No General Privacy Exemption: The Complete COPPA Judgment
The subject of this final synthesis is the relationship between the amended COPPA Rule and the FTC’s 2026 age-verification policy. The question is no longer whether an age gate can be useful; it can. The question is what that usefulness means legally and operationally. The most accurate answer is that age verification can reduce uncertainty about a visitor’s age and can receive a narrow, conditional enforcement treatment for certain age-only processing. It does not turn the service, the input data, or the rest of the operator’s privacy practices into a general exemption.
That conclusion follows from keeping several layers separate. COPPA first asks whether the service, a portion of it, or the operator’s known collection practice falls within the rule. A mixed-audience service may then use a neutral age-determination method to identify a visitor-level path. The FTC policy may affect one narrow form of age-only processing for certain general-audience and mixed-audience operators. But the information used to produce the age result still has a lifecycle, and the operator must still confront purpose, notice, disclosure, security, retention, deletion, consent, and necessity. Age verification is one part of that chain, not a substitute for it.
The answer is narrow by design
The word “exemption” hides three different questions. The first is a classification question: what kind of service is this, and what does the operator know? The amended rule retains a fact-based, totality-of-the-circumstances inquiry into whether a commercial website or online service, or a portion of it, is directed to children. It also reaches an operator with actual knowledge that it is collecting or maintaining personal information from a child. No single percentage of child users replaces that inquiry, and a general-audience label does not cancel a child-directed portion or known child collection.
The second question is a visitor question: how should this particular visitor be treated? A mixed-audience service is already one that is directed to children but does not target children as its primary audience. For that narrower category, the rule permits a neutral age screen or another reasonably calculated method to determine whether the visitor is a child. Before that determination, the service generally may not collect other personal information except for limited purposes in the rule’s consent exceptions. If the visitor is identified as under 13, the operator must follow the applicable COPPA notice and parental-consent requirements.
The visitor-level result does not rewrite the service-level facts. An age gate cannot manufacture a mixed-audience classification, turn a primarily child-directed service into a general-audience service, or erase actual knowledge. If a visitor is not identified as under 13, the mixed-audience rule creates a narrower visitor-level consequence. It does not make every other data practice harmless, and it does not answer what information the operator collected to reach that result.
The third question is a data-permission question: what information was collected, for what purpose, and under what authority? The FTC’s 2026 statement describes a limited situation in which certain general-audience and mixed-audience operators may collect, use, or disclose personal information solely to determine a user’s age without first obtaining verifiable parental consent, provided they satisfy the statement’s conditions. The statement says the Commission will not bring an enforcement action under the COPPA Rule in those circumstances. It does not amend the coverage definitions or create a permanent legal category called “age-verified service.”
The status of the statement is part of its meaning. It is an enforcement posture, not the same kind of authority as a statute or a final rule. The FTC says the statement remains effective until it publishes final rule amendments on age-verification mechanisms in the Federal Register or withdraws the statement. A later rule may change the landscape, and the statement’s own conditions remain tied to the facts of the processing. Treating a temporary enforcement position as permanent immunity is therefore inaccurate even before considering the data itself.
The purpose condition is the policy’s center of gravity. Information collected for age verification may not be used or disclosed for any purpose except determining a user’s age. That is not a statement that age determination is merely the operator’s preferred reason among several. It is a limit on the role the information may play. If the same collected image, identifier, template, or other input is also used to build a profile, support unrelated advertising, enrich an identity record, or serve another independent objective, the processing no longer fits the simple description of age-only collection.
The policy’s other conditions reinforce that boundary.