The Federal Trade Commission's first
update in over a decade to its rules under the Children’s Online Privacy Protection Act (“COPPA”) did not bring the dramatic updates that some privacy advocates had requested. Instead, the FTC will continue to enforce the COPPA under existing
2022 guidance.
- Requiring opt-in consent for targeted advertising and other disclosures to third parties: Website and online service operators covered by COPPA will be required to obtain separate verifiable parental consent to disclose children’s personal information to third-party companies related to targeted advertising or other purposes.
- Limits on data retention: The rule requires covered operators to only retain personal information for as long as reasonably necessary to fulfill a specific purpose for which it was collected. This provision explicitly states that operators cannot retain the information indefinitely.
- Increasing Safe Harbor programs’ transparency: The FTC-approved COPPA Safe Harbor programs, which are self-regulatory programs that implement the protections of the COPPA Rule, will be required to publicly disclose their membership lists and report additional information to the FTC as part of efforts to increase accountability and transparency in the programs.
The final rule includes several amended definitions, including expanding the definition of personal information to include biometric identifiers and government-issued identifiers.
After reviewing the nearly 300 comments the agency received on the proposed changes to the COPPA Rule, the FTC decided against adopting some proposed changes, including requirements intended to limit the use of push notifications directed to children without parental consent and changes relating to the requirements applicable to educational technology companies operating in a school environment.
With the change in administrations, the Department of Education is unlikely to release any FERPA updates soon, so these COPPA regulations are likely the last changes to children’s privacy at the federal level for some time.
The FTC voted 5-0 to approve the publication of the final rule, which will go into effect 60 days after its publication in the Federal Register. The publication date for the rule is January 11, 2025, so the effective date will be March 11, 2025.
