The FTC’s amended COPPA Rule requires separate verifiable parental consent before disclosing children’s data to third parties for targeted advertising, limits retention to what a specific purpose requires, adds biometric and government identifiers to personal information, and makes Safe Harbor programs publish members.
\nThe FTC’s announcement of the final COPPA amendments says covered operators must obtain separate verifiable parental consent to disclose children’s personal information to third-party companies for targeted advertising or other purposes. The Rule requires verifiable parental consent before collecting, using or disclosing personal information from children under 13.
\nOperators may retain personal information only as long as reasonably necessary to fulfill a specific purpose for which it was collected and cannot retain it indefinitely. The definition of personal information now includes biometric identifiers and government-issued identifiers, and FTC-approved Safe Harbor programs must publicly disclose their membership lists.
\nThe FTC said the rule takes effect 60 days after Federal Register publication, with one year from publication to fully comply with amendments that do not specify earlier dates, and its COPPA FAQ notes the Rule was amended on April 22, 2025. The Commission declined to finalize proposed limits on push notifications and changes for educational technology companies operating in schools.
\nUse this for services directed to children or that knowingly collect children’s data. If the amendment was published on April 22, 2025, as the FAQ indicates, the general one-year compliance window has closed; confirm specific dates and obligations in the amended Rule with counsel.
\nDSE recommends that operators of child-directed services map every third-party disclosure and data retention period against the amended COPPA Rule. Separate the consent for advertising-related sharing from the core service consent, set written retention periods with automatic deletion, and treat face, voice and fingerprint data as COPPA personal information in product design and vendor contracts.
\nReview the data map and consent flow annually and whenever a third-party SDK or analytics tool is added, test that deletion jobs actually remove expired records, and keep records of parental consents for each disclosure purpose.
\nFederal Trade Commission — FTC Finalizes Changes to Children’s Privacy Rule Limiting Companies’ Ability to Monetize Kids’ Data. FTC — Complying with COPPA: Frequently Asked Questions. Reviewed October 18, 2026.
", "content_text": "The FTC’s amended COPPA Rule requires separate verifiable parental consent before disclosing children’s data to third parties for targeted advertising, limits retention to what a specific purpose requires, adds biometric and government identifiers to personal information, and makes Safe Harbor programs publish members.\nSource facts\nThe FTC’s announcement of the final COPPA amendments says covered operators must obtain separate verifiable parental consent to disclose children’s personal information to third-party companies for targeted advertising or other purposes. The Rule requires verifiable parental consent before collecting, using or disclosing personal information from children under 13.\nOperators may retain personal information only as long as reasonably necessary to fulfill a specific purpose for which it was collected and cannot retain it indefinitely. The definition of personal information now includes biometric identifiers and government-issued identifiers, and FTC-approved Safe Harbor programs must publicly disclose their membership lists.\nThe FTC said the rule takes effect 60 days after Federal Register publication, with one year from publication to fully comply with amendments that do not specify earlier dates, and its COPPA FAQ notes the Rule was amended on April 22, 2025. The Commission declined to finalize proposed limits on push notifications and changes for educational technology companies operating in schools.\nApplicability\nUse this for services directed to children or that knowingly collect children’s data. If the amendment was published on April 22, 2025, as the FAQ indicates, the general one-year compliance window has closed; confirm specific dates and obligations in the amended Rule with counsel.\nDSE recommendation\nDSE recommends that operators of child-directed services map every third-party disclosure and data retention period against the amended COPPA Rule. Separate the consent for advertising-related sharing from the core service consent, set written retention periods with automatic deletion, and treat face, voice and fingerprint data as COPPA personal information in product design and vendor contracts.\nVerification\nReview the data map and consent flow annually and whenever a third-party SDK or analytics tool is added, test that deletion jobs actually remove expired records, and keep records of parental consents for each disclosure purpose.\nOfficial references\nFederal Trade Commission — FTC Finalizes Changes to Children’s Privacy Rule Limiting Companies’ Ability to Monetize Kids’ Data. FTC — Complying with COPPA: Frequently Asked Questions. Reviewed October 18, 2026.", "content_markdown": "The FTC’s amended COPPA Rule requires separate verifiable parental consent before disclosing children’s data to third parties for targeted advertising, limits retention to what a specific purpose requires, adds biometric and government identifiers to personal information, and makes Safe Harbor programs publish members.\n\n## Source facts\n\nThe FTC’s [announcement of the final COPPA amendments](https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data) says covered operators must obtain separate verifiable parental consent to disclose children’s personal information to third-party companies for targeted advertising or other purposes. The Rule requires verifiable parental consent before collecting, using or disclosing personal information from children under 13.\n\nOperators may retain personal information only as long as reasonably necessary to fulfill a specific purpose for which it was collected and cannot retain it indefinitely. The definition of personal information now includes biometric identifiers and government-issued identifiers, and FTC-approved Safe Harbor programs must publicly disclose their membership lists.\n\nThe FTC said the rule takes effect 60 days after Federal Register publication, with one year from publication to fully comply with amendments that do not specify earlier dates, and its [COPPA FAQ](https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions) notes the Rule was amended on April 22, 2025. The Commission declined to finalize proposed limits on push notifications and changes for educational technology companies operating in schools.