Don't count COPPA out: From privacy statute to safety tool

It's an odd time to be talking about COPPA, the more than quarter-century-old Children's Online Privacy Protection Act. Since it was enacted in 1998, the U.S. statute itself has never been amended. The Children and Teens' Online Privacy Protection Act and similar proposals keep coming session after congressional session, but none have become law.  

So far, this year is no exception. Despite passing both chambers of Congress in two different forms, it's unlikely that COPPA 2.0 will be enacted. With its basic notice-and-parental-consent framework, and its statutory limitation to kids under age 13, a threshold COPPA 2.0 would raise to include teens, COPPA can seem like a privacy relic, even with the Federal Trade Commission's 2025 updates to the implementing rule.

Indeed, many state attorneys general appear to have drawn that conclusion. They've often skipped COPPA in favor of state unfair and deceptive trade practices laws and newly minted state privacy statutes, some of which contain express provisions aimed at kids' safety and mental health, in addition to privacy and data security. Sometimes that is because the attorney general wants to litigate in a more "friendly" state court and the presence of the federal COPPA claim makes it easier for the defendant to remove the case to federal court. Other times, it's because the attorney general won't spend the time and resources proving that a business had actual knowledge of child users on its site or service, or that the site or service is "directed to children" under COPPA's multifactor test. COPPA is very technical. 

But don't count COPPA out. The events of the past year — most notably the coalition of attorneys generals August 2026 Meta multistate settlement and the FTC's February "COPPA – Enforcement Policy Statement Promoting the Adoption of Age-Verification Technology" — suggest COPPA isn't waning as much as it is being absorbed into a broader digital regulatory architecture for kids and teens. The emerging framework keeps COPPA as a key tool for data privacy violations while UDAP laws and age-appropriate design codes provide the lever to challenge design choices that may put children at risk, especially features that leverage personal data, like recommender systems and push notifications. 

This isn't an entirely new approach. The FTC has long used COPPA alongside its statutory UDAP authority to reach both privacy and safety harms. The agency's pioneering 2019 action and order against TikTok, then known as Musical.ly, cracked down on practices that endangered kids, including public-by-default profiles that had let adults locate, follow and message young children, and direct messages that let any user contact them. Yes, that order, which is still in force despite the Department of Justice's recent attempt to relieve TikTok of its binding commitments. Similarly, the 2022 Epic Games settlement paired a COPPA claim for collecting kids' data without verifiable parental consent with a companion UDAP charge under Section 5 of the FTC Act, over its live on-by-default voice and text chat settings and player matching practices, which had exposed children and teens to bullying and harassment, including sexual harassment and predatory contact. That consent order required Epic to adopt strong privacy default settings and obtain affirmative consent from parents of children under 13, or from teenage users, before turning those features on. 

Last year's Disney action showed the same safety leaning. There, the FTC said that by labeling child-directed YouTube videos as "Not Made for Kids," Disney unlawfully collected and used children's personal information for targeted advertising. It also went further: the agency said the labeling also caused kids "downstream harms" by exposing them to features that were not intended for them, including autoplay to other NMFK videos and unrestricted public comments. The FTC's Business Blog put it bluntly, "We all know the rabbit holes autoplay and comments can take us to — and we do not want our kids going there."

Beyond these enforcement cases, the FTC is also harnessing COPPA for online safety work. Its February enforcement policy statement is ostensibly about clarifying how businesses can collect and use information from kids for age assurance without violating COPPA. But it's more than a shield against enforcement: it's intended to incentivize age assurance.

As its name broadcasts, the policy statement is promoting what agency officials have touted as the most significant technologies for protecting children in decades. It's signaling that the agency is elevating age verification technologies, including predictive facial age estimation models, over self-certification, which has been the COPPA default for decades. Indeed, Chairman Andrew Ferguson last year criticized unverified age gates, stating that, "Everyone ... knows that this method of age verification provides little to no barrier of access for children under the age of thirteen to online services." The policy statement draws on COPPA's substantive purpose limitation, data minimization, and data retention principles to supply the standards for age assurance. In short, the FTC is redeploying COPPA for service as a key element of child safety strategy strategies. 

Nowhere is this new COPPA-child safety connection clearer than in the Meta multistate consent judgment announced a few weeks ago. Despite claims that COPPA is too old, narrow and easy to bypass, it played a key role in driving the outcome.

For starters, the federal COPPA claim in the attorneys general complaint supplied the jurisdictional hook to bring their disparate claims together in one federal forum. That let enforcers from roughly 50 jurisdictions, states, territories and the District of Columbia, share litigation costs and trial resources. That structure also gave them negotiating leverage that matched Meta's scale. And it gave smaller states like Nebraska, New Hampshire and Mississippi actual seats at the negotiating table alongside powerhouse attorney general offices like California and New York. It also positioned the attorneys general to secure a lasting result, with ongoing federal judicial supervision and monitoring. Of course, Meta would ordinarily prefer federal court, but here the attorneys general made the forum work to their advantage.

More critically, although much of the press coverage focused on addiction/mental health issues, COPPA provided the anchor for the attorneys general theory of the case. Their 2023 complaint alleged that Meta unlawfully collected and used information from kids on its Instagram and Facebook platforms without verifiable parental consent, and profited from their data despite the company's awareness of the detrimental effects of its engagement-maximizing features on their mental health and wellbeing. The attorneys general tied Meta's willful disregard of COPPA's consent requirements to their addictive product design theory, arguing that Meta used the data it "harvested" from young users to design features that would maximum their time and attention and keep them on the platform longer to boost Meta's advertising revenues. On the opening day of trial, one of California's lawyers summed up Meta's approach this way: "'(H)ook' the users, 'hold' them for as long as they can, 'harvest' their data, and then 'hide' the truth from the public when making public statements," noting that this strategy worked especially well for kids. Eight days into what was expected to be a six-to-seven-week trial, Meta settled with the states.

The settlement agreement requires Meta to detect and remove children under age 13 from the two platforms. Those commitments depend, in large part, on age assurance protocols that hinge on the FTC's enforcement policy statement. Indeed, the Meta settlement order, and now, Alabama's recent TikTok decree, cite the FTC's 2026 age verification technology policy statement by name as the backdrop against which the commitments were negotiated. The agreement also contains a broad COPPA release covering COPPA claims for the use of kids' personal information for the sole purpose of enhancing Meta's efforts to detect and remove underage users including by developing, training, testing, and measuring the performance of a "U13 Age Model" against specified false-positive age thresholds. The COPPA releases in both the Meta and TikTok settlements do not provide the companies with a total pass. It still prohibits them from using age information for other purposes like advertising, marketing and algorithmic optimization and requires strict data minimization and retention limits for such information.

For teens who are permitted to have accounts on the platform, the settlement agreement also imposes a broad set of online privacy and safety protections, outside of COPPA. These include default limits on daily time use, nighttime blocks, restrictions on social comparison features and controls over algorithmically determined feeds and notifications. But even as these remedies extend to conduct far beyond COPPA, COPPA remains at its core: the age assurance requirement is also what makes the teen protections workable.

In many ways, the intertwining of COPPA's data privacy protections with online safety concerns makes sense: its legislative history makes clear that legislators made the connection between the revelation of children's personal information to total strangers on the internet and their physical safety from the get-go. Introducing the bill in July 1998, Sen. Richard Bryan, D-Nev., the lead sponsor of COPPA, warned that the online collection of information from kids may have a "profound impact upon their privacy and, indeed, their safety."  

Nearly 30 years later, that remains true, emphasizing the need for a combined approach to kids’ online privacy and safety, and for sound industry practices that draw on both COPPA and UDAP principles.