The Federal Trade Commission (FTC) has unanimously approved and updated the Children’s Online Privacy Protection Act (COPPA) Rule in January 2025. This significant development marks a crucial milestone in enhancing the online privacy and protection of children in an increasingly digital world, particularly since the COPPA Rule hasn’t been updated since 2013.
Context and Initiation of the Update
COPPA, originally enacted in 1998 and effective 2000, is a federal law that was designed to protect children’s personal information and give parents control over what information is collected from their children online. The process to update COPPA Rules started back in 2019 and the efforts have included two rounds of public comments, multiple drafts, and negotiations. The FTC received more than 175,000 comments in response to its 2019 request for public comments, and 279 responsive comments to its latest 2024 Notice of Proposed Rulemaking (2024 NPRM).
Key Updates to the COPPA Rule
The updated COPPA Rule introduces several important changes aimed at strengthening the privacy protections for children online. Here are some of the key updates:
- Opt-in Consent for Targeted Advertising. The COPPA Rule states that covered operators are required to obtain separate, verifiable parental consent to disclose children’s personal information to third-party companies related to targeted advertising. Without parental consent, the covered operator may not condition a child’s access to the operator’s website or service on whether the child discloses personal information for behavioral advertising purposes and such advertising must be off by default.
- Data Retention. The updated COPPA Rule states that covered operators may only retain personal information for as long as reasonably necessary to fulfill a specific purpose for which it was collected. Operators are prohibited from indefinitely retaining children’s data. The FTC clarifies that covered operators are not required to establish, implement, and maintain a separate written children’s data retention policy if the operator has established, implemented, and maintained a written data retention policy that encompasses children’s personal information.
- Safe Harbor Program Transparency. Industry groups or other persons may apply to the FTC for approval of self-regulatory programs, known as COPPA Safe Harbor Programs. Within 6 months of publication of the COPPA Rule in the Federal Register, these COPPA Safe Harbor Programs must publicly disclose their membership lists and report additional information to the FTC, including copies of consumer complaints related to each operator’s violation of safe harbor program guidelines.
Reversal on EdTech Proposals
One of the notable changes in the finalized COPPA Rule versus the version published in the 2024 NPRM is the FTC’s rollback of rules related to education technology (edtech). The 2024 NPRM had included a school authorization exception to parental consent requirements and clarified contractual responsibility requirements between schools and edtech providers. Regarding its decision to hold back on finalizing proposed amendments related to edtech providers and the role of schools, the FTC states its understanding that the United States Department of Education has affirmed intent to propose amendments to the Family Educational Rights and Privacy Act, thus the FTC is holding back on ed tech updates to avoid conflict with these potential upcoming amendments. The FTC notes that it will still continue to enforce COPPA consistent with its existing guidance and will monitor for these upcoming developments from the United States Department of Education.
Implications for Businesses and Parents
The updated COPPA Rule has significant implications for businesses, especially those operating in the digital and technology sectors. Compliance with the new requirements may necessitate changes in data collection practices, privacy policies, and security measures. For parents, the updated rule provides an added layer of measures regarding their children's personal information.
