FTC advances stronger COPPA rules for kids' data — what would change for families

The Federal Trade Commission's proposed updates to the COPPA rule — its children's online privacy regulation, announced in January 2025 — would require separate parental consent for disclosing data to third parties and for targeted advertising, limit how long platforms can retain children's data, and strengthen security requirements. The current rule, in force since 2000, covers data collection from children under 13. None of the changes are final: the proposal cleared the comment period in 2025 and the rule moves through the Commission's process, which agency materials caution can take a year or more.

The Offspring Session publishes information, not legal advice; this article covers what the proposed rule would change for families if adopted as proposed.

What is in the proposal?

Four elements matter most to families, per the FTC's official proposal summary. First, advertising and data-sharing to third parties would each become separately consentable uses — a parent could say yes to the app but no to the data resale. Second, data retention limits would require platforms to keep children's data only as long as a specific purpose requires. Third, the security obligations for children's data get explicit teeth. Fourth — the element other coverage skipped — the proposal addresses the school-software loophole: educational technology providers taking children's data in the school context would face clearer limits on reusing that data commercially.

What would actually feel different?

Consent screens with more granularity, less long-tail retention of a child's history, and — the industry's most contested part — pressure toward better age assurance. The FTC has said the current honor-system birthdates are a weakness; the proposal does not mandate a single verification method, but compliance pressure pushes platforms toward more checks at signup. Trade groups have contested the cost in comments, and the Commission must answer them, per the rulemaking record.

What should families do meanwhile?

The current rule's rights still apply today: the right to review what a platform holds about a child under 13, to delete it, and to refuse further collection. Practically, parents can check an app's privacy practices for the COPPA section, prefer apps that state limits plainly, and use the parental-consent flows rather than bypassing them with false birthdates — which removes the child from the rule's protections entirely. When the final rule lands, those rights get sharper; nothing in the proposal removes them.

What the docket establishes is a real strengthening in process, with dates attached to its stages. What it cannot establish is the final text — the comment record is contested, and no source can predict what the Commission adopts.