The FTC’s COPPA overhaul introduces stricter data privacy rules for kids, requiring opt-in consent for targeted ads and redefining personal information. Publishers face challenges—and opportunities—in adapting to the new regulations.
The FTC has finalized significant updates to the Children’s Online Privacy Protection Act (COPPA) Rule, marking the first drastic overhaul since 2013. These changes, set to take effect in early 2025, reflect growing scrutiny of how companies handle children’s data online and follow years of pressure from advocacy groups and alarming reports about violations by major platforms like YouTube.
Advocacy groups like Fairplay and the Center for Digital Democracy have long pushed for stricter enforcement, citing incidents where adult-targeted ads—some featuring violent content—were served to children on YouTube. These violations, coupled with a record $170 million fine levied against Google in 2019 for COPPA breaches, highlight the urgent need for more robust protections.
COPPA, originally enacted in 1998 to curb unchecked data collection from children under 13, has been expanded under the new rules. These updates aim to address modern challenges in digital advertising and data privacy, including using advanced tracking technologies and the rise of biometric data collection.
Key Changes in COPPA Updates
As former FTC Chair Linda Khan said, “The updated COPPA rule strengthens key protections for kids’ privacy online.” But what exactly are the new updates?
- Opt-In Consent for Targeted Advertising: Publishers must now secure explicit, verifiable parental consent before sharing children’s personal data with third-party advertisers. This effectively blocks behavioral advertising unless parents opt-in.
- Expanded Definition of Personal Information: COPPA now includes biometric data and government-issued identifiers, significantly broadening the scope of protected data.
- Stricter Data Retention Policies: Children’s data can only be retained for as long as necessary for its original purpose, with indefinite retention explicitly prohibited.
- Enhanced Safe Harbor Transparency: Safe Harbor programs must publicly disclose member lists and provide additional reporting to the FTC.
This means that publishers and advertisers need explicit permission to access data and only use that for its intended purpose and nothing else. Sounds simple, right?
“By requiring parents to opt-in to targeted advertising practices, this final rule prohibits platforms and service providers from sharing and monetizing children’s data without active permission. The FTC is using all its tools to keep kids safe online,” said Khan.
However, Dona Fraser, SVP, BBB National Programs’ Privacy Initiatives, Children’s Advertising Review Unit (CARU), says it’s not as simple as that. Yes, the update gives parents more control over how companies can use their children’s data, but the average parent doesn’t have the insight on targeted advertising like a publisher or advertiser would.
“While the opt-in requirement aims to give parents more control over their child’s data, its full impact remains unclear due to limited evidence on parental understanding of targeted ads and data sharing,” said Fraser. “Companies must assume parents know little and prioritize transparency to comply with COPPA.”
What Publishers Need to Understand About the COPPA Update
The new opt-in requirement for children’s content could significantly impact publishers, with ad revenue potentially declining by 40-60% due to the reduced effectiveness of targeted ads. To adapt, publishers could pivot toward contextual advertising strategies tailored to youth-oriented content as behavioral targeting becomes increasingly limited.
“The business impact will be significant—both in implementation and cost,” said Fraser. “Companies must secure verifiable parental consent before sharing children’s data with third-party advertisers, and robust consent mechanisms will add expenses. If parents opt out, ad revenue could decline, raising sustainability concerns.”
Operationally, publishers face a substantial overhaul, including redesigning data collection, storage, and deletion practices, auditing trackers to align with COPPA’s expanded definition of personal information, implementing robust age verification systems, and updating consent mechanisms to meet the new opt-in standards.
These changes come with a tight timeline, as the final rule will take effect 60 days after publication in the Federal Register, providing publishers until early 2025 to comply.
Privacy expert Dr. Elena Rodriguez sees this as an opportunity for publishers to rebuild trust, stating, “This is about creating a digital ecosystem where protecting young users is a fundamental value.” Despite the financial and operational hurdles, these changes present a chance for publishers to innovate through privacy-first monetization strategies and renewed investments in contextual advertising.
Data Retention and Minimization: Best Practices for Publishers
For publishers, the COPPA updates represent both a challenge and an opportunity.
While compliance will require significant investment and operational changes, those who innovate privacy-first monetization strategies will gain a competitive edge. Balancing user privacy with sustainable revenue models is key to thriving in this new regulatory environment.
The days of unrestricted data collection are over. Publishers must now lead the way in building a digital ecosystem that prioritizes trust and transparency. However, many publishers had already considered this before the COPPA update.
To fully prepare for the new update Fraser has a few suggestions. Companies should prioritize data retention and minimization by:
1) reviewing and updating retention practices,
2) maintaining a detailed written policy on data collection, retention, sharing, and deletion, and
3) regularly reviewing policies, especially when launching new products.
“Additionally, companies collecting data from all age groups should flag and separate children’s data to streamline compliance—an added cost, but a crucial safeguard,” said Fraser.”