The agency makes exception to the Childrens Online Privacy Protection Rule
-
The Federal Trade Commission (FTC) announced it will not take enforcement action under the Childrens Online Privacy Protection Rule (COPPA) against certain operators using personal data solely for age verification.
-
The policy applies to general audience and mixed audience websites that meet strict data use, security and deletion requirements.
-
The Commission signaled it will begin reviewing COPPA to formally address age verification technologies.
The Federal Trade Commission has issued a policy statement clarifying that it will not bring enforcement actions under the Childrens Online Privacy Protection Rule (COPPA) against certain website and online service operators that collect personal information strictly to determine a users age.
The move addresses growing uncertainty around age verification tools, which are increasingly being used to help shield children from inappropriate online content but may require collecting personal data in the process.
COPPA, enacted in 1998, requires operators of commercial websites or online services directed to children under 13 or those with actual knowledge they are collecting personal information from a child to notify parents about their data practices and obtain verifiable parental consent before collecting, using or disclosing that information.
Since COPPA became law, childrens use of internet-connected devices has expanded dramatically. In response to concerns about online safety, several states have begun requiring certain websites and online services to implement age verification mechanisms to determine users ages.
Potential conflict
However, discussions at a recent FTC workshop highlighted a potential conflict: some age verification technologies themselves require the collection of personal information from children, raising questions about whether operators using such tools could inadvertently violate COPPA.
The FTCs new policy statement aims to resolve that tension.
Age verification technologies are some of the most child-protective technologies to emerge in decades, said Christopher Mufarrige, director of the FTCs Bureau of Consumer Protection. Our statement incentivizes operators to use these innovative tools, empowering parents to protect their children online.
Under the policy, the Commission said it will not bring enforcement actions against operators of general audience or mixed audience sites that collect, use or disclose personal information solely for age verification even if they do not first obtain verifiable parental consent provided they meet specific safeguards.
Those conditions include limiting the use of collected information strictly to determining a users age and not repurposing it for marketing or other activities. Operators must also delete the information promptly once age verification is complete and refrain from retaining it longer than necessary.
In addition, companies must disclose age verification data only to third parties that can maintain its confidentiality, security and integrity, and they must obtain written assurances to that effect. Clear notice to parents and children about what information is being collected for age verification is also required.
The FTC further requires operators to implement reasonable security safeguards to protect the data and to take reasonable steps to ensure that any age verification method or third-party service they use is likely to produce reasonably accurate results.
Posted: 2026-02-26 13:19:59

















