ADventures in Law

Home | ADventures in Law

Just as we’re getting ready to pick out our cowboy boots and bolo ties for Beyoncé’s Cowboy Carter Tour, the Federal Trade Commission (FTC or Commission) <a href="https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule?utm_campaign=subscription+mailing+list&amp;utm_medium=email&amp;utm_source=federalregister.gov#citation-382-p16949" target="_blank" rel="noreferrer noopener">published</a> its long-awaited finalized amendments (Final Rule) to the Children’s Online Privacy Protection Act (COPPA) Rule. The rule’s last refresh came in 2012, back when <a href="https://www.adventures-in-law.com/blogs/coppa-is-all-grown-up-ftc-finalizes-rule/" target="_blank" rel="noreferrer noopener">“Call Me Maybe” by Carly Rae Jepsen</a> was the hottest song on the radio. Beyoncé has dropped six albums since then – including a cultural reset and a country curveball – so it’s only fitting that one of the most important laws regulating children’s privacy finally receives an update too.

core/paragraph

The Final Rule’s publication comes at a time when <a href="https://news.bloomberglaw.com/privacy-and-data-security/ftc-leaders-to-prioritize-childrens-privacy-us-data-security" target="_blank" rel="noreferrer noopener">the FTC is signaling it’s ready to lasso and pull in companies</a> based on consumer privacy and security interests. Enforcement of children’s privacy in particular is <a href="https://iapp.org/news/a/at-gps-2025-ftc-s-holyoak-outlines-next-steps-for-us-enforcement-innovation">one FTC commissioner’s top priority</a>. The Final Rule is effective June 23, 2025, 60 days after its publication. However, companies have until April 22, 2026 to comply with these changes.

One of the most notable changes comes in the form of a new consent requirement. Website operators will be required to obtain separate consent for disclosure of a child’s personal information to third parties, regardless of whether they already have verified parental consent for collection and use. Disclosures that are integral to the website or service’s operation are exempt from the separate consent requirement. A caveat of this exception, however, is that disclosures for monetary or advertising purposes or to train or develop artificial intelligence technologies are not considered integral and thus require separate consent. Additionally, the FTC is corralling companies into stronger transparency practices, requiring operators to clearly spell out in their online notices how they plan to use children’s personal data – including the identities <em>and</em> specific categories of third-party recipients.

Another update of interest is that the Final Rule expands on the things the FTC and states will look to in deciding whether or not something is marketed to children. Previously the focus really was external facing, asking how the content looked: Are there cartoon images or kid’s music? Is the language used simple and childlike? Now the Final Rule also looks inward and expressly notes that enforcers will also look at marketing and promotional plans and representations to customers as well as at consumer reviews.

This blog just skims the surface of the Final Rule – sort of like the top tracks instead of the full album. If you’re looking for the deluxe edition, check out <a href="https://admin.bakerlaw.com/wp-content/uploads/2025/05/Advisory-COPPA-Final-Rule-BakerHostetler-.pdf" target="_blank" rel="noreferrer noopener">BakerHostetler’s breakdown</a> for a deeper dive into what the FTC packed into this update. In the meantime, we’ll be at the Cowboy Carter Tour singing our hearts out to “16 Carriages.”

COPPA Is Back in the Saddle: FTC Publishes Final Rule for Children’s Privacy