Countdown to COPPA Rule
The long-awaited updates to the Children’s Online Privacy Protection Act Rule (Final Rule) took effect on June 23, 2025, with a compliance deadline of April 22, 2026. With this fast-approaching compliance deadline, businesses should be actively working to update backend systems to meet the new requirements.
As we discussed in an earlier article, the Final Rule made several key changes that impose new obligations on operators that affect interactions with parents, privacy policy disclosures, and back-end operations. Covered operators must:
- Notify parents directly of the identities or categories of each third party (including the public) to whom the operator discloses children’s personal information, and obtain parental consent.
- Describe in the website privacy policy the specific internal operations for which the operator has collected a persistent identifier, and the means the operator uses to ensure that such identifier is not used or disclosed to contact a specific individual (including for behavioral advertising), to amass a profile of a specific individual, or for any other purpose, except as specifically permitted.
- Adopt a written data security program; designate one or more employees to coordinate the program; conduct, at least annually, a security risk assessment; and obtain written assurances that third parties with which personal information is shared will maintain the security of children’s data.
- Create a written data retention policy and describe the policy in the company’s website privacy notice.
The Final Rule also adopts new definitions, including “mixed audience,” and adds biometric and government identifiers as types of information included in the definition of “personal information,” and related retention and sharing practices.
Many companies are operating under a holiday code freeze that affects the ability to update websites and technology. Nevertheless, companies should be working now to ensure that their practices and operations align with the Final Rule’s requirements.