Congress enacted the Children’s Online Privacy Protection Act (“COPPA” or “COPPA statute”), 15 U.S.C. 6501 et seq., in 1998 to protect children’s privacy and empower parents to control who may collect personal information from their children.¹ Among other things, COPPA requires operators of commercial websites or online services directed to children under 13, and operators with actual knowledge they are collecting personal information from a child, to provide notice of their information practices to parents and to obtain verifiable parental consent before collecting, using, or disclosing personal information collected from a child.²

The COPPA statute directed the Federal Trade Commission (“Commission” or “FTC”) to promulgate regulations implementing COPPA’s requirements.³ On November 3, 1999, the Commission issued its Children’s Online Privacy Protection Rule (“COPPA Rule” or “Rule”). The Commission has substantively revised the Rule in 2013⁴ and 2025.⁵

In the decades since COPPA’s enactment, internet-connected technology has become a significant presence in many children’s lives.⁶ Parents in turn have faced increasing challenges in understanding which online sites and services their children are using and how to make choices about their children’s online activities. In response to this phenomenon, some states have taken steps to protect children’s online privacy and safety by passing laws that mandate that certain sites or services use age-verification mechanisms.⁷ The purpose of these mechanisms is to obtain

¹ Children’s Online Privacy Protection Rule, Notice of Proposed Rulemaking, 64 FR 22750 (Apr. 27, 1999), https://www.govinfo.gov/content/pkg/FR-1999-04-27/pdf/99-10250.pdf (citing 144 Cong. Rec. S12741 (Oct. 7, 1998) (Statement of Sen. Bryan)).

² 15 U.S.C. § 6502(b)(1)(A).

³ 15 U.S.C. § 6502(b).

⁴ Children’s Online Privacy Protection Rule, Statement of Basis and Purpose, 78 FR 3972 (Jan. 17, 2013), https://www.federalregister.gov/documents/2013/01/17/2012-31341/childrens-online-privacy-protection-rule.

⁵ Children’s Online Privacy Protection Rule, Statement of Basis and Purpose, 90 FR 16918 (Apr. 22, 2025), https://www.govinfo.gov/content/pkg/FR-2025-04-22/pdf/2025-05904.pdf.

⁶ See, e.g., Common Sense Media, The Common Sense Census: Media Use by Kids Zero to Eight, 2025 (Feb. 26, 2025), https://www.commonsensemedia.org/sites/default/files/research/report/2025-common-sense-census-web-2.pdf (noting that “children under 2 spend[ ] an average of one hour and three minutes on screens per day, while 2- to 4-year-olds average nearly two hours (2:08), and 5- to 8-year-olds average around three and a half hours per day (3:28)” and engage in activities such as watching videos, using AI, and visiting social media platforms); see also Common Sense Media, The Common Sense Census: Media Use by Tweens and Teens, 2021 (Mar. 9, 2022), https://www.commonsensemedia.org/sites/default/files/research/report/8-18-census-integrated-report-final-web_0.pdf (noting that “[o]n average, 8- to 12-year-olds use about five and a half hours of screen media per day” and visit properties such as online video platforms and social media).

⁷ For example, various states have enacted laws that require the use of age-verification mechanisms to access social media platforms and other content. See, e.g., The Age Verification Providers Association, US state age assurance laws for social media, https://avpassociation.com/us-state-age-assurance-laws-for-social-media/; The Age Verification Providers Association, US State age verification laws for adult content, https://avpassociation.com/4271-2/. For the purposes of this enforcement policy statement, “age verification” refers to a variety of tools used to obtain information about a user’s age, including: (1) age estimation tools that estimate a user’s age or age range; (2) age-verification tools that verify a user’s age; and (3) age inference tools that infer a user’s likely age or age range based on various signals.

and analyze information about a user who visits the site or service to determine what types of access, restrictions, or protections to provide that user.

Age verification can play a critical role in protecting children online and helping parents as they monitor their children’s online activities. To promote innovation in, and the responsible use of, age-verification mechanisms, the Commission is issuing this enforcement policy statement (“Enforcement Statement”) to describe how operators of websites or online services directed to children that do not target children as their primary audience (known as “mixed audience” websites or online services),⁸ as well as operators of general audience sites or services⁹ (collectively “Relevant Operators”), can utilize age-verification mechanisms without subjecting themselves to the risk of enforcement under the COPPA Rule.

The COPPA Rule applies to the collection, use, and disclosure of personal information collected from children. Some Relevant Operators distinguish between children and older users, and seek verifiable parental consent only for users that the Relevant Operators have determined are children. Relevant Operators have often determined a user’s age by simply requesting that the user provide his or her age before interacting with the site or service. But a growing number of age-verification mechanisms now enable Relevant Operators to determine age more reliably than a user-provided response to an age-gating function.¹⁰ In response, Relevant Operators have raised questions about how to comply with the COPPA Rule when adopting these mechanisms, to the extent these mechanisms involve the collection of personal information from a child.

To encourage the use of robust age-verification mechanisms, the Commission will not bring an enforcement action under the COPPA Rule against a Relevant Operator that collects, uses, or discloses personal information for the purpose of determining a user’s age (“Age Verification Purposes”) without first obtaining verifiable parental consent. The Commission seeks to encourage Relevant Operators to use these mechanisms to determine a user’s age more accurately and reliably. These more accurate determinations will in turn allow Relevant Operators to apply their child-protection measures to the fullest extent, thereby protecting more children online. The Commission will, however, exercise its enforcement discretion under the Enforcement Statement only where a Relevant Operator:

1. • does not use or disclose information collected for Age Verification Purposes for any purpose other than for Age Verification Purposes;
2. • discloses information collected for Age Verification Purposes only to those third parties that the Relevant Operator has taken reasonable steps to determine are capable of maintaining the confidentiality, security, and integrity of the information, including by obtaining written assurances that such third parties will employ reasonable measures to do so, will not use or disclose information collected for Age Verification Purposes for any other purpose, and will delete this information promptly after fulfilling the Age Verification Purposes;
3. • does not retain this information longer than the period necessary to fulfill the Age Verification Purposes, and deletes such information promptly thereafter;
4. • provides clear notice to parents and children of the information collected for Age Verification Purposes in the Relevant Operator's privacy policy;
5. • employs reasonable security safeguards for information collected for Age Verification Purposes; and
6. • takes reasonable steps to determine that any product, service, method, or third party utilized for Age Verification Purposes is likely to provide reasonably accurate results as to the user's age.

In addition, the Commission will not exercise its enforcement discretion in circumstances described in this Enforcement Statement unless the Relevant Operator is complying with the COPPA Rule’s requirements in every other respect with regard to personal information collected from children. This requirement ensures that the COPPA Rule will continue to protect America’s children to its fullest extent, while also promoting innovation in the development of age-verification technology.

This Enforcement Statement does not create any substantive rights or entitlements, and the Commission retains the right to investigate and bring actions for violations of the COPPA Rule in individual cases. In the coming months, the Commission intends to initiate a review of the COPPA Rule to address age-verification mechanisms. This Enforcement Statement will remain effective until the Commission publishes final rule amendments on this issue in the Federal Register, or until otherwise withdrawn.