What you need to know
The FTC’s amended COPPA Rule requires separate verifiable parental consent before disclosing children’s data to third parties for targeted advertising, limits retention to what a specific purpose requires, adds biometric and government identifiers to personal information, and makes Safe Harbor programs publish members.
Potentially affected
Operators of websites, apps and online services directed to children under 13 or with actual knowledge of collecting their data, and the vendors, schools and integrators that build or host such services.
DSE recommendation
DSE recommends that operators of child-directed services map every third-party disclosure and data retention period against the amended COPPA Rule.
The FTC’s amended COPPA Rule requires separate verifiable parental consent before disclosing children’s data to third parties for targeted advertising, limits retention to what a specific purpose requires, adds biometric and government identifiers to personal information, and makes Safe Harbor programs publish members.
Source facts
The FTC’s announcement of the final COPPA amendments says covered operators must obtain separate verifiable parental consent to disclose children’s personal information to third-party companies for targeted advertising or other purposes. The Rule requires verifiable parental consent before collecting, using or disclosing personal information from children under 13.
Operators may retain personal information only as long as reasonably necessary to fulfill a specific purpose for which it was collected and cannot retain it indefinitely. The definition of personal information now includes biometric identifiers and government-issued identifiers, and FTC-approved Safe Harbor programs must publicly disclose their membership lists.
The FTC said the rule takes effect 60 days after Federal Register publication, with one year from publication to fully comply with amendments that do not specify earlier dates, and its COPPA FAQ notes the Rule was amended on April 22, 2025. The Commission declined to finalize proposed limits on push notifications and changes for educational technology companies operating in schools.
Applicability
Use this for services directed to children or that knowingly collect children’s data. If the amendment was published on April 22, 2025, as the FAQ indicates, the general one-year compliance window has closed; confirm specific dates and obligations in the amended Rule with counsel.
DSE recommendation
DSE recommends that operators of child-directed services map every third-party disclosure and data retention period against the amended COPPA Rule. Separate the consent for advertising-related sharing from the core service consent, set written retention periods with automatic deletion, and treat face, voice and fingerprint data as COPPA personal information in product design and vendor contracts.
Verification
Review the data map and consent flow annually and whenever a third-party SDK or analytics tool is added, test that deletion jobs actually remove expired records, and keep records of parental consents for each disclosure purpose.
Official references
Federal Trade Commission — FTC Finalizes Changes to Children’s Privacy Rule Limiting Companies’ Ability to Monetize Kids’ Data. FTC — Complying with COPPA: Frequently Asked Questions. Reviewed October 18, 2026.
Review the official source
Federal Trade Commission — FTC Finalizes Changes to Children’s Privacy Rule Limiting Companies’ Ability to Monetize Kids’ Data · Verified October 18, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE