The Amended COPPA Rules, 2025: How Children’s Online Privacy Is Changing in the Age of Targeted Advertising

Major changes introduced under the amended COPPA rules

1. Separate Parental Consent for Targeted Advertising

Under the new rules, companies are required to obtain a separate verifiable parental consent before disclosing a child’s personal information to third parties for purposes such as targeted advertising. This consent cannot be bundled with other permissions that are needed to provide essential services. The idea is to allow parents to consent to the child’s usage of website without consenting to the disclosure of child’s activity to an advertising network.

2. ‘Personal Information’ scope extended

The amended rules modernise and extend the scope of what is considered as protected personal information these now include social security, state identification card, birth-certificate, passport numbers and biometric identifiers. These are mentioned in 16 C.F.R. § 312.2, definition of “Personal information,” paragraphs (6) and (10). The newer scope is essential as many children’s products use voice recognition, face filters, identity checks, motion analysis, and camera-based features. So, companies cannot assume biometrics are not relevant for COPPA compliance because it is not name, email address or cookie. If the information can be used for automated or semi-automated recognition of an individual, the rule treats it as personal information.

3. New Rules formally recognizes “Mixed audience” Services

A new category has been defined by the amended rules, these websites, apps or games that appeal to children but do not treat them as the primary audience these are called ‘Mixed-Audience” defined under 16 C.F.R. § 312.2. These services are allowed to keep a neutral age screening, but they should not encourage a user to lie about their age or default to a particular age. If the service provider finds that the individual is under the age 13, then COPPA’s notice, consent, security, parental-access, and deletion requirements apply.

4. Stronger Data-Retention and Deletion Requirements

The amended COPPA rules will prohibit business from storing children’s personal information indefinitely. As per 16 C.F.R. § 312.10, the rules mandate that covered operators must establish a written data-retention policy explaining why the information was collected, what are the reasons for retaining it, how long it will be stored in the company’s systems and what are the circumstances or deadlines that will trigger its deletion.

5. A written information-security program is mandatory

As per 16 C.F.R. § 312.8(b) a covered operator must create and implement an information security program. This program should be designed as per the sensitivity of the children’s information being collected by the organisation and must be tailored to match the operator’s size, complexity, and activities. Rule 16 C.F.R. § 312.8(b)(1) -(5) states that at the minimum the covered operator must:

• Designate one or more responsible employees;
• Assess internal and external risks at least annually;
• Design and implement safeguards addressing identified risks;
• Regularly test and monitor those safeguards; and
• Evaluate and modify the program at least annually.

6. Greater Responsibility for Third-Party Vendors

Various children’s digital services are built with a lot of technology which are supplied by third party vendors. A single service may rely on different vendors for advertising, analytics, authentication, cloud hosting, content delivery, payments, customer support, and fraud prevention. Rule 16 C.F.R. § 312.8(c) states that an operator must take reasonable steps to determine whether service providers and third parties can protect children’s personal information. All the companies that are involved in providing the services must confirm that their child-directed settings are activated and they are effective through out their chain of analytics and advertising providers.

7. Additional parental-consent methods are codified

Amended rules also have introduced additional methods to obtain verifiable parental consent. These include:

• Payment-card verification, 16 C.F.R. § 312.5(b)(2)(ii), a parent can use a credit/ debit card or any other qualifying online payment that notifies the account holder. It is to be solely used for verification purposes i.e. there is no requirement, that an actual monetary charge should be made.
• Knowledge-based authentication, 16 C.F.R. § 312.5(b)(2)(vi) authentication can be completed by using a sufficiently difficult & dynamic questionnaire with adequately large set of possible answers. The idea here is to design Questions to which the answers cannot be reasonably ascertained by a 12 year old.
• Verification of the government-issued photographic ID of the parent: The official ID of the parent can be used to compare against a live image of a parent’s face rule 16 C.F.R. § 312.5(b)(2)(vii). However, companies are required to immediately delete the ID and images once the verification is completed.

8. Greater Transparency for COPPA Safe Harbor Programs

COPPA Safe harbour is a Federal Trade Commission (FTC) approved privacy oversight program operated by a private organisation, such as an industry association or certification body. Companies participating in an approved program may follow its guidelines if those guidelines provide protections that are consistent with COPPA.

The introduction of amended rules, reporting and transparency requirements for these programs have been made stronger.

• 16 C.F.R. § 312.11(d) made sure that that safe-harbour programs must submit annual reports identifying member, operators and certified services.
• 16 C.F.R. § 312.11(d)(4) Safe harbours association/ certification body must publicly post lists of their current members and the websites or online services certified for each member. Those lists must be updated every six months.