The FTC tied children's data sharing to separate consent

What happened

The Federal Trade Commission published a final rule amending the Children's Online Privacy Protection Rule in the Federal Register on 22 April 2025. The amended rule became effective on 23 June 2025, while regulated entities have until 22 April 2026 to comply with most provisions, so adoption, effect and compliance are three separate dates on the FTC's own notice. The amendments update the Rule first issued under the 1998 Children's Online Privacy Protection Act and last revised in 2013, adding a definition for a mixed audience service and expanding personal information to include government-issued identifiers and biometric identifiers usable for automated recognition.

What the documents show

The Federal Register notice states that the amendments clarify that operators must obtain separate verifiable parental consent for disclosures to third parties, so a parent's consent to an operator's own collection no longer authorises sharing with outside entities such as ad networks by default; a parent must consent again for that disclosure. The same notice revises section 312.10 to require an operator to retain children's personal information only for as long as is reasonably necessary for the specific purpose collected, and to adopt a written data-retention policy stating the business need and deletion timeframe, which the operator must also describe in its public notice. The current codified rule, 16 CFR Part 312, carries this retention text into force.

The mechanism

The amendment works by separating two forms of consent that a single blanket approval used to cover: consent to collect, and consent to disclose onward. That separation targets the specific mechanism by which children's data reaches third-party advertising, an operator collecting data under one consent and quietly monetising it through downstream sharing, without banning data collection itself. The retention-limit duty adds a second, independent mechanism: even lawfully collected and disclosed data cannot be kept indefinitely, and the operator must commit in writing to a deletion timetable rather than an open-ended one.

What it leaves open

The rule does not set a specific numeric retention ceiling; reasonably necessary and a provider's own stated business need remain the operative standards, which leaves room for varying practice across companion and other child-directed or mixed-audience apps. The compliance deadline for most provisions is 22 April 2026, so as of this record's preparation date the amended obligations were in effect but the full compliance runway had not yet closed. This is an editorial note: a companion or chat app that knowingly serves under-13 users, or that qualifies as mixed audience, would need a retention policy and separate third-party consent flow in place well before that deadline.

• Does the app's privacy notice separately name a data-retention policy and timeframe for children's information?
• Is a parent asked to consent again before the child's data is shared with an outside ad network or analytics vendor?
• Would the service's audience or design bring it within the Rule's mixed audience definition?

The 2025 amendments do not change who counts as a child under COPPA; they change what a company must ask a parent's permission for once that child's data already exists inside the system.