United StatesAmended COPPA Rule (2025)
16 C.F.R. Part 312, as amended, 90 Fed. Reg. 16918 ()
In force since .
A social media and minors rule binding private bodies.
- Age threshold
- 13
- Covered services
- Operators covered by the original COPPA Rule.
- Verification methods
- Parental consent
- Audit expectation
- periodic
- Who audits it
- Self
What it requires
- Applies to operators covered by the original COPPA Rule; the deadline for full compliance with the amendments was .
- Obtain separate verifiable parental consent before disclosing a child's personal information to third parties for targeted advertising.NIST Privacy FrameworkCT.PO-P1
- You may obtain verifiable parental consent by the text plus consent method the amended Rule adds.
- Meet the expanded recordkeeping requirements and data retention limits.NIST Privacy FrameworkCT.DM-P5
These lines are LexLint's reading of the law's text. Also read by: Federal Trade Commission (guidance, recorded ).
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Federal Trade Commission
Settledness
- As of
- Guidance link
- https://www.ftc.gov/business-guidance/resources/childrens-online-privacy-protection-rule-six-step-compliance-plan-your-business
- Guidance body
- Federal Trade Commission
- Open questions
- Which disclosures of a child's personal information to a third party are 'integral to the website or online service' under 16 C.F.R. ยง 312.5(a)(2), so that no separate verifiable parental consent is needed, given that the Commission declined to identify any and called the question fact-specific?
What it makes you log
Log retention
Section 312.10 sets no fixed period; the written retention policy must state the operator's own timeframe for deletion.
- As of
- Basis
- Purpose bound
- Prohibits retaining
- Personal information collected online from a child, beyond as long as is reasonably necessary for the specific purpose it was collected, and never indefinitely; a parent's identification and images used to verify parental consent must be deleted promptly after the verification
Logging duty
The Rule orders no log of consent or of an age check. It makes an operator establish, implement and maintain a written data retention policy and a written information security program with annual risk assessments, which cannot be shown without a record. The expanded recordkeeping duties of 312.11(d) bind safe harbor programs, not operators.
- Kind
- Implicit
- As of
- Provision
- 16 C.F.R. 312.10 and 312.8(b), as amended by 90 Fed. Reg. 16918
- Trigger
- personal_data_processing
What this law does
Requires separate verifiable parental consent for disclosing a child's personal information to third parties for targeted advertising, adds a text plus consent method, and expands recordkeeping and data retention limits. Operators had until to come into full compliance.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .