COPPA Compliance for Apps and Ed-Tech: The Amended FTC Rule Explained

COPPA compliance is mandatory for any online service aimed at children under 13 in the United States, and for general-audience services that know they are collecting data from such children. The Children's Online Privacy Protection Act and the Federal Trade Commission's COPPA Rule require parents to be told what is collected and to give verifiable consent before it happens, and they restrict how children's data can be used and shared. The FTC has enforced the rule against app developers, game companies, ed-tech platforms and some of the largest technology firms, with penalties in the hundreds of millions of dollars.

The FTC amended the rule in 2025. The changes took effect in June 2025, with compliance required by 22 April 2026, and they tighten consent for third-party disclosures and targeted advertising, add written security programme and retention policy requirements, and expand what counts as personal information. This guide explains who COPPA applies to, the core requirements, the 2025 changes, how to design consent and data flows in apps, and the enforcement record.

What is COPPA?

COPPA is a US federal law passed in 1998 (15 U.S.C. 6501 and following). It directed the FTC to issue rules, which are in 16 CFR Part 312 and first took effect in 2000. The rule applies to operators of commercial websites and online services, including mobile apps, games, connected toys and voice assistants, that are:

• Directed to children under 13, in whole or in part, judged by factors such as subject matter, visual content, use of animated characters, child-oriented activities and incentives, music, the age of models, child celebrities, advertising and evidence about the audience; or
• General audience services with actual knowledge that they are collecting personal information from a child under 13; or
• Third parties, such as ad networks and plug-ins, with actual knowledge that they collect personal information from users of a child-directed service.

Personal information includes name, address, online contact information, screen names that function as contact information, phone numbers, government identifiers, persistent identifiers that can recognise a user over time and across services (such as cookies and device IDs), photos, videos and audio containing a child's image or voice, geolocation sufficient to identify a street and town, and, under the 2025 amendments, biometric identifiers.

History and why COPPA was introduced

In the late 1990s, children's websites were collecting detailed personal information through registrations, contests and chat, often without parents knowing. Congress passed COPPA to give parents control. The FTC updated the rule in 2013 to cover mobile apps, persistent identifiers, photos, videos and audio, and third-party plug-ins and ad networks. In January 2025, after a review that began in 2019, the FTC finalised further amendments, published in the Federal Register on 22 April 2025.

Core requirements

Notice

Operators must post a clear, complete online privacy notice describing their practices for children's information, and give parents a direct notice before collecting information, explaining what will be collected, how it will be used and disclosed, and how to give consent.

Verifiable parental consent

Before collecting, using or disclosing a child's personal information, operators must obtain verifiable parental consent, using a method reasonably calculated to ensure the person giving consent is the child's parent. Accepted methods include a signed consent form, a credit or debit card or other payment transaction with notice, a toll-free call or video call with trained staff, checking a government ID against databases, and other FTC-approved methods; the 2025 amendments added methods such as knowledge-based authentication, facial matching against a government ID, and text message methods in certain cases. Limited exceptions allow collection without consent, for example to provide notice and seek consent, to respond once to a child's request, or to support internal operations using persistent identifiers only.

Parental rights

Parents can review the information collected, refuse further collection or use, and have it deleted.

Data minimisation and conditioning

Operators must not condition a child's participation in an activity on providing more information than is reasonably necessary.

Security, retention and deletion

Operators must maintain reasonable procedures to protect the confidentiality, security and integrity of children's information, retain it only as long as reasonably necessary, and delete it securely.

What changed in the 2025 amendments

• Separate consent for third-party disclosures: operators must obtain separate verifiable parental consent before disclosing children's personal information to third parties, for example for targeted advertising, unless the disclosure is integral to the service.
• Written information security programme: operators must establish, implement and maintain a written programme with safeguards appropriate to the sensitivity of children's data, with a designated coordinator, annual risk assessments, testing and monitoring.
• Written data retention policy: operators must publish a retention policy stating the purposes for collection, business needs for retention and a timeframe for deletion, and may not keep data indefinitely.
• Expanded definitions: biometric identifiers are personal information; a "mixed audience" category clarifies how services directed to children but not primarily to them must screen users.
• More consent methods and changes to notice content, including identifying third parties and purposes.
• Safe harbor transparency: approved safe harbor programs must publish their membership lists and report more information to the FTC.

