What the FTC's 2026 Age-Verification Policy Actually Allows
The subject here is the Federal Trade Commission’s February 2026 policy statement on age-verification technologies, and the specific question is what its promise not to bring a COPPA enforcement action actually covers. The answer gives operators and readers a practical boundary: the statement can support a narrow form of age-only processing for certain services, but it is not a new audience category, a permanent amendment to COPPA, or a declaration that age verification makes personal information generally exempt.
The distinction matters because the statement uses language that is both reassuring and conditional. The FTC says it will not bring an enforcement action under the COPPA Rule in described circumstances. That is a meaningful enforcement choice. It is not the same legal act as changing the rule’s text. To understand the difference, it helps to read the statement as a comparison between two things that are often treated as interchangeable: a rule that defines obligations, and an agency policy that describes how it will exercise enforcement discretion within a limited situation.
A policy statement is not a new legal category
The 2025 amendments remain the starting point. They define the services and collection practices to which COPPA applies and retain the requirement for verifiable parental consent before covered collection, use, or disclosure of a child’s personal information. The 2026 statement does not announce that those definitions have been replaced. Instead, it describes how the FTC will approach one particular question: whether certain operators may collect, use, or disclose personal information solely to determine a user’s age without first obtaining verifiable parental consent.
The described operators are those running general-audience and mixed-audience websites or online services. That scope is narrower than “every service that uses an age gate.” It does not name a general right for primarily child-directed services to collect whatever information they want in the name of age assurance. Nor does it say that a general-audience label settles the coverage question. The classification work still matters. A service must be in a category to which the statement applies, and the age-verification processing must have the purpose the statement describes.
The phrase “will not bring an enforcement action” also matters. It describes the Commission’s current enforcement posture under the COPPA Rule; it does not erase the rule or promise that every consequence of the processing is suspended. The policy statement says it will remain effective until the Commission publishes final rule amendments on age-verification mechanisms in the Federal Register or withdraws it. That language makes the policy temporary in two ways: it can be superseded by a later rule, and it can end through withdrawal.
This is not a semantic distinction reserved for lawyers. Suppose an operator reads the statement as a permanent exemption and builds an age check that collects extra information, keeps it for unrelated analytics, or sends it to a vendor without meaningful controls. If the operator’s behavior no longer fits the stated conditions, the headline promise no longer describes the behavior. The operator has not merely chosen a less elegant implementation. It has changed the facts on which the enforcement posture depends.
A policy statement also has a different relationship to uncertainty than a regulation. The FTC’s release identifies the policy’s purpose and conditions, but it does not create a universal accuracy score, prescribe one technology, or specify one retention period that works for every service. The absence of a fixed technical recipe is deliberate room for method selection, not permission to stop evaluating the method. An operator must still make a reasonable, fact-sensitive judgment about whether the chosen method is likely to determine age accurately enough for the situation.
That open choice creates a real comparison rather than a search for an officially approved product. A method that asks for little information may still need scrutiny for false or easily manipulated answers. A method that uses a photograph, identity document, or biometric signal may provide a different kind of age evidence, but it also creates a more consequential collection and a larger security question. The supplied policy summary does not rank these methods or establish that one is best in every context. It requires the operator to connect the method to the actual age question, the likely accuracy, the amount of information involved, and the safeguards that will govern the flow.
The statement should therefore be read as a conditional answer to a narrow question: when the covered operator uses personal information only to determine age, and satisfies the listed safeguards, how will the FTC approach COPPA enforcement? It should not be read as an answer to broader questions about the operator’s audience classification, the sensitivity of the input, the validity of another use, or the requirements of other legal authorities. Those questions remain outside the statement’s described promise.
Read the conditions as one control package
The first condition is purpose. The operator must not use or disclose information collected for age verification for any purpose except determining a user’s age. “Sole purpose” is stronger than saying that age determination is one purpose among several. If the same collected information is also used to build a profile, support unrelated targeting, enrich an identity record, or serve another independent business objective, the operator would have difficulty describing the processing as age-only. The policy’s value depends on keeping the information inside the purpose that justifies the limited enforcement posture.
