The Narrow Promise of Age Verification Under COPPA
The subject of this series is the post-2025 Children’s Online Privacy Protection Rule, or COPPA, and the Federal Trade Commission’s 2026 policy on age-verification technologies. The practical question is narrower than the public debate often suggests: when may a service collect information to determine a user’s age without first obtaining verifiable parental consent, and what obligations remain after that age decision? The answer matters to operators choosing an age-assurance method, parents deciding what a service is asking them to accept, and readers trying to distinguish a real legal boundary from a reassuring product label.
Age verification can reduce uncertainty about who is using a service. It cannot, by itself, answer whether the service is covered by COPPA, whether the information collected is personal information, whether the stated purpose is the only purpose, or whether the data is secure and deleted when it is no longer needed. The central idea of this series is therefore simple: an age check may route a user through a privacy regime, but it is not a general privacy exemption.
COPPA changed, but it did not stop being COPPA
The FTC’s 2025 amendments updated and clarified a rule that was already built around parental control. The amended rule became effective on June 23, 2025, and most regulated entities had until April 22, 2026 to comply. It refined definitions, added or clarified notice requirements, strengthened security and retention provisions, and adjusted some parental-consent methods. Those changes respond to newer technologies and online practices. They do not suspend the underlying structure.
That structure begins with a covered operator’s collection, use, or disclosure of personal information from a child under 13. The operator generally must provide notice and obtain verifiable parental consent before those activities occur. Parents must have a reasonable way to review information collected from their child, refuse further use or collection, and request deletion. Operators must protect the information and maintain retention and deletion practices. They also may not condition a child’s participation in a game, prize offering, or other activity on disclosing more personal information than is reasonably necessary for that activity.
This last protection is especially important to the age-verification question. Consent is not a universal cure for over-collection. The amended rule treats the necessity limit as an independent boundary: an operator cannot simply ask for a larger data package, obtain parental agreement, and then describe the whole package as permissible. Nor can a retention policy turn indefinite storage into a legitimate purpose. The rule requires information to be kept only as long as reasonably necessary for the specific purpose for which it was collected, and it prohibits indefinite retention.
The 2025 amendments also make the surrounding system more visible. They clarify the category of mixed-audience services, expand the definition of personal information to include additional government-issued identifiers and certain biometric identifiers, require more detailed disclosures about third-party sharing, and add a written information-security program and written data-retention policy. These are not unrelated administrative additions. Together, they reflect a view of privacy protection as a chain: identify when the rule applies, tell parents what will happen, obtain the required permission, limit the purpose, protect the information, and remove it when the purpose ends.
Three questions hidden inside one age gate
A product screen that asks, “Are you over 13?” appears to pose one question. COPPA analysis sees at least three.
The first is a coverage question: what is the service, or what is the relevant portion of it, and what does the operator know about its audience and data collection? The amended rule retains a fact-based inquiry into whether a commercial website or online service is directed to children. Subject matter, visual and audio content, child-oriented activities and incentives, models or celebrities, language, advertising, audience evidence, and evidence of intended audience can all matter. A service is not automatically outside the rule because children are a minority of its users, and the FTC declined to create a safe percentage below which an operator could stop asking broader questions.
The second is a visitor-level question: what does the operator use to determine whether this particular visitor is a child? This is where mixed-audience services have a specific, limited role for age screening. A mixed-audience service is still directed to children under the rule’s analysis, but children are not its primary audience. It may use age information or another reasonably calculated method to identify visitors who are children. The method must be neutral; it cannot default to a chosen age or encourage visitors to claim they are older.
The third is a data-permission question: what information is being collected, for what purpose, and under what authority? A result such as “not identified as under 13” may change the visitor-level COPPA branch for a mixed-audience service. It does not rewrite the service’s audience classification, erase actual knowledge, or authorize every other use of the information collected during the check. When a visitor is identified as under 13, the operator must still follow the applicable notice and parental-consent requirements before collecting, using, or disclosing the child’s personal information.
The input to the age check matters as much as the result. The amended definition of personal information includes a photograph, video, or audio file containing a child’s image or voice; government-issued identifiers such as a state identification, birth-certificate, or passport number; persistent identifiers; and biometric identifiers that can be used for automated or semi-automated recognition. The biometric examples include fingerprints, voiceprints, gait patterns, facial templates, and faceprints. This does not mean that every age signal is always personal information under every factual design. It does mean that an operator cannot make a high-intrusion input disappear legally by renaming it “verification data.”
The difference between input and output is the key. A service may want only a yes-or-no age result, but it may still collect a face image, an identifier, or a biometric template to produce that result. Minimizing what is retained after the decision is valuable. It does not automatically make the original collection irrelevant.
A narrow policy promise, and why the boundary matters
The FTC’s February 2026 policy statement is the source of much of the current confusion because its practical effect is meaningful but carefully limited. It says the Commission will not bring an enforcement action under the COPPA Rule against certain operators of general-audience and mixed-audience sites and services that collect, use, or disclose personal information solely to determine a user’s age without first obtaining verifiable parental consent—provided they satisfy the statement’s conditions.
That wording is an enforcement position, not a new statutory category and not a rewrite of the final rule. The statement says it will remain effective until the FTC publishes final rule amendments addressing age-verification mechanisms in the Federal Register or withdraws the statement. Its temporary and conditional character matters. “The Commission will not bring a COPPA enforcement action in the described circumstances” is not the same as “age verification is exempt from privacy law.” It is also not a promise that conduct outside the conditions, or obligations arising under other legal authorities, will be ignored.
The conditions explain the policy’s logic. Information collected for age verification must not be used or disclosed for another purpose. It must not be held longer than necessary and must be deleted promptly afterward. If it is shared, the operator must take reasonable steps to determine that the recipient can protect its confidentiality, security, and integrity. The operator must provide clear notice to parents and children, use reasonable security safeguards, and take reasonable steps to choose a method or provider likely to produce reasonably accurate results.
These conditions are cumulative, not decorative. A company cannot invoke the age-only purpose while using the same data to build profiles, improve unrelated targeting, or enrich identity records. A vendor relationship does not remove the operator’s responsibility to consider recipient capability. A fast deletion routine does not excuse misleading notice or an unreliable method. And a technically accurate age decision does not authorize a collection that is broader than reasonably necessary.
The Justice Department’s August 2026 announcement of a $400 million settlement with TikTok, ByteDance, and affiliated entities supplies a useful enforcement reality check, but not an age-verification shortcut. The release describes $300 million to be paid immediately and another $100 million tied to vacating a prior consent decree against Musical.ly’s predecessor. It also describes changes in ownership, management, compliance functions, privacy practices, age-related controls, and parental oversight. Yet the release expressly says the resolved claims are allegations only and that there has been no determination of liability. It does not establish that age verification created a defense, that the settlement concerned the 2025 amendments specifically, or that the reported changes satisfy the FTC’s 2026 policy.
That limit is not a technical footnote. It is the habit needed to read this subject accurately. A rule tells us what its requirements are. A policy statement tells us how an agency currently describes a particular enforcement posture. A settlement announcement tells us what the government says it resolved and what it reports about the resolution. None of those documents should be stretched into a universal guarantee.
The question that follows is therefore not, “Which age gate makes the service exempt?” It is, “What facts put this service and visitor inside COPPA, what information does the age decision require, and which protections govern that information before, during, and after the check?” Audience classification comes first. Only then can the narrow promise of age verification be tested against the data flow it is supposed to justify.