The amendments took effect on 23 June 2025; regulated entities had until 22 April 2026 to comply with most of them.

How to comply, step by step

1. Decide whether your service is child-directed, mixed audience or general audience, using the FTC's factors and your actual audience data.
2. For mixed audience and general services, implement a neutral age screen that does not encourage children to falsify their age, and route under-13 users to a compliant experience.
3. Map data flows: every SDK, analytics tool, ad network and plug-in that collects data, including persistent identifiers.
4. Minimise collection: remove fields and identifiers you do not need; avoid collecting precise location, photos and voice unless essential.
5. Implement verifiable parental consent with an accepted method, and separate consent for third-party disclosures.
6. Disable behavioural advertising for children unless you have separate consent, and configure SDKs for child-directed treatment.
7. Publish the privacy notice and retention policy, and send direct notices to parents.
8. Build parental tools to review, refuse further collection and delete.
9. Write and run an information security programme for children's data.
10. Consider joining an FTC-approved safe harbor program.

Designing a compliant age screen and consent flow

Product decisions in the first minute after a user arrives determine most of a service's COPPA exposure. Patterns that hold up:

• Neutral age question. Ask for date of birth or age without hints such as "you must be 13 or older", and do not let users immediately go back and change their answer.
• Collect only a parent's contact first. For an under-13 user, collect the parent's email or phone solely to send the direct notice and request consent, and delete it if consent is not given within a reasonable time.
• Explain what happens next to the child in simple language, without collecting more data while waiting.
• Offer a limited experience before consent that collects no personal information, if the product allows it.
• Record consent properly: method used, time, notice version, and the separate choice about third-party disclosures.
• Configure SDKs by age: pass child-directed flags to ad and analytics tools, or load them only for adults.
• Give parents a dashboard to see data, change choices and delete the account.

Testing these flows end to end, including what each third-party SDK actually sends over the network, is the most reliable way to catch problems before a regulator or a researcher does.

Documentation you will need

• Audience assessment and age screening design.
• Online privacy notice and direct notice templates.
• Records of verifiable parental consent and separate third-party consent.
• Data inventory including all SDKs and third parties.
• Written data retention policy (published).
• Written information security programme, risk assessments and test results.
• Third-party contracts requiring confidentiality and security.
• Records of parental requests and deletions.

Enforcement and safe harbors

The FTC enforces COPPA through investigations, consent orders and civil penalty actions brought with the Department of Justice. Civil penalties are assessed per violation and adjusted annually for inflation. State attorneys general can also enforce COPPA. The FTC approves safe harbor programs run by industry organisations; members that comply with an approved program's guidelines are deemed to comply with the rule, subject to FTC oversight.

Timeline and cost considerations

The amended rule has been fully enforceable since April 2026. Costs depend on audience and data flows: building consent and parental dashboards, replacing ad and analytics SDKs with child-safe configurations, security programme work, legal review and possibly safe harbor membership. The most significant cost is often lost advertising revenue when behavioural ads are disabled for children.

Benefits and consequences of non-compliance

Compliance protects children, builds trust with parents and schools, and is required by app store policies for children's categories. Penalties are severe: in 2019, Google and YouTube agreed to pay 170 million dollars to settle FTC and New York allegations that YouTube collected children's data without parental consent; in 2022, Epic Games agreed to pay 275 million dollars in a COPPA civil penalty, the largest at the time, over its Fortnite game. Smaller developers have also faced penalties and orders requiring data deletion.

