What Is
What Is COPPA
The Children's Online Privacy Protection Act (COPPA), 15 U.S.C. 6501 to 6506, and the Federal Trade Commission's COPPA Rule, 16 C.F.R. part 312, protect children under 13. They apply to an operator of a website or online service directed to children, and to any operator that actually knows it is collecting personal information from a child (15 U.S.C. 6502(a)).
A covered operator must post notice of what it collects from children and how it uses and discloses it, obtain verifiable parental consent before collecting, using, or disclosing a child's personal information, let parents review the information and stop further use, collect no more than a game or activity reasonably requires, and protect the information's confidentiality, security, and integrity (15 U.S.C. 6502(b)).
The FTC approved amendments to the Rule on January 16, 2025. The amended Rule was published in the Federal Register on April 22, 2025, took effect June 23, 2025, and compliance with the new requirements was required by April 22, 2026. Operators must now obtain separate verifiable parental consent before disclosing a child's information to third parties for purposes not integral to the service, such as targeted advertising; keep and disclose a written retention policy and never keep children's data indefinitely; maintain a written information security program; and treat biometric identifiers as personal information. The Rule provides narrow exceptions to prior verifiable parental consent, including specified collection to seek consent, a one-time response to a child's request, and limited collection to protect the service's security or integrity. Each exception has its own limits on the information collected and its use, disclosure, notice, or deletion (16 C.F.R. 312.5(c)). On February 25, 2026, the FTC issued a policy statement on how it will treat age verification; the statement guides enforcement but does not amend the Rule.
A violation of the Rule is treated as a violation of an FTC rule on unfair or deceptive practices (15 U.S.C. 6502(c)), with civil penalties of up to $53,088 per violation (16 C.F.R. 1.98). State attorneys general, including Texas's, may sue in federal court for injunctions and damages on behalf of residents after notifying the FTC (15 U.S.C. 6504). The statute gives individuals no right to sue.
Why it matters in Texas. The Texas Data Privacy and Security Act treats a known child's data as sensitive data that must be processed in line with COPPA (§541.101(b)(4)), and a controller that complies with COPPA's parental consent requirements is treated as complying with the TDPSA's parental consent obligations (§541.005). The SCOPE Act takes a different approach: it applies to covered digital services that allow social interaction, public or semi-public profiles, or user-posted content (§509.002), and it protects known minors under 18, except minors who have had the disabilities of minority removed for general purposes (§509.001(5)).
Pinpoint: 15 U.S.C. 6501 to 6506; 16 C.F.R. part 312. Related term: Child (TDPSA).