What happened?

On January 16, 2025, the Federal Trade Commission (FTC) finalized amendments to the Children’s Online Privacy Protection Act (COPPA) Rule, enhancing protections for children under 13. These changes will affect privacy and data policies.

Overview:

These changes address the evolving digital landscape and give parents more control over their children’s data.

• FTC Finalizes Amendments to COPPA Rule: Summary
  • Opt-in Consent for Advertising: Parents must provide specific opt-in consent before companies can use children’s data for targeted advertising or disclose it to third parties.
  • Parental Consent Methods: New methods include knowledge-based questions, facial recognition technology, and “text plus” verification.
  • Data Retention: Operators must establish, implement, maintain, and publish a written data retention policy specifying the purposes for collecting personal information, business needs for retaining it, and the period for deletion. Indefinite data retention is explicitly prohibited.
  • Enhanced Security Requirements: Operators must establish, implement, and maintain a written information security program with appropriate safeguards, designate employees to coordinate it, conduct regular risk assessments, and ensure safeguards are in place.
  • Increased Transparency for Safe Harbor Programs: Programs must publicly disclose membership lists, include supplemental disclosures in annual reports, and submit a report to the FTC every three years.
  • Additional Changes: Restrictions on data exchange between businesses, expanded definitions of personal information (including biometric and government-issued identifiers), and flexibility in age assurance methodologies.
  • Support for Internal Operations Exception: Operators using this exception must post an online notice specifying the internal operations for collecting persistent identifiers from children.
  • Additional Content Requirements for Notices: Operators must specify the identities and categories of third parties to whom they disclose personal information online and direct parental notices.

The final rule will be effective 60 days after publication, with a 1-year compliance period for most amendments.

Additional Information:

• A notable deviation from the Notice of Proposed Rulemaking (NPRM) is that the FTC did not adopt proposals to ban certain uses of persistent identifiers and to codify the Policy Statement on Education Technology into the COPPA Rule.

• These updates reflect the FTC’s commitment to protecting children’s privacy and ensuring companies manage children’s data responsibly.

Source References

• Federal: COPPA Legislation on the Road to an Update (VensureHR)
• FTC Press Release COPPA
• 16 CFR Part 312: COPPA – Final Rule Amendments

Resources

• FTC Kids’ Privacy (COPPA)

This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.