FTC Issues Long Awaited New COPPA Rules: How They Will Impact Your Business

On January 16, 2025, the Federal Trade Commission finalized changes to the Children's Online Privacy Protection Act (COPPA) Rule. The changes are broad, and, importantly, they require separate direct parental consent for any data sharing or monetization of children's data; prescribe more granular disclosure of how children's data is collected and used, including identifying specific third parties with whom data is shared; and update the Safe Harbor program.

For background, COPPA was initially enacted in 1998 to protect children's privacy on the internet. COPPA applies to "operators" of websites and online services that target children or knowingly collect personal information from children under 13 years old. The law's original regulations (the "COPPA Rule") came into effect in 2000, but, as internet services and theories of harm evolved, the COPPA Rule was amended in 2013. The FTC began reviewing potential updates in 2019 and issued a notice of proposed rulemaking