US Tightens Children's Privacy Rules for Targeted Ads

What Changed

On January 16, 2025, the US Federal Trade Commission (FTC) finalized amendments to its rule under the Children's Online Privacy Protection Act (COPPA), by a unanimous vote. It was the first change to the rule since 2013.¹ The rule covers commercial websites, apps and connected devices directed to children under 13.² The amendments were published in April 2025 and took effect on June 23, 2025, and most companies had until April 22, 2026 to comply.³

The change that matters most for advertising is consent. Operators must get separate and specific opt-in consent from a parent before disclosing a child's personal information to third parties for targeted advertising, and can't fold it into a general consent to data collection. Sharing that is integral to the service, such as for delivering a product, is exempt.³ The FTC's chair at the time, Lina Khan, said that requiring parents to opt in "prohibits platforms and service providers from sharing and monetizing children's data without active permission".¹

Other changes tighten what happens to children's data:^1,3

• "Personal information" now includes biometric and government-issued identifiers.
• Operators may keep children's data only as long as needed for the purpose it was collected for, and must publish a written retention policy.
• Notices to parents must name the third parties that receive data, or their categories, and why.
• Operators must take reasonable steps to make sure those third parties can keep the data secure.

Why It Mattered

For brands that advertise on children's sites and apps, or run them, targeted advertising using children's data now needs a parent's deliberate opt-in, separate from agreeing to use the service. Without it, ads there have to rely on context rather than the child's data, and every ad tech partner that receives children's data has to be named, at least by category, and checked.

It points the same way as Europe, where the Digital Services Act bans profiling-based ads to minors on platforms outright. On both sides of the Atlantic, children are now the audience where personalized advertising is most restricted.