Children's Online Privacy Protection Rule
FTC amends COPPA Rule, expanding definitions of 'personal information' and 'operator,' requiring additional parental consent for targeted advertising, and mandating data retention limits and stronger security.
Aforeworn detected this change in the US State Data-Privacy Laws space on July 30, 2026 and published this briefing so affected operators are forewarned rather than caught off guard. It is rated High urgency. Operators of websites, online services, and apps directed to children under 13, or that knowingly collect personal information from children, including adtech, SaaS platforms, and data brokers. should confirm how it applies to their specific situation before acting. There is a time constraint attached: Effective 60 days after publication in the Federal Register (publication date April 22, 2025).. Acting after that point can mean penalties, a lapsed licence, or lost eligibility — exactly the kind of surprise Aforeworn exists to prevent. Aforeworn monitors US State Data-Privacy Laws continuously and turns every detected change into a plain-English briefing like this one, so you always know first. Forewarned is forearmed.
What changed
Expanded definition of 'personal information' to include biometric identifiers, persistent identifiers used for cross-site tracking, and data inferred from children. Expanded 'operator' definition to include third parties that collect data on child-directed services. New requirements: separate parental consent for targeted advertising; data retention limits; enhanced data security; and annual compliance audits for certain operators.
Who it affects
Operators of websites, online services, and apps directed to children under 13, or that knowingly collect personal information from children, including adtech, SaaS platforms, and data brokers.
What you must do
Review and update privacy policies, consent mechanisms, data collection practices, and data retention schedules to comply with the amended Rule. Implement separate parental consent for targeted advertising. Conduct a data inventory and risk assessment.
Deadline
Effective 60 days after publication in the Federal Register (publication date April 22, 2025).
Never miss a change like this again
Aforeworn watches US State Data-Privacy Laws around the clock and alerts you the moment a rule moves — with a plain-English brief on what to do.
Start your free trialRelated changes in US State Data-Privacy Laws
- General Motors and OnStar, LLC; Analysis of Proposed Consent Order To Aid Public Comment
- Illusory Systems, Inc.; Analysis of Proposed Consent Order To Aid Public Comment
- New Jersey Legislature Passes Grocery Surveillance Pricing Ban - EPIC – Electronic Privacy Information Center
- New York puts accuracy minimums for age assurance into effect with SAFE for Kids Act - Biometric Update
- CalPrivacy’s New Audits Division Launches Its First Sectoral Audit, With More to Come - jdsupra.com