New Changes To Children’s Online Privacy Act (COPPA)
On January 16, 2025, the U.S. Federal Trade Commission (“FTC”) finalized its amendments to the Children’s Online Privacy Protection Rule, consistent with the requirements of the Children’s Online Privacy Protection Act (COPPA).
COPPA applies to operators of websites and online services that collect personal information from children under 13 years old, whether those operators direct their services to children (think: an app for kids) or have actual knowledge that they are collecting personal information from children online (such as YouTube, which in 2019 paid $170 million to settle allegations from the FTC and NY Attorney General related to its COPPA non-compliance). The COPPA Rule requires that these websites and online services obtain verifiable consent before collecting, using, or disclosing personal information from children under 13.
Some highlights of the amendments include:
Opt-in Consent for Targeted Advertising: Parents must opt in to third-party advertising. This is important because most websites’ consent mechanisms are opt out. For example, if you have a Meta pixel on your site, the information about your users is automatically sent to Meta for targeted advertising, unless and until they opt out. Now, website and online service operators subject to COPPA will be required to obtain separate verifiable parental consent to disclose the children’s personal information to third-party companies for targeted advertising or other purposes)
Limits on Data Retention: The rule clarifies that websites and operators may not hold on to personal information “indefinitely” in their interpretation of as long as “reasonably necessary” to fulfil the specific purpose for which the personal information was collected. This mirrors the approach of some state’s comprehensive privacy laws, such as California.
Increasing Transparency for the Safe Harbor Programs: FTC-approved COPPA Safe Harbor programs will be required to publicly disclose their membership lists and report additional information to the FTC.
Expanded Definitions: The definition of personal information now includes biometric identifiers.
The Final Rule will go into effect 60 days after publication in the Federal Register.
Online operators that direct their sites or services to children will have to make certain important changes, by the end of Q1.
