The Federal Trade Commission finalised changes to the Children’s Online Privacy Protection Rule to set new requirements around the collection, use and disclosure of children’s personal information and give parents new tools and protections to help them control what data is provided to third parties about their children.
The final rule requires parents to opt into third-party advertising. It includes other changes to address the emerging ways companies collect and use consumer data, particularly how children’s data is being shared and monetised.
“The updated COPPA rule strengthens key protections for kids’ privacy online,” said FTC Chair Lina M. Khan. “By requiring parents to opt into targeted advertising practices, this final rule prohibits platforms and service providers from sharing and monetising children’s data without active permission. The FTC is using all its tools to keep kids safe online.”
In January 2024, the FTC proposed changes to the COPPA rule to ensure it keeps pace with changes in the marketplace since the rule was last updated in 2013. The COPPA Rule, enacted in 2000, requires certain websites and other online services to obtain verifiable parental consent before collecting, using or disclosing personal information from children under 13.
It also provides other important rights for parents, including the right to require operators to delete personal information collected from their children. It imposes independent obligations on covered operators, for example, concerning data minimization and data retention.
In a notice that will soon be published in the Federal Register, the FTC made several amendments to the rule, including requiring opt-in consent for targeted advertising and other disclosures to third parties. Website and online service operators covered by COPPA will be required to obtain separate verifiable parental consent to disclose children’s personal information to third-party companies related to targeted advertising or other purposes.
There are also limits on data retention. The rule requires covered operators to only retain personal information for as long as reasonably necessary to fulfill the specific purpose for which it was collected. This provision explicitly states that operators cannot retain the information indefinitely.
There is also the need to increase the transparency of the Safe Harbor programs. The FTC-approved COPPA Safe Harbor programs, which are self-regulatory programs that implement the protections of the COPPA Rule, will be required to publicly disclose their membership lists and report additional information to the FTC to increase accountability and transparency in the programs.
The final rule includes several amended definitions, including expanding the definition of personal information to include biometric identifiers and government-issued identifiers.
After reviewing the nearly 300 comments the agency received on the proposed changes to the COPPA Rule, the commission decided against adopting some proposed changes, including proposed requirements that were intended to limit the use of push notifications directed to children without parental consent and changes relating to the requirements applicable to educational technology companies operating in a school environment.
While the commission declined to finalize those particular proposals, the agency notes that it remains concerned about the use of push notifications and other engagement techniques to keep kids online in ways that could harm their mental health.
The commission vote approving publication in the Federal Register of the final rule was 5-0. Chair Lina Khan and Commissioner Andrew Ferguson issued separate concurring statements. Commissioner Alvaro Bedoya and Commissioner Rebecca Slaughter issued a joint concurring statement.
The final rule will become effective 60 days after its publication in the Federal Register. Entities subject to the final rule will have one year from that publication date to come into full compliance with amendments that do not specify earlier compliance dates.
James Trilling and Elizabeth Averill from the FTC’s Bureau of Consumer Protection are the lead attorneys in this matter.