\n\n## Applicability\n\nUse this for services directed to children or that knowingly collect children’s data. If the amendment was published on April 22, 2025, as the FAQ indicates, the general one-year compliance window has closed; confirm specific dates and obligations in the amended Rule with counsel.\n\n## DSE recommendation\n\nDSE recommends that operators of child-directed services map every third-party disclosure and data retention period against the amended COPPA Rule. Separate the consent for advertising-related sharing from the core service consent, set written retention periods with automatic deletion, and treat face, voice and fingerprint data as COPPA personal information in product design and vendor contracts.\n\n## Verification\n\nReview the data map and consent flow annually and whenever a third-party SDK or analytics tool is added, test that deletion jobs actually remove expired records, and keep records of parental consents for each disclosure purpose.\n\n## Official references\n\n[Federal Trade Commission — FTC Finalizes Changes to Children’s Privacy Rule Limiting Companies’ Ability to Monetize Kids’ Data](https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data). [FTC — Complying with COPPA: Frequently Asked Questions](https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/coppa-rule-2025-amendments-third-party-consent-retention-biometrics/", "url": "https://update.dsesecurity.com/updates/coppa-rule-2025-amendments-third-party-consent-retention-biometrics/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/coppa-rule-2025-amendments-third-party-consent-retention-biometrics/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "COPPA’s 2025 amendments: separate parental consent for third-party ad sharing and no indefinite retention of kids’ data", "item": "https://update.dsesecurity.com/updates/coppa-rule-2025-amendments-third-party-consent-retention-biometrics/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/coppa-rule-2025-amendments-third-party-consent-retention-biometrics/#article", "identifier": "https://update.dsesecurity.com/updates/coppa-rule-2025-amendments-third-party-consent-retention-biometrics/", "url": "https://update.dsesecurity.com/updates/coppa-rule-2025-amendments-third-party-consent-retention-biometrics/", "headline": "COPPA’s 2025 amendments: separate parental consent for third-party ad sharing and no indefinite retention of kids’ data", "description": "The FTC’s amended COPPA Rule requires separate verifiable parental consent before disclosing children’s data to third parties for targeted advertising…", "abstract": "The FTC’s amended COPPA Rule requires separate verifiable parental consent before disclosing children’s data to third parties for targeted advertising, limits retention to what a specific purpose requires, adds biometric and government identifiers to personal information, and makes Safe Harbor programs publish members.", "articleBody": "The FTC’s amended COPPA Rule requires separate verifiable parental consent before disclosing children’s data to third parties for targeted advertising, limits retention to what a specific purpose requires, adds biometric and government identifiers to personal information, and makes Safe Harbor programs publish members.\nSource facts\nThe FTC’s announcement of the final COPPA amendments says covered operators must obtain separate verifiable parental consent to disclose children’s personal information to third-party companies for targeted advertising or other purposes. The Rule requires verifiable parental consent before collecting, using or disclosing personal information from children under 13.\nOperators may retain personal information only as long as reasonably necessary to fulfill a specific purpose for which it was collected and cannot retain it indefinitely. The definition of personal information now includes biometric identifiers and government-issued identifiers, and FTC-approved Safe Harbor programs must publicly disclose their membership lists.\nThe FTC said the rule takes effect 60 days after Federal Register publication, with one year from publication to fully comply with amendments that do not specify earlier dates, and its COPPA FAQ notes the Rule was amended on April 22, 2025. The Commission declined to finalize proposed limits on push notifications and changes for educational technology companies operating in schools.\nApplicability\nUse this for services directed to children or that knowingly collect children’s data. If the amendment was published on April 22, 2025, as the FAQ indicates, the general one-year compliance window has closed; confirm specific dates and obligations in the amended Rule with counsel.\nDSE recommendation\nDSE recommends that operators of child-directed services map every third-party disclosure and data retention period against the amended COPPA Rule. Separate the consent for advertising-related sharing from the core service consent, set written retention periods with automatic deletion, and treat face, voice and fingerprint data as COPPA personal information in product design and vendor contracts.\nVerification\nReview the data map and consent flow annually and whenever a third-party SDK or analytics tool is added, test that deletion jobs actually remove expired records, and keep records of parental consents for each disclosure purpose.\nOfficial references\nFederal Trade Commission — FTC Finalizes Changes to Children’s Privacy Rule Limiting Companies’ Ability to Monetize Kids’ Data. FTC — Complying with COPPA: Frequently Asked Questions. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:01:00+00:00", "dateModified": "2026-10-18T22:22:08+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/coppa-rule-2025-amendments-third-party-consent-retention-biometrics/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/coppa-rule-2025-amendments-third-party-consent-retention-biometrics/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "COPPA’s 2025 amendments: separate parental consent for third-party ad sharing and no indefinite retention of kids’ data" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Briefing", "Advisory priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 370, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Federal Trade Commission — FTC Finalizes Changes to Children’s Privacy Rule Limiting Companies’ Ability to Monetize Kids’ Data", "url": "https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data" } } ] } }