Children's Online Privacy and Subscription Consent Rules Under COPPA

Every service that collects data from a child under 13 is already operating under a rewritten set of federal rules, and the grace period for getting ready ended in the spring. This is the operative law of the land for anyone running a children's app, game, or subscription platform, already in force rather than a policy proposal working its way through a comment period.

The timeline matters because it shows how deliberate and final this process was. The FTC voted 5-0 to approve the amendments on January 16, 2025. That kind of unanimous, bipartisan vote makes the rule hard to unwind, regardless of who holds the Commission's seats down the road. The amendments were published in the Federal Register on April 22, 2025, became effective on June 23, 2025, and hit a full compliance deadline of April 22, 2026. That deadline has passed. Every covered operator is now expected to be in compliance, in full, today.

The reason the update landed with this much force comes down to what it replaced. The amendments close that gap, and they do it retroactively for every operator who didn't already build these protections in.

What "personal information" now covers that it didn't before

The entire structure of new consent and disclosure requirements rests on one foundational shift: the legal definition of "personal information" got a lot bigger. If a service collects something that now falls under that definition, every rule discussed in this piece applies to it, whether the operator planned for that or not.

Biometric identifiers are the clearest example. Fingerprints and handprints, retina and iris patterns, genetic data including DNA sequences, voiceprints and facial templates, and gait patterns and faceprints. That list isn't abstract. Fingerprint authentication on a tablet, facial recognition in a game or virtual reality app, a voice command feature in a kids' learning tool: these are everyday touchpoints, not edge cases. A service using any of them is now collecting regulated data, full stop.

Practitioners are watching closely how the FTC drew this line, because it means the raw biometric capture is covered, but derivative data built from analyzing that capture sits in murkier territory.

Government-issued identifiers expanded too. The rule used to focus narrowly on Social Security numbers. Now it explicitly reaches state identification cards, birth certificates, and passport numbers. Even mobile phone numbers get swept in when they're used to text a parent for consent purposes, which now count as "online contact information" under the rule.

What this means in practice: a service that once argued it collected no "personal information" because all it captured was a voiceprint or a facial template has lost that argument entirely. Those data types trigger the full weight of COPPA obligations now.

How the rule determines which services are covered

Which services actually have to comply? Parents tend to assume the rule covers a narrow set of children's apps, but the coverage is broader and blurrier than that.

Coverage isn't something an operator gets to declare for itself. Whether a service counts as "directed to children" is a determination the FTC makes using an expanded, non-exhaustive set of factors, and that list can catch services that never marketed themselves as children's products in the first place. The factors include marketing materials or plans, representations made to consumers or third parties, reviews left by users or third parties, and, notably, the age composition of users on similar websites or services.

That last factor matters: a general-audience gaming platform or video app could be evaluated, in part, by looking at who uses comparable platforms in its category. If similar services skew young, that composition becomes evidence against the operator, even when its own marketing never mentioned children.

The rule also formalizes a "mixed audience" category for platforms that are directed to children without primarily targeting them. Those operators have to run age screening before collecting any personal information, and they get access to the same consent exceptions available to fully child-directed services.

A video app, a general-audience game, or a social-adjacent product can be covered by COPPA even if it never calls itself a kids' service, which matters for any family evaluating what their child uses. The FTC's own plain-language guidance confirms that the rule reaches general-audience sites under certain conditions, and doesn't limit itself only to platforms explicitly built for children. Coverage follows audience reality over a company's self-description.

The bundled consent problem

The end of bundled consent is the structural center of the whole rewrite, the change most likely to affect a parent's daily life, because accepting one terms-of-service screen no longer covers both a service's internal use of a child's data and its disclosure of that data to third parties.

Consider how the old model worked. A parent would see a button that said something like "By clicking Agree, you consent to our Terms of Service and Privacy Policy." Subscription platforms that monetized through behavioral profiles leaned on exactly this structure for years, because it let one click cover everything a data pipeline needed.

That door is closed now. Operators have to get separate, verifiable parental consent before disclosing a child's personal information to third parties for targeted advertising, data broker relationships, or AI training. The two consents (internal use, and third-party disclosure) can be requested at the same time or at different points in a signup flow, but each one has to be clearly distinguished from the other and obtained through an unambiguous, affirmative action from the parent. No more single checkbox doing double duty.

The direct notice sent to parents has to spell out that consenting to the collection and use of a child's data does not mean consenting to third-party disclosure of that data, except when the disclosure is necessary for the purpose the service was already providing.

That "necessary" carve-out is narrower than it sounds. Integral disclosures cover things like payment processing, content delivery, and safety monitoring. They do not cover advertising, data broker relationships, or AI training, and the FTC stated that targeted advertising and AI training are "never integral" to any website or service, so they always require their own separate consent, with no exceptions.

For subscription platforms built around behavioral advertising, this changes the underlying business logic. Profiling a user for ad targeting typically depends on persistent identifiers and cross-service tracking, and that kind of tracking can no longer ride along inside a standard subscription signup. Parents effectively have a new right: the ability to say yes to the app and no to the data pipeline feeding the ad network, as two distinct decisions rather than one bundled click.

New methods for giving parental consent

Once separate consent is required, the next question is how a service actually collects it, and the answer isn't uniform across the industry. The amended rule codifies new methods for verifiable parental consent, and the method a given service picks isn't a neutral technical detail. It changes how easy or hard it is for a child to pose as their own parent.

