The 2025 COPPA rewrite adds a separate opt-in for ad sharing

The revenue mechanism

A site or newsletter reaching children under 13 cannot monetize their data the same way it monetizes an adult reader, because the Children's Online Privacy Protection Act requires verifiable parental consent before collecting it, and on 16 January 2025 the FTC voted to tighten what that consent must cover. Its own press release states the Commission finalized amendments to the COPPA Rule by a 5-0 vote, effective 60 days after Federal Register publication. The mechanism a publisher needs to understand is narrow but consequential: the change specifically targets disclosing a child's data to third parties for targeted advertising, not general operation of a covered site.

What the documents show

The FTC's release states the amended rule requires operators to obtain separate, verifiable parental consent specifically before disclosing a child's personal information to third parties for targeted advertising or other purposes, on top of any consent already obtained to operate the service. It also states operators must retain a child's personal information only as long as reasonably necessary for the specific purpose collected, and may not retain it indefinitely. FTC-approved COPPA Safe Harbor programs, which oversee some operators, must now publicly disclose their membership lists and report more to the FTC. The rule expands the definition of personal information to include biometric and government-issued identifiers, and the FTC declined, after nearly 300 comments, to adopt separate limits on push notifications to children.

The assumptions exposed

These are the amendments the FTC's own release states it adopted; they are not a record of enforcement outcomes, since the changes had not taken effect when the release was issued, and compliance timelines run from Federal Register publication, not the vote date. A press release is the agency's own plain-language account of a longer legal text; a publisher relying on it should still confirm the exact effective and compliance dates against the Federal Register notice itself, since a release can simplify provisions a covered operator must apply precisely. The FTC declining to adopt push-notification limits does not mean it considers that practice acceptable; the release states it remains concerned about engagement techniques directed at children even where it declined to regulate them here.

What to check before you rely on it

This is an editorial checklist, not legal advice, and the FTC's own children's privacy guidance is the place to confirm current obligations. A publisher that may reach users under 13 should check whether its data-sharing arrangements with ad networks or measurement vendors newly require separate opt-in consent, whether its retention practice matches the new necessity standard, and whether it collects any newly covered identifier types.

• Do I share a child user's data with a third party for targeted advertising, and have I obtained separate consent for that disclosure?
• Does my retention policy specify a purpose-limited period, or default to keeping data indefinitely?
• Do I collect biometric or government-issued identifiers now treated as personal information?

The amended rule narrows how an operator may monetize a child's data through third-party sharing; it does not change the underlying requirement to know whether COPPA applies to your audience at all.