The Children's Online Privacy Protection Act (COPPA) and its implementing Rule require operators of online services directed at children under 13, or who have actual knowledge of collecting information from children under 13, to obtain verifiable parental consent before collecting personal information. The Rule also restricts retention and use, and prohibits conditioning a child's participation on disclosing more information than is reasonably necessary.
The 2024–2025 COPPA Rule amendments tightened restrictions on personalized advertising to children, clarified treatment of biometric and inferred data, and extended the framework to ed-tech and AI-driven services. AI products that train on children's data without verifiable parental consent run squarely into COPPA enforcement.