FTC Finalizes Updates to COPPA

April 24, 2025 | On April 22, the Federal Trade Commission (FTC) formally published amendments to the Children’s Online Privacy Protection Act (COPPA) Rule that sets new requirements around the collection, use, and disclosure of children’s personal information.

The new rule will take effect on June 23, 2025, with most compliance obligations beginning April 22, 2026 — a timeframe for which The Toy Association™ advocated in written comments regarding the new rule submitted last March.

The published rule, initially finalized in January but delayed by an administrative freeze under the Trump administration, was reviewed and approved with only minor modifications under newly appointed FTC Chairman Andrew Ferguson:

• Material Changes and Parental Consent:
  Although the amended rule continues to require new parental consent for "material" changes to privacy practices, the Federal Register preamble clarifies that simply adding a new third-party recipient is not considered a "material" change that would require new parental consent.
  
  
• Data Retention Policies:
  While the amended rule still does not set a fixed time limit for retaining children's personal information, it now requires operators to adopt written data retention policies that reference a time period, addressing concerns that data must not be retained indefinitely.
  
  
• Age Verification and Personal Information Collection:
  The FTC considered but ultimately rejected an exception that would have allowed operators to collect sensitive personal information (such as photographs or government-issued IDs) solely for age verification without parental consent. The Commission decided that the privacy risks outweighed the potential benefits.

Click here to read the full text of the final rule.

The COPPA Rule, which first went into effect in 2000, requires certain websites and other online services that collect personal information from children under the age of 13 to provide notice to parents and obtain verifiable parental consent before collecting, using, or disclosing personal information from these children. The rule was last updated in 2013 to reflect increased use of mobile devices and social media platforms.

Members may reach out to Joan Lawrence, senior vice president of standards & regulatory affairs at The Toy Association, about questions on this topic.