The FTC's 2025 COPPA rule adds an opt-in for kids' data sharing

The workload

A site or app that is, or might be, directed to children under 13 has always carried COPPA's verifiable-parental-consent duty; the 2025 amendments add a second, separate consent the operator now has to collect. The FTC's own announcement states the amended rule requires operators to get separate verifiable parental consent specifically before disclosing a child's personal information to third parties for targeted advertising or similar purposes, on top of the consent already required to collect the data in the first place. The added workload is a second consent flow and a data-retention policy that states a specific reason for keeping data rather than an indefinite default.

What the documents show

Verified: the FTC's own press release, dated 16 January 2025, states the Commission finalized the amendments and describes them as requiring opt-in consent for targeted-advertising disclosures and limiting data retention to what is reasonably necessary for the purpose collected, an explicit statement that indefinite retention is not permitted. Verified: the Federal Register entry for the final rule shows a publication date of 22 April 2025, three months after the Commission's own announcement, and states the amended rule's effective date as 23 June 2025, a later date operators had to plan around rather than the January announcement date. Verified: the same Federal Register entry describes the amendments as the first update to the rule since it was last amended in January 2013, and the underlying rule has applied since 2000.

The operating cost

Neither document states a compliance fee. The cost is the engineering work to add a second consent mechanism for third-party data sharing and to write and enforce a data-retention limit, plus the risk of FTC enforcement, which for COPPA violations can include civil penalties under separate FTC penalty schedules not detailed in either source cited here.

The stop condition

Editorially: the safest stop condition remains not collecting data from users known to be under 13 and not designing a product directed to children in the FTC's sense, since every COPPA obligation, old or amended, is triggered by that classification rather than by company size or intent.

• Does the product collect, or is it likely to be found to collect, personal information from users under 13, triggering COPPA regardless of company size?
• If so, does any third-party data sharing for advertising now require the separate opt-in the 2025 amendment added, distinct from the original collection consent?
• Is a specific, stated retention period documented for children's data, rather than an indefinite default the amended rule does not permit?

The three dates matter separately: finalized in January 2025, published in April 2025, effective in June 2025. Citing only the first as the compliance date would misstate when the new duties actually began.