to the rule, including:
- Requiring opt-in consent for targeted advertising and other disclosures to third parties: Website and online service operators covered by the COPPA Rule will be required to obtain separate verifiable parental consent to disclose children’s personal information to third-party companies related to targeted advertising or other purposes.
- Limits on data retention: The COPPA Rule requires covered operators to only retain personal information for as long as reasonably necessary to fulfill a specific purpose for which it was collected. This provision explicitly states that operators cannot retain the information indefinitely.
- Increasing Safe Harbor programs’ transparency: The FTC-approved COPPA Safe Harbor programs, which are self-regulatory programs that implement the protections of the COPPA Rule, will be required to publicly disclose their membership lists and report additional information to the FTC as part of efforts to increase accountability and transparency in the programs.
The Commission's vote to approve the final rule's publication in the Federal Register was 5-0. Chair Lina Khan and Commissioner Andrew Ferguson issued separate concurring statements. The final rule will become effective 60 days after publication in the Federal Register. Entities subject to the final rule will have one year from that publication date to come into full compliance with amendments that do not specify earlier compliance dates.
“The updated COPPA rule strengthens key protections for kids’ privacy online,” said FTC Chair Lina M. Khan. “By requiring parents to opt in to targeted advertising practices, this final rule prohibits platforms and service providers from sharing and monetizing children’s data without active permission. The FTC is using all its tools to keep kids safe online.”
©2025 Katten Muchin Rosenman LLP