Purpose limitation also forces a distinction between an age decision and the information used to reach it. A service may ultimately want only a conclusion about whether a visitor is under a threshold. That desired output does not mean every input is automatically confined to that output. The operator must be able to identify what information enters the process and what happens to it. If an age-verification provider receives the information, the provider’s role is part of the operator’s purpose and disclosure analysis; the operator cannot make the purpose narrow merely by outsourcing the step.
The second condition concerns time. Information collected for age verification cannot be retained longer than necessary to fulfill the age-verification purpose, and it must be deleted promptly afterward. The policy does not supply a universal number of minutes, hours, or days. “Promptly” operates as a factual constraint tied to necessity. A service should be able to explain why the information must remain at all after the decision, what event ends that need, and how deletion actually occurs. Keeping the information indefinitely for a possible future use would conflict with the statement’s age-only logic.
That condition is not interchangeable with the rule’s general retention requirements. The amended COPPA Rule separately requires operators to keep children’s personal information only as long as reasonably necessary for the specific purposes for which it was collected and to maintain a written retention policy. The policy statement adds a particularly direct expectation for the age-verification flow. Deletion is both a risk reduction and a condition of the narrow enforcement approach; it is not a retroactive claim that the information was never sensitive.
The third condition concerns recipients. If the operator discloses age-verification information, it must disclose it only to third parties the operator has taken reasonable steps to determine are capable of maintaining the information’s confidentiality, security, and integrity. The operator must obtain certain written assurances from those recipients. This moves the analysis beyond the operator’s own application. A service can have a careful front-end age screen and still create a new failure point when the information crosses to a provider whose safeguards, retention, or secondary uses are unclear.
The fourth condition is notice. The operator must provide clear notice to parents and children about the information collected for age-verification purposes. Clear notice is not merely a statement that “we use age assurance.” It should make the relevant collection understandable to the people affected: what kind of information enters the process, why it is needed to determine age, and what limits govern its use, sharing, and deletion. The policy summary does not prescribe one notice template, so the responsible question is not whether a particular sentence appears but whether the notice communicates the actual flow without hiding the sensitive step behind a product label.
The fifth condition is security. The operator must employ reasonable security safeguards for information collected for age-verification purposes. Security is a separate condition because prompt deletion does not protect information during the period in which it exists. Access controls, transfer practices, storage choices, and incident readiness may vary with the information and the operator, but the basic logic is constant: temporary possession still creates an exposure window. A service cannot claim that a short retention period makes security irrelevant.
The sixth condition is reasonable accuracy. The operator must take reasonable steps to determine that the product, service, method, or third party used for age verification is likely to provide reasonably accurate results. This requirement does not make the FTC a certification body for a particular vendor. It does not establish a single benchmark that every service can quote as proof. It places a method-selection responsibility on the operator, which must consider whether the method is suitable for the age question it is being used to answer.
Accuracy and privacy should not be treated as rival slogans. A method that produces an age decision but encourages visitors to falsify their age may fail the broader design objective. A method that is accurate but gathers more information than necessary may create a different problem. A method selected without evidence about its likely results may not satisfy the policy’s reasonable-steps condition even if it is marketed as innovative. The statement leaves room for innovation because technologies and contexts differ; it does not remove the duty to evaluate the choice.
The sequence shows why the conditions cannot be reduced to “collect, check, delete.” The operator chooses or engages a method, receives a result, gives notice, controls any disclosure, secures the information, and makes a purpose-limited retention decision. Each step has a different failure mode. A provider may be inaccurate; a recipient may be incapable of protecting the data; a notice may be unclear; a system may keep the input after the age decision; or a secondary use may quietly turn age-only processing into something else.
The package also explains why the policy is not a safe harbor in the broad sense of that phrase. It does not make an operator’s factual classification irrelevant. It does not authorize the collection of information for an unrelated purpose. It does not promise that consent, security, or deletion in one part of the flow cures a failure in another. And it does not supply a universal answer for a service whose design, audience, or data practices differ from the circumstances described by the FTC.
The right conclusion is modest but useful. The FTC has created room for certain general-audience and mixed-audience operators to determine age without first obtaining verifiable parental consent, but only when age determination is the sole purpose and the six conditions are respected. The policy makes age verification easier to deploy in a narrow setting; it does not make privacy analysis optional. The next question is what happens to the underlying image, biometric signal, identifier, or other information as it moves through that carefully limited process.