Children's Online Privacy Protection Rule

<RULE> FEDERAL TRADE COMMISSION <CFR>16 CFR Part 312</CFR> <RIN>RIN 3084-AB20</RIN> <SUBJECT>Children's Online Privacy Protection Rule</SUBJECT> <HD SOURCE="HED">AGENCY:</HD> Federal Trade Commission. <HD SOURCE="HED">ACTION:</HD> Final rule amendments. <SUM> <HD SOURCE="HED">SUMMARY:</HD> The Federal Trade Commission amends the Children's Online Privacy Protection Rule (the “Rule”), consistent with the requirements of the Children's Online Privacy Protection Act. The amendments to the Rule, which are based on the FTC's review of public comments and its enforcement experience, include one new definition and modifications to several others, as well as updates to key provisions to respond to changes in technology and online practices. The amendments are intended to strengthen protection of personal information collected from children, and, where appropriate, to clarify and streamline the Rule since it was last amended in January 2013. </SUM> <EFFDATE> <HD SOURCE="HED">DATES:</HD> <E T="03">Effective date:</E> The amended Rule is effective June 23, 2025. <E T="03">Compliance date:</E> Except with respect to § 312.11(d)(1), (d)(4), and (g), regulated entities have until April 22, 2026 to comply. </EFFDATE> <HD SOURCE="HED">ADDRESSES:</HD> The complete public record of this proceeding will be available at <E T="03">www.ftc.gov</E> . <FURINF> <HD SOURCE="HED">FOR FURTHER INFORMATION CONTACT:</HD> James Trilling, Attorney, (202) 326-3497; Manmeet Dhindsa, Attorney, (202) 326-2877; Elizabeth Averill, Attorney, (202) 326-2993; Andy Hasty, Attorney, (202) 326-2861; or Genevieve Bonan, Attorney, (202) 326-3139, Division of Privacy and Identity Protection, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. <HD SOURCE="HD1">Statement of Basis and Purpose</HD> <HD SOURCE="HD1">I. Overview and Background</HD> <HD SOURCE="HD2">A. Overview</HD> This document states the basis and purpose for the Federal Trade Commission's (“Commission” or “FTC”) decision to adopt certain amendments to the Children's Online Privacy Protection Rule that were proposed and published for public comment on January 11, 2024, in a notice of proposed rulemaking (“2024 NPRM”). <SU>1</SU> <FTREF/> After careful review and consideration of the entire rulemaking record, including public comments submitted by interested parties, and based upon its enforcement experience, the Commission has determined to adopt amendments to the Children's Online Privacy Protection Rule, 16 CFR 312 (“COPPA Rule” or “Rule”). These amendments will update and clarify the COPPA Rule, consistent with the requirements of the Children's Online Privacy Protection Act (“COPPA” or “COPPA statute”), 15 U.S.C. 6501 <E T="03">et seq.,</E> to protect children's personal information and give parents control over their children's personal information. <FTNT> <SU>1</SU>  Children's Online Privacy Protection Rule, Notice of Proposed Rulemaking, 89 FR 2034 (Jan. 11, 2024), available at <E T="03">https://www.govinfo.gov/content/pkg/FR-2024-01-11/pdf/2023-28569.pdf</E> . </FTNT> The final amendments to the COPPA Rule include a new definition for <E T="03">Mixed audience website or online service</E> that is intended to provide greater clarity regarding an existing sub-category of child-directed websites and online services under the Rule. The final amendments also modify the definitions of <E T="03">Online contact information</E> to include mobile telephone numbers; <E T="03">Personal information</E> to include government-issued identifiers and biometric identifiers that can be used for the automated or semi-automated recognition of an individual; <E T="03">Support for the internal operations of the website or online service</E> to clarify that information collected for the enumerated activities in the definition may be used or disclosed to carry out those activities; and <E T="03">Website or online service directed to children</E> to provide some examples of evidence the Commission may consider in analyzing audience composition and intended audience, and to adjust the third paragraph to align with the new definition of <E T="03">Mixed audience website or online service</E> . In addition, the Commission is modifying operators' obligations with respect to direct and online notices; information security, deletion, and retention protocols; and FTC-approved COPPA Safe Harbor programs' annual assessment, disclosure, and reporting requirements. The Commission is also adopting amendments related to parental consent requirements, methods of obtaining verifiable parental consent, and exceptions to the parental consent requirement. The Commission is replacing the term “web site” with “website” throughout the Rule and making other minor stylistic or grammatical changes to the Rule that the Commission proposed in the 2024 NPRM. In the 2024 NPRM, the Commission proposed a number of Rule modifications relating to educational