Written by: Haim Ravia, Dotan Hammer
The Federal Trade Commission (FTC) has published the amended Children’s Online Privacy Protection Rule, aiming to strengthen the protection of children’s personal information and clarify the obligations of online operators under the federal Children’s Online Privacy Protection Act (COPPA).
The updates are based on results from the FTC’s enforcement experience and review of public comments received since the previous rule was finalized in 2013. The amended rule comes into effect on June 23, 2025. However, online operators and other covered entities have until April 22, 2026, to comply with the updated rule.
Significant changes in the updated rule include the introduction and expansion of legal definitions. “Personal information” now includes government-issued identifiers and biometric identifiers that can be used for recognition, such as fingerprints, genetic data, and data derived from voice or facial data. The rule also includes examples of various terms, such as “Website or online service directed to children”, which the FTC will use to interpret the definitions.
New requirements for notifying parents and obtaining consent have been introduced. Online notices to parents must now include the intended use of the data collected and must list the third parties to whom data will be disclosed, identified by either name or category. Entities are required to maintain two written documents: one regarding an organization-specific security program and a written data retention policy. The retention period for personal information may not extend beyond the period reasonably necessary for the original processing purposes, which must be disclosed in the privacy notice.
Additional rules include codification and expansion of methods for acquiring parental consent, such as text messages, along with corresponding practices, such as deleting data required for parental identifiers.
Click here to read the text of the amended COPPA rule.
