FTC staff found teens get little more than adult data rules

The short answer

In September 2024, FTC staff published findings from years of compelled disclosures by nine major social media and video streaming companies, and concluded that most treated teenagers exactly like adult users for data-collection purposes, while relying on a legal technicality, saying children cannot create accounts, to avoid deeper obligations toward younger children. The report is a staff analysis of practices from 2019 and 2020, not a new rule, but it names specific gaps a parent might otherwise assume were already closed.

What the evidence says

Using its Section 6(b) authority to compel information without a specific law-enforcement purpose, the FTC ordered nine companies, including Meta, YouTube's parent Google, Amazon's Twitch, ByteDance's TikTok, Snap, X, Discord, Reddit and WhatsApp, to answer detailed questions about their data practices, and staff published the findings as 'A Look Behind the Screens' in September 2024, with the FTC's announcement dated 19 September 2024. The report examined practices during the period the orders covered, 2019 and 2020, not current behaviour. On children and teens, it found companies generally restricted account creation for under-13s, the age COPPA covers, but most also claimed to have no child users at all because children supposedly cannot register, even though the report says the companies know children use their services regardless. Teens fared differently: almost all companies allowed teenagers on with no restrictions beyond those for adults, and collected personal information the same way, because COPPA's Rule does not cover users 13 and older. Very few companies gave parents any rights over a teen's account. The report's index page confirms the 6(b) legal basis, and the full report called data retention and deletion practices severely deficient, with some companies failing to fully delete data on request, while targeted advertising drove most revenue with little meaningful opt-out.

For context

This is a staff report, not a rule, settlement or enforcement action, and its underlying data is several years old by publication, so it is a snapshot rather than current practice. Its central point about teens, that COPPA's age-13 line leaves 13-to-17-year-olds with essentially adult-level data collection by default, is a structural observation about the law, not a finding that any one company broke a rule. The report recommends Congress pass comprehensive privacy legislation and that companies treat COPPA as a floor, not a ceiling, extending more protection to teens by default.

A practical next step

Since the report suggests teen accounts often get no more protection than adult accounts by default, it may be worth checking a teenager's account settings directly, rather than assuming their age alone triggers extra safeguards.

• Does a platform your teenager uses offer any account protections specifically for under-18 users, or only the standard adult defaults?
• Would you know how to request deletion of your own or a family member's data from a platform, and whether it actually happens?
• Do you think COPPA's under-13 line still matches how your household actually uses these services?

The report's lasting contribution may be naming, in the companies' own disclosures, a gap between COPPA's letter and how teenagers are actually treated, whatever else changes since 2020.