If your media plan touches kids’ content, gaming, edtech or family-friendly YouTube, COPPA is no longer a legal footnote. It is a targeting constraint baked into every ad request.
PPC Land has published a detailed explainer on the Children’s Online Privacy Protection Act of 1998, and the timeline it lays out is a useful reality check for performance teams. Here’s the marketer’s version.
The clause that actually hurts
Everyone knows the headline: you cannot collect personal information from a child under 13 without notifying a parent and getting verifiable consent. The Federal Trade Commission writes and enforces the implementing Rule at 16 CFR Part 312.
The part that reshaped ad tech is quieter. Since the 2013 amendment, effective 1 July 2013, “personal information” includes persistent identifiers: cookies, IP addresses and unique device IDs. That single definitional change put behavioural targeting of under-13 audiences outside federal law.
Translation for buyers: an ad request from child-directed inventory arrives with no user-level identifier. What survives is contextual targeting and frequency capping. What does not survive is audience segments, lookalike modelling, retargeting and cross-site attribution.
Who is on the hook
Two operator categories fall inside the Rule. First, any commercial service directed to children, judged on a multi-factor test covering subject matter, animated characters, music, the age of models, child celebrities and even whether the ads on the service are themselves child-directed. Audience composition and marketing plans count as evidence.
Second, any general-audience operator with actual knowledge it is collecting data from an under-13 user. Crucially, a service also becomes child-directed when it knows it is collecting data from users of another child-directed service. That is how ad networks and analytics vendors get pulled in.
A formal mixed-audience category was defined for the first time in 2025 for services that meet the child-directed criteria without children as the primary audience.
The 2025 amendments changed the workflow
The Commission voted 5-0 on 16 January 2025 to finalise the first substantive revision since 2013. The amended Rule took effect 23 June 2025, with full compliance required by 22 April 2026. Four changes hit media buying directly:
- Separate consent for disclosure to third parties, including advertisers, unless the disclosure is integral to the service.
- Biometric identifiers — voiceprints, gait, facial templates, faceprints — are now personal information.
- No indefinite retention. A written retention policy is mandatory.
- Disclosure duties for anyone relying on the internal-operations exception, including the measures preventing behavioural use of the identifier.
That exception, at 312.5(c)(7), is the commercial lifeline: you may collect a persistent identifier and nothing else for support for internal operations, which explicitly covers contextual advertising and frequency capping. It cannot be used to build a profile or serve behavioural ads.
The plumbing keeps moving
Publishers and apps signal the condition through ad request parameters. Google’s long-serving tagForChildDirectedTreatment and tagForUnderAgeOfConsent flags were replaced on 18 May 2026 by a single age treatment tag, TFAT, which adds a TEEN value alongside CHILD and UNSPECIFIED. On YouTube, the uploader applies the “made for kids” audience setting — a platform mechanism, not a legal category.
Platforms are also guessing. Google began deploying machine learning age estimation in the US on 30 July 2025, switching off personalisation for accounts the model reads as belonging to minors.
Enforcement is real money
Civil penalties reach $53,088 per violation for penalties assessed after 17 January 2025, and state attorneys general can sue too. The record: $170 million from Google and YouTube in September 2019, $10 million from Disney in September 2025 for failing to designate child-directed videos individually, an FTC suit against toy maker Apitor days later, and a $400 million TikTok and ByteDance settlement announced by the DOJ on 21 August 2026.
What to do this quarter
Audit where child-directed or mixed-audience inventory sits in your buys. Confirm your stack sends the right TFAT value. Rebuild kids-adjacent campaigns around contextual classification — the model SuperAwesome took to Roblox as its sole global under-13 ad partner from 4 June 2026. And watch COPPA 2.0: the Senate passed it by unanimous consent on 5 March 2026, and it would push the protected age to under 17 and ban targeted advertising to that cohort. The House has not acted.
Plan as if contextual is the future for young audiences. Legally, for under-13s, it already is.
Source: PPC Land
