There is no universal compliance framework for managing data related to minors, but attorneys Greg Szewczyk and Madison Etherington from Ballard Spahr suggest that companies can implement various measures now to reduce risks.
For many years, numerous companies viewed youth privacy on their applications as a limited compliance issue: Is the application aimed at users under 13, or does the company have actual knowledge that a user is younger than 13?
The federal Children’s Online Privacy Protection Act (COPPA) continues to be a fundamental element of children’s privacy compliance, yet state regulations are swiftly emerging and broadening the efforts to oversee how businesses gather, utilize, and share the personal information of young individuals online. Additionally, app store accountability measures introduce further requirements by establishing new evaluation and notification standards regarding how companies obtain age-related data.
Consequently, businesses are compelled to reassess their methods of collecting and processing user information.
COPPA is applicable to operators of websites and online services aimed at children under 13, as well as those who are aware that they are collecting personal information from someone under that age. Operators covered by COPPA must provide notice and secure verifiable parental consent prior to collecting, using, or disclosing such information.
However, this foundational standard is changing. The FTC finalized amendments to the COPPA Rule in 2025, which, among other updates, mandate separate parental opt-in consent before certain disclosures of minors’ personal information to third parties for targeted advertising.
In general, businesses should continue to regard COPPA as the minimum standard for compliance, typically indicating that their products or services are not intended for children and that information will not be gathered from children without first obtaining verifiable parental consent. If a company discovers that it has inadvertently collected information from children, it should promptly rectify the situation by deleting the data and halting all related processing.
While COPPA has served as the foundational guideline for processing children’s information for many years, an increasing number of state privacy laws are beginning to regulate data pertaining to teenagers separately.
Data belonging to teenagers is emerging as its own compliance category. Several states have started to implement laws that require businesses to handle the data of individuals aged 13 to 18 differently.
- New York’s Child Data Protection Act governs personal data belonging to users under 18. For users aged 13-17, certain processing must either be strictly necessary for specified activities or backed by informed consent. The law also restricts some uses of personal data collected while a user was a minor once the user reaches adulthood.
- Maryland’s Online Data Privacy Act prohibits targeted advertising and the sale of personal data involving consumers whom an organization knew or should have known were under 18.
- Arkansas’ Children and Teens’ Online Privacy Protection Act establishes distinct obligations for children under 13 and teens aged 13-16 when a company is aware that it collects their personal information.
- Colorado’s Privacy Act was recently revised to offer additional protections for the data of individuals under 18 when a controller is aware or willfully ignores information indicating that a user is a minor, and the Department of Law has rulemaking authority. In the draft rules that have been released, the attorney general outlines factors to consider when determining whether a controller has willfully disregarded a consumer’s minor status. These factors include whether the user can provide their age, whether the user can modify their age, whether the user has a bio section in their profile, whether there are indicators of age, such as grade level, and whether the company categorizes them differently for marketing purposes. However, the draft rules explicitly state that this list is not exhaustive, and the determination…
Source: Original article