Antitrust Law Daily Wrap Up, CONSUMER PROTECTION NEWS: Amendments to FTC COPPA Rule officially published, (Apr 22, 2025)

By Jeff Williams

Full compliance for rule changes, announced in January 2025, is April 22, 2026. Effective date for some provisions is June 23, 2025.

Amendments to the Children’s Online Privacy Protection (COPPA) Rule, which the FTC made in an effort to expand protections for children's data and to require operators to provide more information to parents, were officially published on April 22. The agency said that the changes were instituted to update the COPPA Rule in response to changes in technology and online practices, clarify the scope of the rule, and strengthen protection of children’s personal information. The amendments were based on the agency’s “enforcement expertise” and its review of public comments submitted in response to the notice of proposed rulemaking that the Commission launched in January 2024 to update the rule, consistent which the Children’s Online Privacy Protection Act (COPPA). The changes are effective June 23, 2025, with respect to certain provisions; however, full compliance is set for April 22, 2026.

Amendments. The COPPA Rule changes include a new definition for “mixed audience or online service” that is intended to “provide greater clarity” about the means by which operators of websites for which children are not the primary audience can determine whether a user is a child, the notice said.

“To the extent that a visitor identifies as under 13, the operator may not collect, use, or disclose the child’s personal information without first complying with the Rule’s notice and parental consent provisions,” the FTC said.

The agency also modified the definition of “online contact information” to include mobile telephone numbers and the definition of “personal information” used for verification purposes to include “government-issued identifiers and biometric identifiers that can be used for the automated or semi-automated recognition of an individual,” the notice said.

In addition, the definition of “support for the internal operations of the website or online service” was changed to “clarify that information collected for the enumerated activities in the definition may be used or disclosed to carry out those activities.”

The definition of a "website or online service directed to children” was augmented with examples of “evidence the agency may consider in analyzing audience composition and intended audience,” the FTC said.

The notice also said that the commission has modified “operators’ obligations with respect to direct and online notices; information security, deletion, and retention protocols,” as well as FTC-approved COPPA Safe Harbor programs’ annual assessment, disclosure, and reporting requirements.

Among other things, the FTC said that requiring operators to provide direct notice about third parties they might disclose personal data to “will enhance parent’s ability to make an informed decision about whether to consent to the collection of their child’s personal information” and that it “agrees with the many commenters that stressed the importance of clear and concise direct notices.”

Along with various style and grammar changes, the amendments also pertain to parental consent requirements, methods of obtaining verifiable parental consent, and exceptions to the rule’s parental consent requirement.

Among those changes, the FTC codified as an approved verifiable parental consent method the use of a knowledge-based authentication process that uses “dynamic, multiple-choice questions, where there are a reasonable number of questions with an adequate number of possible answers such that the probability of correctly guessing the answers is low” and questions that “are of sufficient difficulty that a child age 12 or younger in the parents’ household could not reasonably ascertain the answer."

The commission also noted that though it “remains deeply concerned about the use of push notifications and other engagement techniques that are designed to prolong children’s time online in ways that may be harmful to their mental and physical health,” it declined to take specific action out of concern they would be inconsistent with COPPA and raise First Amendment concerns.

To avoid making changes that could “conflict” with changes the Department of Education is considering, the FTC said it is not finalizing proposed amendments dealing with educational technology and provisions governing the collection of information from children in schools and codifying a school authorization exception to obtaining verifiable parental consent.

“The Commission will continue to enforce COPPA in the ed tech context consistent with its existing guidance,” the FTC added.

News: ConsumerProtection Privacy FederalTradeCommissionNews