March 30, 2026 | Starting April 22, 2026, companies will be required to comply with the updated requirements under the Children’s Online Privacy Protection Act (COPPA) rule, as amended last year by the Federal Trade Commission (FTC).
The revised rule, which took effect June 23, 2025, sets additional requirements around the collection, use, and disclosure of children’s personal information. Notably, the April 2026 compliance deadline aligns with the timeline The Toy Association advocated for in written comments submitted in March 2024. See requirements below:
- Material Changes and Parental Consent:
Although the amended rule continues to require new parental consent for "material" changes to privacy practices, the Federal Register preamble clarifies that simply adding a new third-party recipient is not considered a "material" change that would require new parental consent.
- Data Retention Policies:
While the amended rule still does not set a fixed time limit for retaining children's personal information, it now requires operators to adopt written data retention policies that reference a time period, addressing concerns that data must not be retained indefinitely.
- Age Verification and Personal Information Collection:
The FTC considered, but ultimately rejected, an exception that would have allowed operators to collect sensitive personal information (such as photographs or government-issued IDs) solely for age verification without parental consent. The Commission decided that the privacy risks outweighed the potential benefits.
Click here to read the full text of the revised COPPA rule.
COPPA, which first went into effect in 2000, requires certain websites and other online services that collect personal information from children under the age of 13 to provide notice to parents and obtain verifiable parental consent before collecting, using, or disclosing personal information from these children. The rule was last updated in 2013 to reflect increased use of mobile devices and social media platforms.
Additionally, the FTC issued a new COPPA policy statement earlier this year addressing age verification for general- and mixed-audience sites, noting it will not take enforcement action against operators that collect limited personal information solely to determine a user’s age, subject to certain conditions. At a recent FTC COPPA workshop, FTC Chairman Andrew Ferguson highlighted age verification as central to future enforcement and reaffirmed the agency’s commitment to protecting minors online.
Members may reach out to Joan Lawrence, senior vice president of standards and regulatory affairs at The Toy Association, about questions on this topic.