A 2025 COPPA update requires opt-in before it requires compliance

The test

On 16 January 2025 the FTC finalized amendments to the Children's Online Privacy Protection Rule (COPPA Rule), the regulation that has required parental consent before collecting personal information from children under 13 since 2000. The FTC's own release states the amendments followed a January 2024 proposal and nearly 300 public comments. The amended rule was then published in the Federal Register on 22 April 2025, which states the amended Rule became effective 23 June 2025.

What the evidence says

The FTC's release lists specific changes: operators must get separate, verifiable parental consent before disclosing a child's data to third parties for targeted advertising; personal information can be retained only as long as reasonably necessary for the purpose it was collected for, not indefinitely; and FTC-approved COPPA Safe Harbor self-regulatory programs must publicly disclose membership lists and report more to the FTC. The Federal Register notice is the legally operative text and states the compliance mechanics in more detail than the release: it confirms a general one-year compliance window from publication, with certain Safe Harbor obligations taking effect sooner, on 90-day and six-month schedules. The FTC's release also states the agency declined to finalize some proposed changes, including limits on push notifications to children, after reviewing comments.

The sample and the variance

These amendments apply to operators already covered by COPPA, services directed to children under 13 or with actual knowledge of under-13 users, which includes short-form platforms with youth audiences but does not itself expand which services qualify. The one-year compliance figure is a ceiling stated in the Federal Register text for provisions without an earlier specified date, not a single fixed date every obligation shares. Neither document states that any platform has already changed its practices to meet the amended rule; both describe requirements, not enforcement outcomes.

What to try next

A short-form platform or marketing team relying on children's data for ad targeting should treat the opt-in requirement and the Safe Harbor disclosure change as the two amendments most likely to require new consent flows, and check the Federal Register text's specific compliance dates rather than assume the rule is already fully phased in. This is an editorial prioritisation, not a ranking either document itself makes.

• Has the FTC published guidance or a compliance checklist specific to the amended rule since the effective date?
• Which COPPA Safe Harbor programs have published the newly required membership disclosures?
• Has any enforcement action since mid-2025 cited the amended provisions specifically, rather than the pre-2025 rule?

A finalized rule and an enforced rule are different stages of the same policy; the amendments described here are confirmed text with confirmed dates, but their practical effect depends on compliance steps this record does not yet document.