Cybersecurity Policy Report, Revisions Sought to FTC’s COPPA Age Verification Enforcement Approach, (Mar 19, 2026)

By Lynn Stanton

The Center for Digital Democracy, the Electronic Privacy Information Center (EPIC), and Fairplay have asked the Federal Trade Commission to revise its enforcement policy statement on age verification under the Children’s Online Privacy Protection Act (COPPA) by putting in place “stronger, privacy-protective age assurance standards.”

The FTC issued the policy statement last month, in which it said the collection, use, and disclosure of personal information by non-child-directed websites and online service providers for the purposes of age verification will not trigger FTC enforcement actions under its COPPA rule (CPR, Feb. 26).

CDD, EPIC, and Fairplay said in a letter to the FTC that the policy statement “sets a weak federal floor for age verification data practices.”

Specifically, they argued that the policy statement ignores COPPA’s goal of parental consent for collection of children’s data by “allowing operators of mixed audience or general audience websites or online services to collect personal information from every user, including children, without parental consent in order to determine which users are children,” they said in a press release. They also said the policy statement’s security standards for sensitive data were weaker than in the FTC’s rules and guidance and that they set the bar for third-party oversight below the FTC’s established standards. They said the policy statement would weaken data retention and deletion requirements and fail to safeguard against bias against different demographic groups.

News: FederalLegislation DataPrivacy