A child’s privacy should not depend on whether a product team remembered to revisit an old consent screen. Yet that is a practical risk when federal requirements change and a product keeps operating on assumptions built into earlier versions. For developers, the question is whether today’s data flows match today’s obligations.
The Federal Trade Commission published its final amendments to the Children’s Online Privacy Protection Rule on April 22, 2025. They became effective June 23, 2025, with a general compliance deadline of April 22, 2026; certain safe-harbor provisions had different timing. As of September 20, 2026, that general deadline has passed. These are agency rule amendments under an existing federal statute, rather than a bill awaiting a congressional vote. The distinction matters because planning for a possible proposal is different from evaluating current operations against a final rule. Federal Register final rule
COPPA primarily concerns children under 13. It covers operators of commercial websites and online services directed to that age group, along with certain other operators that have actual knowledge they are collecting children’s personal information. A service does not escape that analysis simply by placing an age restriction in its terms. Whether a product is directed to children depends on the relevant facts. Parents also have rights concerning information collected from their children, including review and deletion. FTC COPPA guidance
That scope calls for an honest product assessment. Teams should examine the audience their design attracts, the information their service receives, and the circumstances in which they learn a user’s age. A privacy policy cannot answer those questions by itself. Designers, engineers, support staff, and business decision-makers may each see a different piece of the same system. Bringing those pieces together is a practical way to identify questions that need qualified legal review.
One significant change concerns disclosure to third parties. The amended rule generally requires separate verifiable parental consent for those disclosures unless they are integral to the service. A parent must be able to consent to collection and use without automatically agreeing to a separate disclosure that does not meet that exception. The FTC’s final rule explains the strengthened consent framework, including its relevance to targeted advertising. Final rule and explanation
For developers, I would start by tracing what happens before and after a parent makes each choice. Does an advertising SDK initialize immediately? Does a rejected permission prevent the relevant network request, or only change a label in the interface? Does the backend preserve the distinction between different permissions? These are engineering questions with consequences for whether a family’s choice has practical meaning. A consent record is useful only when the rest of the product respects it.
The current rule also requires a written information-security program appropriate to the circumstances, including designated responsibility, annual risk assessments, safeguards, and testing. It requires reasonable checks on recipients’ ability to protect information and written security assurances. Retention must serve a specific purpose and last only as long as reasonably necessary; indefinite retention is prohibited. Operators must maintain a written retention policy addressing purposes, business need, and deletion timing, and include it in their online notice. Current rule, sections 312.8 and 312.10
A useful engineering exercise is to follow one fictional child’s record through the entire product. Start with account creation, then examine event logs, support tickets, analytics exports, backups, and vendor systems. Identify an owner for each copy and document how deletion reaches it. If a team cannot explain why a field remains, that uncertainty deserves attention. Storage being inexpensive is not a convincing privacy reason to preserve a child’s information indefinitely.
Age verification introduces another issue. On February 25, 2026, the FTC announced a conditional enforcement policy for certain general-audience and mixed-audience services collecting information solely to determine age without first obtaining parental consent. The stated conditions include purpose limits, prompt deletion, reasonable security and accuracy measures, clear notice, and limits on sharing. This is a specific enforcement policy, not a blanket removal of COPPA obligations or permission to reuse verification data for advertising. FTC age-verification policy announcement
The practical lesson is to treat age determination and permission for other processing as separate design questions. A team considering a verification vendor should ask what evidence is collected, what result the product actually needs, and whether the underlying evidence can be discarded. A privacy safeguard should have a defined boundary. Collecting additional sensitive information without a clear deletion path can create another problem for families.
For parents, useful questions are concrete: What does this service collect about my child? Which information goes elsewhere? Can I refuse that sharing while allowing the core activity? How do I request review or deletion? For developers, those same questions can guide an audit of the actual experience. Clear explanations, working controls, and accountable data handling make privacy rights easier to exercise. The deadline has passed; the continuing work is making those protections function in everyday use.
About Joseph Sides
Joseph Sides is a South Florida-based data privacy advocate, consultant, and entrepreneur whose work focuses on consumer rights, digital transparency, website tracking, meaningful privacy choices, and responsible technology. His public DEV introduction describes a bachelor’s degree in criminology, a minor in business, and training in data analytics. These interests connect questions about how technology operates with questions about what people understand and how organizations remain accountable for their decisions.
The educational purpose of these articles is to make privacy developments easier to follow and their practical implications easier to examine. That means connecting the language of laws and regulatory actions with familiar experiences: visiting a website, choosing an app, responding to a consent request, or trying to delete information. For developers, the discussion also considers how interface choices and data practices shape the choices available to consumers. The aim is informed understanding and thoughtful questions, with attention to both individual rights and responsible product decisions.
Educational Information — Not Legal Advice
This article provides general education and commentary, not legal advice. Joseph writes as a privacy advocate and consultant, not as an attorney. Reading this article does not create an attorney-client relationship, and the discussion is not a substitute for advice from a qualified attorney about your particular circumstances.
Laws, interpretations, applicability, exemptions, and deadlines vary by jurisdiction and can change. A requirement that applies to one organization or activity may apply differently to another. Readers should consult current primary sources and a qualified attorney when evaluating obligations, available rights, or a specific course of action. This article does not promise complete coverage, guaranteed outcomes, or personal legal guidance.
AI Disclosure
Prepared with AI assistance.
Top comments (0)