Overview
This series explains how the amended COPPA Rule and the FTC’s February 2026 policy treat age verification. It starts with service classification and actual knowledge, narrows the mixed-audience visitor path, then follows inputs, recipients, security, retention, deletion, consent, and necessity. The result is a practical judgment: certain general-audience and mixed-audience operators may receive a narrow, conditional enforcement posture for age-only processing, but an age result does not erase COPPA coverage, sensitive inputs, or later privacy duties. The policy is temporary and conditional, and the TikTok settlement supplies enforcement context without proving liability or approving any method.
Learning outcomes
- An age gate can change a mixed-audience visitor path, but it cannot create that classification or erase actual knowledge.
- The FTC’s 2026 statement covers only certain age-only processing by general-audience and mixed-audience operators meeting all stated conditions.
- A binary age result does not make the underlying image, identifier, or biometric input irrelevant.
- The TikTok settlement shows enforcement stakes, but its allegations do not approve an age-verification method or prove liability.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
Does age verification exempt a service from COPPA?
No. Age verification is not a general COPPA exemption; the FTC statement offers only a narrow, conditional enforcement posture for certain age-only processing.
When can a mixed-audience service use an age screen under COPPA?
A mixed-audience service may use a neutral, reasonably calculated method after it is found to be directed to children but not primarily aimed at them. Before screening, it generally may not collect other personal information except for limited consent exceptions.
What happens to data collected for an age check?
It remains part of the privacy analysis: the operator must examine purpose, disclosure, security, retention, and deletion for inputs such as images, identifiers, or biometrics. Under the FTC statement, age-verification information must be deleted promptly after it is no longer necessary.
What conditions apply under the FTC’s 2026 age-verification policy?
For certain general-audience and mixed-audience operators, use and disclosure must stay limited to age determination, with prompt deletion, controlled recipients, clear notice, reasonable security, and reasonable steps toward accuracy.