Key points

• The FTC's amended Children's Online Privacy Protection Rule took effect in June 2025, with most compliance obligations applying from April 2026. Retailers are now operating under it.
• Operators must obtain separate verifiable parental consent before disclosing children's personal information to third parties, including for targeted advertising.
• The amended rule requires a written information security program, a written data retention policy and a ban on keeping children's data longer than reasonably necessary.
• The definition of personal information now expressly covers biometric identifiers, and the commentary addresses mixed audience services and the use of persistent identifiers.
• Retail apps that attract children, such as toy, apparel, gaming and entertainment retail, should assess whether they are directed to children even if that is not the target market.
• State laws on minors, age assurance and design add obligations that sit alongside COPPA.

Who is covered

COPPA applies to operators of websites and online services directed to children under 13, and to operators of general audience services that have actual knowledge they are collecting personal information from a child. A service is directed to children based on a set of factors that include subject matter, visual content, the use of animated characters, music, the age of models, advertising directed to children and evidence about audience composition. Retailers sometimes assume that because they sell to parents they are outside the rule. That assumption fails when an app includes games, character content, child-friendly rewards or features aimed at children.

Mixed audience services, which are directed to children but do not target them as the primary audience, may age screen users and apply COPPA obligations only to those who identify as under 13, provided the screen is neutral. The amended rule and the FTC's commentary reinforce the need for a neutral age gate that does not encourage users to misstate their age.

What changed in the amended rule

Separate consent for third-party disclosure. Operators must obtain verifiable parental consent for disclosing children's information to third parties unless the disclosure is integral to the service, and the consent for third-party disclosure has to be separate from the consent for collection. This directly affects advertising technology, analytics and social sharing features.

Data retention and security. Operators must maintain a written data retention policy that states the purposes for collection and a time frame for deletion, and they cannot retain children's information indefinitely. They must also maintain a written information security program with a designated employee, annual risk assessment and safeguards tested at appropriate intervals. Operators that share data must obtain assurances that third parties will keep it secure.

Definitions. The definition of personal information now includes biometric identifiers that can be used to identify a person, such as fingerprints, voiceprints, retina patterns and facial templates, and government-issued identifiers. The rule retained the treatment of persistent identifiers, and the support for internal operations exception is narrower in practice because the operator must disclose and justify the purposes.

Safe harbor and notice. The amended rule increases transparency obligations on approved safe harbor programs and expands the content of the direct notice to parents, including identifying the third parties receiving data and the purposes.

Issues we see in retail apps

Software development kits embedded in retail apps often collect persistent identifiers and device information for analytics or advertising. If the app is directed to children, those transmissions can amount to collection and disclosure that require consent. Teams should inventory the tags and kits in each build and compare their behavior with the privacy notice.

Loyalty and rewards programs that enroll children, birthday clubs and online games or contests with sign-up forms are common sources of unplanned collection. Customer service channels, such as chat, also collect information from users who may be children.

Parental consent mechanisms must be reasonably calculated to ensure the person giving consent is the parent. Methods that work for transactions, such as a payment card used with a monetary transaction, may not suit a free loyalty program. The FTC has approved additional methods in recent years and the available choices should be reviewed against the user experience.

State laws and the wider picture

COPPA does not preempt state laws that are consistent with it, and many states now address minors more broadly. Some have enacted age-appropriate design codes, restrictions on targeted advertising to minors up to age 17, or limits on collecting the data of teenagers without consent. Some of these laws have been challenged on First Amendment grounds, and the position varies by state and court. Retailers should expect to apply a higher standard to features used by teens than to features used by adults, even where the law does not strictly require it.

Enforcement has been active. The FTC and state attorneys general have brought actions against operators of games and apps, with remedies that included deletion of data and deletion of the models or algorithms built from it, along with civil penalties.

Steps to take now

Decide whether each online service is directed to children, mixed audience or general audience, and document the reasoning. Map the data collected from children, where it goes and which vendors receive it. Update the notice to parents and the consent flow, and separate third-party disclosure consent where needed. Adopt the written retention policy and the security program, and assign owners. Review vendor contracts for the assurances the amended rule requires, and test deletion processes so that a parent's request is honored in practice.

Corvane Ryle's Privacy & Cyber team advises retailers, app developers and brands on children's privacy, including biometric technologies that now fall within the amended definition.