Cybersecurity Policy Report, Info Collected for Age-Verification Not Covered Under COPPA, FTC Says, (Feb 26, 2026)

By Lynn Stanton

The collection, use, and disclosure of personal information by non-child-directed websites and online service providers for the purposes of age verification will not trigger Federal Trade Commission enforcement actions under its Children’s Online Privacy Protection Act (COPPA) rules, the FTC said in a policy statement issued yesterday.

“Age verification can play a critical role in protecting children online and helping parents as they monitor their children’s online activities. To promote innovation in, and the responsible use of, age-verification mechanisms, the Commission is issuing this enforcement policy statement (‘Enforcement Statement’) to describe how operators of websites or online services directed to children that do not target children as their primary audience (known as ‘mixed audience’ websites or online services), as well as operators of general audience sites or services (collectively ‘Relevant Operators’), can utilize age-verification mechanisms without subjecting themselves to the risk of enforcement under the COPPA Rule,” the FTC said.

“To encourage the use of robust age-verification mechanisms, the Commission will not bring an enforcement action under the COPPA Rule against a Relevant Operator that collects, uses, or discloses personal information for the purpose of determining a user’s age (‘Age Verification Purposes’) without first obtaining verifiable parental consent. The Commission seeks to encourage Relevant Operators to use these mechanisms to determine a user’s age more accurately and reliably. These more accurate determinations will in turn allow Relevant Operators to apply their child-protection measures to the fullest extent, thereby protecting more children online,” it said.

The FTC said the enforcement discretion would be applied only to operators that adhere to a number of conditions, including not using or disclosing information collected for age-verification purposes for any other purposes; disclosing such information “only to those third parties that the Relevant Operator has taken reasonable steps to determine are capable of maintaining the confidentiality, security, and integrity of the information” and that will delete the information “promptly after fulfilling the Age Verification Purposes”; and not themselves retaining the information longer than necessary for age verification.

To qualify for enforcement discretion, operators also must provide “clear notice to parents and children of the information collected for Age Verification Purposes in the Relevant Operator’s privacy policy”; employ “reasonable security safeguards for information collected for Age Verification Purposes”; and take “reasonable steps to determine that any product, service, method, or third party utilized for Age Verification Purposes is likely to provide reasonably accurate results as to the user’s age,” the FTC said.

“In addition, the Commission will not exercise its enforcement discretion in circumstances described in this Enforcement Statement unless the Relevant Operator is complying with the COPPA Rule’s requirements in every other respect with regard to personal information collected from children,” it added.

It also said it planned “in the coming months” to launch a review of its COPPA rules “to address age-verification mechanisms. This Enforcement Statement will remain effective until the Commission publishes final rule amendments on this issue in the Federal Register, or until otherwise withdrawn.”

News: FederalLegislation DataPrivacy