Insight
The COPPA Rule and the Separate Age Verification Policy
The amended COPPA duties and the limits of the FTC's age-verification enforcement statement.
The amended COPPA Rule and the FTC's February 2026 age-verification statement have different legal effects. The Rule establishes obligations. The statement describes conditional enforcement discretion for certain age-verification activities; it does not amend the Rule or create an enforceable entitlement.
The amended Rule
The FTC published its amendments to 16 C.F.R. part 312 on April 22, 2025. They took effect June 23, 2025, with a general compliance date of April 22, 2026, subject to separate deadlines for specified provisions. The amendments did not change COPPA's core: an operator of a service directed to children under 13, or with actual knowledge that it is collecting from one, must obtain verifiable parental consent first, subject to the Rule's exceptions. That duty dates from 2000. What changed is the detail.
| Rule topic | Requirement |
|---|---|
| Third-party disclosure | Separate parental consent for nonintegral third-party disclosure, subject to the Rule's conditions and exceptions |
| Retention | Written retention policy and a justified retention period; indefinite retention is prohibited |
| Security | Written program, responsible personnel, risk assessment, safeguards, and service-provider oversight |
| Personal information | Covered biometric identifiers are included in the definition |
| Mixed audience | Apply the definition's age-screening conditions before collecting personal information under that route |
| Consent methods | Permitted methods have different safeguards and limits; text-plus is restricted to operators that do not disclose the child's information |
The consent methods are not interchangeable. Text-plus verification is available only to operators that do not disclose the child's information; identification and facial-matching methods carry authentication, review, and deletion conditions.
The policy statement
Age verification creates a puzzle. To learn whether a user is a child, an operator may have to collect information from that child, which COPPA forbids without parental consent. The February 2026 statement addresses the puzzle and nothing else.
The FTC's statement describes conditional enforcement discretion for specified mixed-audience and general-audience operators collecting information to determine age. It requires purpose limitation, restricted third-party disclosure with written assurances, prompt deletion, notice, safeguards, reasonably accurate methods, and compliance with COPPA in other respects. The statement does not amend the Rule or create substantive rights, and the FTC expressly retains authority to investigate and enforce in individual cases.
Three limits matter. The statement covers mixed-audience and general-audience operators, not services primarily directed to children. Third-party sharing requires written assurances covering safeguards, purpose limitation, and prompt deletion. And the discretion is conditioned on compliance with COPPA in every other respect.
What the statement does not do
It does not amend the Rule. It does not require anyone to verify age. It does not excuse any other COPPA duty. It does not bind courts, state attorneys general, or other enforcers. It lasts until the FTC amends the Rule or withdraws the statement; the agency has said it will open a review of the Rule on age verification. It also says nothing about Texas law. A service that verifies age to satisfy the SCOPE Act, the App Store Accountability Act, or HB 1181 must meet those statutes on their own terms. The FTC's forbearance protects only against the FTC.
An example shows the boundary: an age-assurance vendor that retains a face image for advertising falls outside the statement's age-verification-only condition. A vendor contract should address deletion and contain the required assurances.
Sources
- 16 C.F.R. part 312 (§§312.2, .5, .8, .10)
- FTC enforcement policy statement on age verification technology (Feb. 25, 2026)
- Mayer Brown on the FTC age-verification policy statement (commentary)
- Hunton on the FTC age-verification policy statement (commentary)
- Loeb & Loeb on the amended COPPA Rule (commentary)