First, Determine Which COPPA World You Are In
This chapter explains the coverage mechanism that comes before any discussion of age-verification technology: how the amended COPPA Rule classifies a service, a portion of that service, and the operator’s knowledge about its users. The practical value is straightforward. Before asking whether an age gate is accurate or privacy-preserving, a reader should be able to identify which facts make COPPA apply and which facts merely determine the path for a particular visitor.
COPPA classifies the service before it classifies the visitor
COPPA does not begin with a universal question about whether every user is a child. It begins with the operator, the commercial website or online service, the information being collected, and the relationship between the service and children under 13. The amended rule covers a service directed to children, including a child-directed portion of a larger service. It also covers an operator that has actual knowledge that it is collecting or maintaining personal information from a child.
That first category is not decided by a single design feature. The rule preserves a totality-of-the-circumstances inquiry: the FTC considers the service’s subject matter, visual content, child-oriented activities or incentives, music and other audio, the age of models, child celebrities or celebrities who appeal to children, language, other characteristics, and whether advertising promoting or appearing on the service is directed to children. It may also consider competent and reliable empirical evidence about audience composition and evidence about intended audience, including marketing materials, representations to consumers or third parties, user or third-party reviews, and the age of users on similar services.
The point of this list is not to create a scoring formula. It is to show why classification is a factual judgment. A service can signal its intended audience through its own choices—what it makes, how it describes the offering, whom it features, and how it promotes the service. Evidence about actual users can matter too, but the FTC said that reviews and demographic evidence may receive different weight depending on whether they are accurate, representative, genuine, or relevant to the COPPA question. The amended examples do not require an operator to find and continuously monitor every review or every demographic fact on the internet.
This flexibility cuts in two directions. It prevents an operator from claiming that one contrary fact automatically settles the question, but it also prevents a dashboard threshold from doing all the legal work. During the rulemaking, the FTC considered an exemption for services that found no more than a specified percentage of users were likely to be children under 13. The agency declined to adopt it. Commenters raised concerns about manipulated data, changing user populations, unreliable age methods, increased collection of personal information, and the mismatch between a percentage test and the rule’s multi-factor approach.
An operator therefore cannot treat “only a small share of our users are children” as a complete answer. That fact may be relevant evidence, but it does not replace the questions about intended audience, content, design, marketing, and the operator’s knowledge. A service that primarily attracts adults may still contain a child-directed portion. A service that is generally aimed at adults may still face COPPA obligations when it knows that it is collecting a child’s personal information. The relevant classification can change with the service’s design, audience, and information practices.
The idea of a “primary” audience also should not be mistaken for a numerical cutoff. The FTC has described the word in its ordinary sense—what stands first in rank, importance, or value—and says the judgment still depends on the totality of the circumstances. This allows a portion of a service to be primarily directed to children even when the service as a whole is not. It also explains why the same age-screening design may have different consequences in two different products: the legal starting point is the service and its facts, not the screen in isolation.
Actual knowledge is the second major route into the rule. It matters because COPPA is not limited to services whose content obviously appeals to children. A general-audience operator can become a covered operator when it has actual knowledge that the information it collects or maintains comes from a child. The rule also addresses circumstances in which an operator knows it is collecting personal information directly from users of another child-directed service. The precise facts matter, but the underlying principle is easy to state: a general-audience label does not cancel information the operator actually knows.
This is why the service-level and knowledge-level questions must be kept separate. One asks what the service is and whom it targets. The other asks what the operator knows about a particular collection practice. An age gate may produce evidence about a visitor’s age, but it does not retroactively decide what the service was designed to be, and it does not erase knowledge already held by the operator.
Mixed audience does not mean audience-neutral
The rule’s mixed-audience category is useful precisely because it preserves these distinctions. A mixed-audience website or online service is directed to children under the rule’s audience test, but children are not its primary audience. The category is therefore not a synonym for “general audience,” and it is not a finding that children are irrelevant to the service. It is a narrower classification with a visitor-level age-screening option.
