A 1998 law still sets the internet's under-13 privacy line

The short answer

If a service is directed at children under 13, or knows a user is under 13, it needs a parent's verifiable consent before collecting most personal information, and that has been the basic rule since the Children's Online Privacy Protection Act took effect. A 2025 update tightened things further, adding limits on how long that data can be kept and a separate consent step for targeted advertising. None of this makes an app safe by default; it sets a floor for what a company must ask before it collects.

What the evidence says

Congress passed the Children's Online Privacy Protection Act in 1998, and the FTC's implementing Rule followed in 2000, covering operators of commercial websites and online services, including apps and connected devices, that are 'directed to children under 13' or that have actual knowledge they are collecting data from a child that age, according to the FTC's rule summary. The Commission judges whether a service is child-directed using factors such as subject matter, animated characters and child celebrities, per its compliance FAQ, which also lists what counts as personal information: names, contact details, a persistent identifier that recognises a device over time, a photo, video or audio file with a child's image or voice, and geolocation precise enough to identify a street and town. In 2013 the FTC finalised amendments that broadened the Rule's reach. On 16 January 2025 the Commission voted to finalise further changes: operators must now get separate parental consent before disclosing a child's data to third parties for targeted advertising, retain data only as long as reasonably necessary, and Safe Harbor programmes must publish member lists and report more to the FTC, per the FTC's announcement. The amended text takes effect 60 days after formal publication, with a year allowed for compliance.

For context

COPPA regulates data collection, not content, design or screen time, and it stops at age 13; a teenager's account sits outside the Rule entirely. The child-directed test also depends partly on a company's own classification, which is why enforcement cases turn on whether a service should have known it was reaching children. Reasonable people can differ on where a mixed-audience app sits, and the FTC's guidance leaves some of that judgement to the operator in the first instance.

A practical next step

If your child uses an app, it can help to look up whether it describes itself as directed at children, general audience, or mixed; that classification, more than any age gate, determines what protections apply.

• Does this app or site say it is directed at children, general audience, or mixed?
• Has a parent ever been asked to consent to data collection for this account, and do you remember what for?
• Would you know how to ask a company to delete a child's account and its data?

The 2025 changes narrow some gaps that had existed since 2000, particularly around advertising and retention, but the basic architecture, consent before collection for a defined age group, is unchanged since the Rule's introduction.