technology (“ed tech”), including new definitions of <E T="03">School</E> and <E T="03">School-authorized education purpose,</E> <SU>2</SU> <FTREF/> as well as provisions governing collection of information from children in schools, <SU>3</SU> <FTREF/> and codifying a school authorization exception to obtaining verifiable parental consent. <SU>4</SU> <FTREF/> In Fall 2024, the United States Department of Education (“DOE”) affirmed its intention to propose amendments to the Family Educational Rights and Privacy Act (“FERPA”) regulations, 34 CFR 99, “to update, clarify, and improve the current regulations by addressing outstanding policy issues, . . . and clarify[ ] provisions governing non-consensual disclosures of personally identifiable information from education records to third parties.”  <SU>5</SU> <FTREF/> These changes may be relevant to provisions of the COPPA Rule related to ed tech and school authorization that the Commission proposed in the 2024 NPRM. To avoid making amendments to the COPPA Rule that may conflict with potential amendments to DOE's FERPA regulations, the Commission is not finalizing the proposed amendments to the Rule related to ed tech and the role of schools at this time. <SU>6</SU> <FTREF/> The Commission will continue to enforce COPPA in the ed tech context consistent with its existing guidance. <SU>7</SU> <FTREF/> <FTNT> <SU>2</SU>  89 FR 2034 at 2043-2044. </FTNT> <FTNT> <SU>3</SU>   <E T="03">Id.</E> at 2053-2058, 2059. </FTNT> <FTNT> <SU>4</SU>   <E T="03">Id.</E> The Commission also asked a question about what types of services should be considered to have an educational purpose. <E T="03">Id.</E> at 2071 (Question 16). </FTNT> <FTNT> <SU>5</SU>  Department of Education Fall 2024 Unified Agenda, RIN: 1875-AA15, available at <E T="03">https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202410&RIN=1875-AA15</E> . </FTNT> <FTNT> <SU>6</SU>  This approach is consistent with that taken in a prior Commission rulemaking. <E T="03">See</E> Energy Labeling Rule, Final rule, 87 FR 61465, 61466 (Oct. 12, 2022), available at <E T="03">https://www.federalregister.gov/documents/2022/10/12/2022-22036/energy-labeling-rule</E> (“In response to comments, the Commission will wait to update television ranges until [the Department of Energy] completes proposed test procedure changes for those products.”). </FTNT> <FTNT> <SU>7</SU>   <E T="03">See Complying with COPPA: Frequently Asked Questions</E> (“COPPA FAQs”), FAQ Section N, available at <E T="03">https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions</E> ; FTC, <E T="03">Policy Statement of the Federal Trade Commission on Education Technology and the Children's Online Privacy Protection Act</E> (May 19, 2022), available at <E T="03">https://www.ftc.gov/legal-library/browse/policy-statement-federal-trade-commission-education-technology-childrens-online-privacy-protection</E> . The Commission will monitor and weigh future developments with respect to DOE's potential FERPA regulation amendments in deciding whether to pursue COPPA Rule amendments related to ed tech. </FTNT> <HD SOURCE="HD2">B. Background</HD> Congress enacted COPPA in 1998. On November 3, 1999, the Commission issued the COPPA Rule, which became effective on April 21, 2000. <SU>8</SU> <FTREF/> The COPPA Rule imposes certain requirements on operators of websites  <SU>9</SU> <FTREF/> or online services directed to, or with actual knowledge of the collection of personal information from, children under 13 years of age (collectively, “operators”). The Rule requires that operators provide direct and online notice to parents and obtain verifiable parental consent before collecting, using, or disclosing personal information from children under 13 years of age. <SU>10</SU> <FTREF/> Additionally, the Rule requires operators to provide parents the opportunity to review the types of personal information collected from their child, delete the collected information, and prevent further use or future collection of personal information from their child. <SU>11</SU> <FTREF/> The Rule requires operators to keep personal information they collect from children secure and to maintain effective data retention and deletion protocols for that information. <SU>12</SU> <FTREF/> The Rule prohibits operators from conditioning children's participation in activities on the collection of more personal information than is reasonably necessary to participate in such activities. <SU>13</SU> <FTREF/> The Rule also includes a “safe harbor” provision that allows industry groups or others to submit to the Commission for approval self-regulatory guidelines that implement the Rule's protections. <SU>14</SU> <FTREF/> <FTNT> <SU>8</SU>  Children's Online Privacy Pr ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Preview showing 10k of 588k characters. Full document text is stored and available for version comparison. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━