COPPA Rule

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-04-22 Compliance date for most of the 2025 COPPA Rule amendments
2. 2026-02-25 FTC issues a COPPA policy statement on the use of age verification technologies
3. 2025-06-23 2025 amendments to the COPPA Rule take effect
4. 2013-07-01 2013 amendments to the COPPA Rule take effect

1. 2025-04-22
   COPPA Rule as amended April 2025 AmendmentCurrent text

   Added one definition, revised several others and updated key provisions for current technology; effective 23 June 2025, with compliance required by 22 April 2026. source

   More

   • Operators must obtain separate verifiable parental consent for disclosures to third parties.
   • A written children's personal information security program is required (312.8).
   • The written data retention policy must be included in the online notice (312.10).
   • Some safe harbor program obligations have earlier compliance dates.
2. 2024-01-11
   Proposed amendments (January 2024) Draft

   The FTC proposed amendments to the COPPA Rule. source

3. 2013-01-17
   COPPA Rule as amended January 2013 Amendment

   Modified the definitions of operator, personal information and child-directed service, and added a data retention and deletion provision; effective 1 July 2013. source

4. 1999-11-03
   Original COPPA Rule Major version

   First Children's Online Privacy Protection Rule, effective 21 April 2000. source

The rule applies to online operators that target children under 13 or knowingly collect their personal information.

Operators

Operators of child-directed websites or online services, and operators with actual knowledge that they collect personal information from a child. source

Core duties

Notice of what is collected and how it is used, verifiable parental consent before collection, use or disclosure, and a reasonable means for parents to review the information and refuse its further use or maintenance. source

Security

Operators must keep reasonable procedures to protect children's personal information and a written information security program suited to its sensitivity and the operator's size. source

Retention

Children's personal information may be kept only as long as reasonably necessary for its purpose, never indefinitely, under a written data retention policy. source

Operators assess their own security risks at least annually; industry safe harbor programs approved by the FTC are an alternative route.

Annual risk assessment

The security program must identify and, at least annually, assess risks to the confidentiality, security and integrity of children's personal information. source

Safe harbor programs

Industry groups may run FTC-approved safe harbor programs; their guidelines and member oversight are set out in 312.11. source

The FTC enforces the rule, and violations can carry civil penalties per violation.

Legal basis

A violation of the COPPA Rule is treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the FTC Act. source

Recent fines

1. 2025-12-30 $10,000,000

   Disney Worldwide Services and Disney Entertainment Operations – civil penalty in a stipulated court order over alleged COPPA violations on YouTube videos source

1. Law text 16 CFR part 312 – Children's Online Privacy Protection Rule
2. Law text Final rule amendments (22 April 2025)
3. Guidance FTC COPPA Rule page
4. Guidance Children's Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business

1. FTC Safeguards Rule

   Both are FTC rules; the Safeguards Rule protects financial institutions' customer information, while COPPA protects personal information collected online from children.

2. GDPR

   GDPR governs all personal data in the EU, with its own rules on children's consent; COPPA covers US online collection from children under 13.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to COPPA Rule (RSS)