The Federal Trade Commission (FTC) announced it will not take enforcement action under the Children’s Online Privacy Protection Rule (COPPA) against certain operators using personal data solely for age verification.
The policy applies to general audience and mixed audience websites that meet strict data use, security, and deletion requirements.
The Commission signaled it will begin reviewing COPPA to formally address age verification technologies.
The Federal Trade Commission has issued a policy statement clarifying that it will not bring enforcement actions under the Children’s Online Privacy Protection Rule (COPPA) against certain website and online service operators that collect personal information strictly to determine a user’s age.
The move addresses growing uncertainty around age verification tools, which are increasingly being used to help shield children from inappropriate online content — but may require collecting personal data in the process.
COPPA, enacted in 1998, requires operators of commercial websites or online services directed to children under 13 — or those with actual knowledge they are collecting personal information from a child — to notify parents about their data practices and obtain verifiable parental consent before collecting, using, or disclosing that information.
Since COPPA became law, children’s use of internet-connected devices has expanded dramatically. In response to concerns about online safety, several states have begun requiring certain websites and online services to implement age verification mechanisms to determine users’ ages.
Potential conflict
However, discussions at a recent FTC workshop highlighted a potential conflict: some age verification technologies themselves require the collection of personal information from children, raising questions about whether operators using such tools could inadvertently violate COPPA.
The FTC’s new policy statement aims to resolve that tension.
“Age verification technologies are some of the most child-protective technologies to emerge in decades,” said Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection. “Our statement incentivizes operators to use these innovative tools, empowering parents to protect their children online.”
Under the policy, the Commission said it will not bring enforcement actions against operators of general audience or mixed audience sites that collect, use, or disclose personal information solely for age verification — even if they do not first obtain verifiable parental consent — provided they meet specific safeguards.
Those conditions include limiting the use of collected information strictly to determining a user’s age and not repurposing it for marketing or other activities. Operators must also delete the information promptly once age verification is complete and refrain from retaining it longer than necessary.
In addition, companies must disclose age verification data only to third parties that can maintain its confidentiality, security, and integrity, and they must obtain written assurances to that effect. Clear notice to parents and children about what information is being collected for age verification is also required.
The FTC further requires operators to implement reasonable security safeguards to protect the data and to take reasonable steps to ensure that any age verification method or third-party service they use is likely to produce reasonably accurate results.