COPPA

COPPA requires operators of websites and online services directed to children under 13, or with actual knowledge they are collecting from children, to obtain verifiable parental consent before collecting personal information, a term that explicitly includes persistent identifiers such as cookies, device IDs, and advertising identifiers. The FTC's amended COPPA Rule, published in April 2025, has been in full effect since April 22, 2026. It requires separate parental consent before disclosing children's data to third parties for targeted advertising, tightens data retention limits, and expands what counts as personal information. Civil penalties run to $53,088 per violation. For apps and connected TV services with a child audience, the question is which SDKs collect an identifier before any consent flow has completed, and the answer has to come from observing the app run, not from the SDK vendor's documentation.