Skip to content
AI Policy Generator

ESWhat applies

United States (federal) · Regulation

Children's Online Privacy Protection Rule (COPPA), as amended

In forceCOPPA Rule 2025

Summary

The amended COPPA Rule has been fully enforceable since April 22, 2026. It covers online services directed to children under 13 or that knowingly collect their data, including AI chatbots and educational apps. It requires separate parental consent to share data with third parties, a written retention policy and a written security program.

Who it applies to

Operators of websites, apps and online services (including AI services) directed to children under 13 in the US, or that knowingly collect their data.

Penalties

Civil penalties of more than $50,000 per violation (adjusted annually for inflation).

Official name
Children's Online Privacy Protection Rule (16 CFR Part 312), as amended (90 FR 16918, April 22, 2025)
Official reference
16 CFR Part 312; Federal Register, 22 de abril de 2025
Regulator
Federal Trade Commission (FTC)
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Separate parental consent to share children's data16 CFR 312.5(a)(2)In forceApril 22, 2026Applies if your service is directed to children under 13 or you know you collect their data.Verified in the official source on November 4, 2026
Written data retention policy for children's data16 CFR 312.10In forceApril 22, 2026Applies to operators covered by COPPA.Verified in the official source on November 4, 2026
Written information security program16 CFR 312.8In forceApril 22, 2026Applies to operators covered by COPPA.Verified in the official source on November 4, 2026

Written data retention policy for children's data

16 CFR 312.10In force

Applies from April 22, 2026

When it relates
Applies to operators covered by COPPA.
What the rule provides
  • Keep data only as long as needed for the purpose, then delete it.
  • Publish a retention policy with purposes and timeframes.
Typical evidence
  • Published retention policy
  • Deletion records
Verification
Verified in the official source on November 4, 2026Checked in the Federal Register (90 FR 16918: effective Jun 23, 2025; compliance by Apr 22, 2026, except § 312.11(d)(1), (d)(4) and (g)) and on eCFR: § 312.10 (retain only as long as necessary and a written retention policy published in the notice).

Written information security program

16 CFR 312.8In force

Applies from April 22, 2026

When it relates
Applies to operators covered by COPPA.
What the rule provides
  • Designate a coordinator, assess risks at least annually and implement safeguards.
  • Require equivalent safeguards from vendors that receive children's data.
Typical evidence
  • Written security program and annual assessment
Verification
Verified in the official source on November 4, 2026Checked in the Federal Register (90 FR 16918: effective Jun 23, 2025; compliance by Apr 22, 2026, except § 312.11(d)(1), (d)(4) and (g)) and on eCFR: § 312.8(b) (written program, coordinator and risk assessment at least annually) and § 312.8(c) (written assurances from third parties).

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)