What changed in the COPPA rule, and does it apply to my app?

The FTC's 2025 amendments to the children's privacy rule, the April 2026 compliance date, and what they mean for apps and AI features that children might use.

Short answer

COPPA applies when your app or site is directed to children under 13, or when you have actual knowledge that you are collecting personal information from a child under 13. The FTC's amended rule (90 Fed. Reg. 16918, April 22, 2025) took effect June 23, 2025, and compliance with most of its provisions was required by April 22, 2026. The biggest changes require separate parental consent before children's data is disclosed to third parties, a written data retention policy, and a written security program, and they broaden the definition of personal information. The FTC also said expressly that disclosing children's data to third parties to train AI requires that separate consent.

Does it apply to you?

• Directed to children. The FTC looks at the whole picture: subject matter, visuals, animated characters, music, the ages of people shown, advertising, and evidence of who actually uses the service.
• Mixed audience. The amended rule defines a mixed-audience service as a child-directed service that doesn't target children as its primary audience. Such a service can screen users' ages in a neutral way that doesn't encourage children to misstate their age, and then apply COPPA's notice and consent protections to users under 13. It generally can't collect personal information before it determines age. A general-audience service that simply has some child users is not a mixed-audience service.
• Actual knowledge. If a user tells you they are under 13, or your support or moderation team learns it, COPPA applies to that user even in a general-audience app.

What the 2025 amendments changed

• Separate consent for third-party disclosure (§ 312.5(a)(2)). Parents must be able to consent to the collection and use of their child's information without also consenting to its disclosure to third parties, unless the disclosure is integral to the service. Disclosures that aren't integral, such as those for targeted advertising, need separate verifiable parental consent. COPPA's definition of "disclosure" excludes certain transfers to providers that support internal operations, so not every outside vendor triggers the separate-consent requirement.
• Written retention policy (§ 312.10). The policy must state why you collect the data, the business need for keeping it, and when you will delete it, and it must appear in your online notice. There's no fixed number of days. Keep the data only as long as reasonably necessary for the purpose you collected it for, and never indefinitely.
• Written security program (§ 312.8). The program needs designated employees responsible for it, risk assessments at least once a year, safeguards that match the risks, regular testing and monitoring, and an annual review. Before disclosing children's data to others, assess the recipients and get written assurances that they will protect it. A company-wide program can satisfy this requirement if it covers children's data.
• Broader personal information (§ 312.2). The definition now includes government-issued identifiers, such as Social Security, state ID, birth certificate, and passport numbers. It also includes biometric identifiers that can be used to recognize a person automatically, such as fingerprints and handprints, retina and iris patterns, genetic data including DNA sequences, voiceprints, gait patterns, and facial templates and faceprints. Persistent identifiers, photos and recordings of a child's face or voice, geolocation, and online contact information remain covered.
• More consent methods (§ 312.5(b)(2)). The rule adds knowledge-based authentication, government photo ID with facial matching, and a text-message method. The email-plus and text-plus methods are available only to operators that don't disclose children's personal information to third parties. The facial-matching method requires safeguards, including prompt deletion of the ID and facial images.

AI features in apps children use

• Training is not integral. In its explanation of the final rule, the FTC said that disclosing children's personal information to third parties to train or otherwise develop AI technologies is not integral to the service and requires separate verifiable parental consent.
• Running a feature is a separate question. The FTC's statement is about disclosure for AI training and development. Whether an AI provider that simply runs a feature for you is supporting your internal operations, or is receiving a disclosure that needs separate consent, depends on your setup and has to be assessed case by case. Either way, contract for no training and short retention.
• Voice and images. Recordings and photos of children are personal information, and voiceprints and facial templates are expressly listed as biometric identifiers.
• Chat logs. Conversations with an AI feature are personal information, and your retention policy has to cover them.

Teens and state law

COPPA stops at 13, but state laws increasingly regulate minors' data, age assurance, app-store access, parental approval, and design features, including protections for teens aged 13 to 17. Many of these laws face constitutional challenges, so check each state's current court orders, not just its effective date. Examples as of this guide's date:

• Texas (SB 2420, App Store Accountability Act): requires age verification and parental approval for certain activity by minors. A federal court initially blocked it; appellate rulings in mid-2026 allowed enforcement while the challenge continues.
• Louisiana (Act 185 of 2026): a replacement app-store accountability law, scheduled to take effect July 1, 2027.
• California (Age-Appropriate Design Code Act): partially enjoined; the Ninth Circuit narrowed the injunction in November 2026.
• Florida (HB 3, minors' social media accounts): in ongoing constitutional litigation.

Checklist an agent can run against the codebase

• Find where the app asks for age or birth date, what happens when a user enters an age under 13, and whether any personal information is collected before that.
• List every SDK and API that receives data from users under 13, including analytics, advertising, and AI providers.
• For each recipient, note whether it is integral to the service or supports internal operations, and find the parental consent check that gates it.
• Check whether advertising or ad-measurement SDKs can run for users under 13.
• Find the deletion logic for children's data and compare it with the written retention policy.
• Check whether voice, photos, video, government ID numbers, or face or voice templates are collected from children.
• Check whether children's data can reach any third party's model training or development.
• Compare the privacy notice with the actual recipients and retention periods.

Sources

• FTC final rule amending the COPPA Rule and statement of basis and purpose, 90 Fed. Reg. 16918 (April 22, 2025)

If this applies to you

An app launch legal package covers the privacy notice, parental consent flow, and retention policy together. Adding a feature that children might use, such as an AI chat or voice feature, is a good fit for a pre-build feature check.