The FTC tied children's data sharing to separate consent

The amended COPPA Rule requires separate consent for third-party data sharing and a written retention-limit policy, effective 23 June 2025.

Historical event

April 22, 2025

First source published

April 22, 2025

Site publication

September 18, 2026

What happened

The Federal Trade Commission published a final rule amending the Children's Online Privacy Protection Rule in the Federal Register on 22 April 2025. The amended rule became effective on 23 June 2025, while regulated entities have until 22 April 2026 to comply with most provisions, so adoption, effect and compliance are three separate dates on the FTC's own notice. The amendments update the Rule first issued under the 1998 Children's Online Privacy Protection Act and last revised in 2013, adding a definition for a mixed audience service and expanding personal information to include government-issued identifiers and biometric identifiers usable for automated recognition.

What the documents show

The Federal Register notice states that the amendments clarify that operators must obtain separate verifiable parental consent for disclosures to third parties, so a parent's consent to an operator's own collection no longer authorises sharing with outside entities such as ad networks by default; a parent must consent again for that disclosure. The same notice revises section 312.10 to require an operator to retain children's personal information only for as long as is reasonably necessary for the specific purpose collected, and to adopt a written data-retention policy stating the business need and deletion timeframe, which the operator must also describe in its public notice. The current codified rule, 16 CFR Part 312, carries this retention text into force.

The mechanism

The amendment works by separating two forms of consent that a single blanket approval used to cover: consent to collect, and consent to disclose onward. That separation targets the specific mechanism by which children's data reaches third-party advertising, an operator collecting data under one consent and quietly monetising it through downstream sharing, without banning data collection itself. The retention-limit duty adds a second, independent mechanism: even lawfully collected and disclosed data cannot be kept indefinitely, and the operator must commit in writing to a deletion timetable rather than an open-ended one.

What it leaves open

The rule does not set a specific numeric retention ceiling; reasonably necessary and a provider's own stated business need remain the operative standards, which leaves room for varying practice across companion and other child-directed or mixed-audience apps. The compliance deadline for most provisions is 22 April 2026, so as of this record's preparation date the amended obligations were in effect but the full compliance runway had not yet closed. This is an editorial note: a companion or chat app that knowingly serves under-13 users, or that qualifies as mixed audience, would need a retention policy and separate third-party consent flow in place well before that deadline.

• Does the app's privacy notice separately name a data-retention policy and timeframe for children's information?
• Is a parent asked to consent again before the child's data is shared with an outside ad network or analytics vendor?
• Would the service's audience or design bring it within the Rule's mixed audience definition?

The 2025 amendments do not change who counts as a child under COPPA; they change what a company must ask a parent's permission for once that child's data already exists inside the system.

Sources & reading trail

Final rule text and basis and purpose: separate consent for third-party disclosure, and the written data-retention-policy requirement, plus effective and compliance dates.

Source published: 22 April 2025 · Retrieved: 16 September 2026

Current codified text of section 312.10's retention-and-deletion requirement as in force.

Source published: Not established · Retrieved: 16 September 2026

Company documents, filings, studies and official records establish the record; the reading and the questions are Lovebot Journal editorial analysis. This retrospective draft does not imply the site published on the event date.

Continue reading

• Three companion privacy policies diverge on chat data
• Exporting and deleting a companion chat is not uniform
• Age assurance guidance separates declaring from proving
• Browse the complete the archive

Published September 18, 2026, not on the date of the event described.