Three methods are newly codified. Knowledge-based authentication uses dynamic, multiple-choice questions built to be sophisticated enough that a child under 13 can't guess the right answers, and random guessing doesn't work either. Photo identification via facial recognition matches a parent's webcam photo against a government-issued ID, and the rule requires immediate deletion of that ID image and photo once the match is confirmed. Text-plus verification pairs a text message with an additional step, like a confirmatory follow-up text or postal mail confirmation, but this option is only available to operators who don't disclose children's data to third parties, precisely because it carries a higher risk that a child could pose as a parent.

That restriction is a useful thing for parents to know when evaluating an app. If a service uses text-plus verification and also shares data with third parties, that combination is a compliance red flag on its face, since the rule doesn't allow that pairing.

The FTC issued an age-verification policy statement on February 25, 2026 that limits enforcement of COPPA in cases where children's data is collected for age-verification purposes without parental consent obtained first. That leniency only applies when the company is otherwise fully compliant with the rest of the rule. It's a narrow accommodation for the specific mechanics of figuring out how old a user is in the first place, not a loophole around consent requirements generally.

What services must now tell parents

Consent requirements only work if parents actually understand what they're agreeing to, and that's the gap the disclosure rules are built to close. The 2025 amendments raise the bar on specificity across both the direct notice a parent receives and the broader privacy policy a service posts publicly, aiming to give parents enough information to make a real decision instead of a nominal one.

The direct notice to parents now has to identify the categories of third parties the operator plans to share a child's data with, and explain why that sharing happens. It also has to spell out, in plain terms, that parents can consent to collection and internal use without consenting to third-party disclosure.

Privacy policies carry their own new obligations. They need to disclose data retention practices, how persistent identifiers get used, how audio files are handled where relevant, and the specific identities and categories of third parties receiving a child's data. They also need to explain the purposes behind collecting persistent identifiers and describe what the operator does to prevent those identifiers from being repurposed without authorization.

For a parent reading through one of these notices, the test is straightforward. Vague phrases like "trusted partners" or "third-party vendors," without naming actual categories of who those partners are, don't meet the bar anymore. A compliant notice names things. It says what kind of company gets the data and why, not just that "partners" exist somewhere downstream.

The data retention requirement deserves particular attention, because it's genuinely new. Operators now have to maintain a written data retention policy, and they're barred from holding onto a child's personal information indefinitely. A parent reviewing a privacy notice today should expect to see an actual answer to "how long is this kept," not silence on the question. If that answer isn't there, the notice is very likely running on old language that hasn't caught up to the rule.

AI training on children's data now requires its own parental consent

This is the most forward-looking piece of the whole rewrite, and arguably the one carrying the most weight for where children's data ends up next. For the first time in American law, disclosing a child's personal information to a third party for the purpose of training or developing an AI system requires its own separate, verifiable parental consent, and that obligation has been mandatory since April 22, 2026.

The FTC's own commentary on the rule doesn't leave room for interpretation here. The FTC's commentary on the rule states that disclosures of a child's personal information to train or otherwise develop artificial intelligence technologies are not integral to a website or online service and require separate, verifiable parental consent.

The practical risk sits somewhere many parents wouldn't think to look. Children's apps and subscription platforms often run on embedded third-party tools: analytics software, personalization engines, A/B testing frameworks. Many children's apps and subscription services use embedded third-party SDKs, such as analytics, personalization, and A/B testing tools, that may feed data into model training pipelines, and practitioners are now treating every embedded SDK as a potential compliance point. Compliance practitioners have started treating every embedded SDK inside a children's app as its own potential point of exposure.

An operator can't wave that risk away by pointing at the third-party vendor. The Apitor Technology settlement made that clear: an embedded tool's behavior is attributed to the operator running the app, and a company can't disclaim responsibility for what a third-party SDK collects just because the SDK, not the company's own code, is doing the collecting.

None of this cancels out the other side of the AI story. The FTC has also recognized AI-driven age verification as a legitimate compliance tool, issuing a policy statement on February 25, 2026 that limits enforcement when children's data is collected for age-verification purposes. That accommodation only holds, again, when the service is otherwise fully compliant with the rest of the rule. AI appears on both sides of this rule: it is a use of children's data that now demands its own dedicated consent, and it is a tool the FTC allows operators to use carefully, provided everything else checks out.

What enforcement actions show about the gaps in practice

Enforcement is where the theory of this rule meets the reality of how children's apps are actually built. A company can write a pristine privacy policy and still be out of compliance because of what a third-party analytics tool bundled into its app is quietly doing in the background.

That pattern suggests the next wave of enforcement will center less on obvious violations, like a company openly selling children's data without any consent process. It will center on the gap between what an operator's privacy policy claims and what its actual technical stack does once installed on a child's device. A service can have a fully rewritten, rule-compliant notice and still fail if nobody audited what its third-party SDKs are sending out the back door.

The rule gives parents an enforceable set of rights across these disclosures, methods, and consent categories. The rule gives families real, enforceable rights: separate consent for advertising and AI training, specific disclosure of who gets a child's data and why, and a hard line on how long that data can be kept. Whether any given app actually lives up to those rights depends on enforcement catching up to the gap between policy language and the code running underneath it, and the Apitor case shows that gap is exactly where the FTC has started to look.