Common mistakes and challenges for IT companies

• Claiming to be general audience while using child-oriented content and characters.
• Third-party SDKs collecting persistent identifiers for advertising in child-directed apps.
• Age gates that tell users the right answer or let them retry immediately.
• Collecting more than necessary for features like profiles and chat.
• Keeping children's data indefinitely.
• No process for parents to review or delete data.

Best practices, tools and technologies

• Design child accounts with minimal data, avatars instead of photos, and filtered or pre-set chat.
• Use child-directed flags in ad and analytics SDKs, or remove them.
• Offer a parent dashboard with consent management, data review and deletion.
• Automate retention and deletion.
• Encrypt and restrict access to children's data, with logging.
• Align with stricter state laws and international rules such as the UK Age Appropriate Design Code where relevant.

We build learning platforms and family-friendly apps with parental consent, minimal data collection and deletion tools, drawing on our education sector work.

How COPPA relates to other laws

Law	Relationship
FERPA	Protects student education records; schools may consent on parents' behalf under COPPA for educational purposes in limited cases.
CCPA/CPRA	Requires opt-in for sale or sharing of data of consumers under 16 in California.
US state privacy laws	Many add protections for teenagers and children's data.
GDPR	Sets parental consent ages between 13 and 16 for information society services, by member state.
DPDP Act	India requires verifiable parental consent for all users under 18.

Real-world implementation examples

The FTC's enforcement history includes cases against app developers for collecting persistent identifiers through ad networks, ed-tech providers for retaining data too long, and smart toy makers for weak security. Following the YouTube settlement, YouTube introduced requirements for creators to designate child-directed content and disabled personalised ads and some features on such content.

An illustrative case for an ed-tech app used by primary school pupils at home: the company classifies the app as child-directed, removes a third-party analytics SDK that collected advertising IDs, replaces email sign-up with parent-created accounts verified by a small card transaction, publishes a retention policy deleting inactive accounts after a set period, and writes a security programme with annual risk assessments. Teachers' classroom use is handled under school authorisation for educational purposes only.

Next steps

1. Assess whether your service is child-directed or knowingly collects from children.
2. Audit SDKs and third parties, including what they actually transmit from child users' devices.
3. Implement consent, parental tools and minimised data collection before launching new child features.
4. Publish notices and a retention policy; write a security programme.
5. Consider a safe harbor program and get a legal review of your notices, consent methods and third-party contracts.

Frequently asked questions

Who does COPPA apply to?

Operators of websites and online services directed to children under 13, general audience services with actual knowledge of collecting from children, and third parties that knowingly collect from child-directed services.

Does COPPA apply to companies outside the US?

Yes, when they direct services to children in the United States or knowingly collect personal information from them.

What changed in the COPPA Rule in 2025?

Separate consent for third-party disclosures, written security programmes and retention policies, biometric identifiers as personal information, a mixed audience category, new consent methods and safe harbor transparency.

When did the amended COPPA Rule take effect?

It took effect on 23 June 2025, with compliance required by 22 April 2026 for most provisions.

What is verifiable parental consent?

Consent obtained through a method reasonably calculated to ensure that the person consenting is the child's parent, such as a signed form, a payment transaction or checking a government ID.

Can schools consent instead of parents?

FTC guidance allows schools to consent on behalf of parents in limited cases where data is used solely for the educational purpose and not for commercial purposes.

Are persistent identifiers personal information?

Yes, when they can be used to recognise a user over time and across services, such as cookies and advertising IDs, unless used only for internal operations.

What are COPPA penalties?

Civil penalties per violation, adjusted annually for inflation, plus orders requiring changes and data deletion. Settlements have reached hundreds of millions of dollars.

What is a COPPA safe harbor?

An FTC-approved self-regulatory program; members following its guidelines are treated as complying with the rule, subject to FTC oversight.

Does COPPA cover teenagers?

No. COPPA covers children under 13. Some state laws and proposed federal laws add protections for teenagers.