United StatesChildren's Online Privacy Protection Rule (COPPA), including 2025 biometric identifier amendments
16 CFR Part 312, as amended effective June 23, 2025
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 21 April 2000.
A data subject rights rule binding private bodies.
As of 23 August 2026.
What it requires
- Obtain verifiable parental consent before collecting, using, or disclosing a child's personal information, including biometric identifiers such as voiceprints or facial templates.
- Give parents a way to review and delete a child's collected personal information.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
16 CFR 312.9 deems a violation of a regulation issued under COPPA Section 6502(a) to be a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the FTC Act (15 U.S.C. 57a(a)(1)(B)), which draws the same civil penalty as any other FTC trade-regulation rule violation under 15 U.S.C. 45(m)(1)(A): a nominal $10,000 per violation, adjusted for inflation to $53,088 per violation (2025 figure) by 16 CFR 1.98. A State attorney general may also sue as parens patriae under 15 U.S.C. 6504, but that is not a right of action for an individual private plaintiff.
- Rule
- Per violation only
- As of
- 2 September 2026
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 53,088
Who enforces it
Enforcement body
Federal Trade Commission; a State attorney general may also bring a parens patriae civil action under 15 U.S.C. 6504
Enforcement record
Counts the case entries on the FTC's own Cases and Proceedings listing filtered to the COPPA consumer-protection topic and sorted by date, using the page's own Last Updated field: Iconic Hearts Holdings (September 29, 2025), Apitor (October 1, 2025), Disney (December 31, 2025), NGL (January 6, 2026), and Illuminate Education (June 5, 2026), five matters over the latest twelve months the filtered listing covers as of the read date. The next-older entries, Epic Games, Inc., U.S. v. and Epic Games, In the Matter of, are both Last Updated June 25, 2025, outside this window. NGL's Last Updated date reflects the page's own listing of a January 2026 claims-process announcement in an action the Commission first brought in July 2024.
- As of
- 17 September 2026
- Source link
- https://www.ftc.gov/legal-library/browse/cases-proceedings?field_consumer_protection_topics=1421&field_mission%5B29%5D=29&sort_by=field_date
- Actions per year
- 5
What it reaches
Excludes recording-derived identifiersNo
Obligation class
Consent, Age verification, Disclosure, Retention
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Requires operators of websites and online services directed to children under 13, or that have actual knowledge they are collecting personal information from such children, to give notice and obtain verifiable parental consent before collecting, using, or disclosing a child's personal information, and to give parents a means to review and delete it.
The FTC's 2025 amendments, effective June 23, 2025, add biometric identifiers, including voiceprints and facial templates, to the covered definition of personal information.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachprocesses_voiceprocesses_biometrics
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.