The analysis has two steps. First, the operator asks whether the service—or the relevant portion of it—is directed to children using the totality of the circumstances. If the answer is no, the service is not mixed audience on that basis. If the answer is yes, the operator asks whether children are the primary audience. If children are primary, the service remains primarily child-directed. If children are not primary, the service may qualify as mixed audience.
Only after that two-step analysis does the age-screening option become relevant. A mixed-audience service may collect age information or use another method reasonably calculated, in light of available technology, to determine whether a visitor is a child. The method must be neutral. It cannot default to a selected age, steer visitors toward an older answer, or use design choices and messages that encourage visitors to falsify their age.
The rule also places a collection boundary around the screening step. Before collecting age information or using another reasonably calculated method, a mixed-audience operator generally may not collect personal information from any visitor, except for the limited purposes listed in the rule’s exceptions to prior parental consent. This matters because the age gate is not a license to collect a profile first and classify the person later. The sequence is part of the protection: determine the relevant age status before beginning broader personal-information collection.
Consider an illustrative service that offers creative tools, has a large adult audience, and includes a section whose design and subject matter appeal strongly to children. The service cannot simply call itself general audience and assume that the child-oriented section has no separate significance. It must first examine the section under the audience test. If the section is child-directed but children are not its primary audience, a neutral age screen may help distinguish visitors for that section. If a visitor identifies as under 13, the operator must apply COPPA’s notice and parental-consent requirements before collecting, using, or disclosing the child’s personal information.
If the visitor is not identified as under 13, the rule says a mixed-audience service is not deemed directed to children with regard to that visitor. That is a visitor-level consequence, not a declaration that the service has become audience-neutral. It does not authorize unrelated collection during the age check, make an intrusive input harmless, or prevent a different actual-knowledge fact from mattering. The result narrows one branch of the analysis; it does not dissolve the analysis itself.
The diagram’s most important edge is not the one leading to an age screen. It is the edge that comes before it: service assessment. A method cannot create a mixed-audience classification simply because it is called an age gate. Nor can it convert a primarily child-directed service into a general-audience service. The operator must establish the relevant category from the facts, and then use age determination within the limits of that category.
Why an age result is not the legal endpoint
An age result answers a limited question: how should the operator treat this visitor for the purpose at hand? It does not answer what was collected to obtain the result or what the operator plans to do with that information afterward. Those are separate privacy questions, which is why a visitor-level branch cannot be confused with permission to process data.
The distinction is clearest when the method itself uses personal information. A service may ask for a date of birth, an image, a voice sample, an identity document, or a biometric signal. The legal significance of that input depends on the facts and the rule’s definitions. The amended rule expressly includes children’s image or voice files, certain government-issued identifiers, persistent identifiers, and biometric identifiers capable of automated or semi-automated recognition among examples of personal information. A yes-or-no result does not erase the input that produced it.
The same logic applies to a service that believes it has selected an adult visitor. If the method is designed in a way that encourages false answers, the neutrality requirement is implicated. If the service collected other information before determining age, the sequence may undermine the mixed-audience limitation. If the operator already has actual knowledge that the information comes from a child, the general-audience label may not resolve the problem. And if the visitor is identified as under 13, the operator must move into the COPPA path rather than treating the age result as permission to continue collecting.
This does not mean that COPPA requires one universal age-verification technology. The FTC’s rulemaking record recognizes flexibility and did not impose a single additional verification method for every service. It means that method choice follows classification; it does not replace it. An operator must be able to explain what the service is, why the method is reasonably calculated to determine age, how the method treats visitors neutrally, and what happens to the information used in the process.
That order of reasoning is also useful for readers. When a product description says that an age gate “solves” children’s privacy, ask four questions before accepting the claim. What facts make the service or its relevant portion child-directed, mixed audience, or general audience? What does the operator actually know about the visitor and the collection? What information is gathered before and during the age decision? What changes if the visitor is identified as under 13?
Once those questions are answered, the FTC’s 2026 policy statement can be read in its proper place. It addresses a narrow form of age-only processing for certain general-audience and mixed-audience operators. It does not create the coverage category that makes the policy relevant, and it does not supply the answer for the data lifecycle that follows. The next question is therefore not whether the FTC has blessed age gates in general, but what the statement actually promises not to enforce—and the conditions attached to that promise.