On April 22, 2025, the Federal Trade Commission (FTC) published the finalized amendments (Amendments) to the Children’s Online Privacy Protection Rule (COPPA Rule) that would impose additional restrictions on website and online service operators that collect personal information from children under the age of thirteen. The Amendments will become effective on June 23, 2025. Operators subject to the COPPA Rule will have until April 22, 2026 to comply with additional requirements. The new requirements for organizations offering safe harbor programs will have earlier compliance deadlines ranging from ninety days to six months from the Amendments’ publication.
The Amendments mark the conclusion of the FTC’s latest review of the COPPA Rule that began in 2019. The FTC approved the Amendments on January 16, 2025, but their publication had been delayed by the Trump administration’s regulatory freeze announced on January 20, 2025. The regulatory freeze halted all agency rulemaking activities pending the respective agency head’s review and approval. The FTC Chair Andrew Ferguson, who voted in favor of the Amendments as an FTC commissioner before the Trump administration took office, had voiced concerns on the Amendments’ lack of clarity and risk of inadvertent hostile outcomes. Despite these concerns, Ferguson opted to approve the Amendments’ publication in the Federal Register.
The Amendments, as published in the Federal Register, are substantively identical to the draft version the FTC announced on January 16, 2025. Among other things, the Amendments will (1) expand the scope of personal information protected under the COPPA Rule to include biometric identifiers; (2) require operators to obtain separate verifiable parental consent before disclosing personal information collected from children for purposes that are not “integral” to operators’ websites or online services; and (3) mandate operators to establish, implement, and maintain a written information security program and written data retention policy. Our previous advisory discusses the Amendments’ notable changes to the COPPA Rule in further detail.
The FTC’s publication of the Amendments underscores the bipartisan focus on children’s privacy. Operators should note that protecting children’s privacy and online safety remains a high priority for regulators at both federal and state levels, resulting in enforcement actions under the Children’s Online Privacy Protection Act and the FTC Act as well as state regulations. See our blog entries on actions against a social media company and a mobile game developer, for example.
Alston & Bird’s Privacy, Cyber & Data Strategy Team will continue to monitor developments surrounding the COPPA Rule and other laws and regulations addressing children’s privacy and online safety. Please contact us if you have any questions.
