COPPA Is Quietly Becoming the Backbone of U.S. Kids’ Online Safety

It is easy to treat the Children’s Online Privacy Protection Act as a relic. Enacted in 1998, never amended by Congress, limited to children under 13, and built on a notice-and-verifiable-parental-consent model that many companies still meet with a simple age gate, COPPA looks poorly matched to platforms that optimize for engagement, recommendation systems that surface content in real time, and a generation of users who treat age boxes as optional. State attorneys general have often acted as if they agreed. Many have preferred state unfair and deceptive practices statutes or newer comprehensive privacy laws that include explicit kids’ provisions, in part because those routes can keep cases in friendlier state courts and avoid the technical work of proving that a service is “directed to children” or that the operator had actual knowledge of child users.

Yet the last year of enforcement suggests the opposite conclusion. COPPA is not fading. It is being absorbed into a broader regulatory architecture for children’s online safety, one that treats personal data collection and product design as two sides of the same problem. The federal statute remains the sharpest tool for the privacy violation itself. State UDAP laws and emerging age-appropriate design requirements supply the leverage over features—default public profiles, unrestricted messaging, autoplay, algorithmic feeds—that use that data to keep young users engaged. The combination is more powerful than either approach alone.

Enforcement Has Always Linked Privacy and Safety

This linkage is not new. The Federal Trade Commission has long paired COPPA with its Section 5 authority. The 2019 Musical.ly (TikTok) order addressed both the collection of children’s data without parental consent and the design choices that made children easier to find and contact—public-by-default profiles and open messaging. The 2022 Epic Games settlement did the same: a COPPA claim for unauthorized data collection sat alongside a UDAP claim over live voice and text chat that was on by default and matching practices that exposed children to harassment and predatory contact. The order required stronger default privacy settings and affirmative consent before those features could be turned on. The more recent Disney action followed the pattern. Labeling child-directed YouTube videos as “Not Made for Kids” violated COPPA by enabling the collection and use of children’s information for targeted advertising; the FTC also treated the mislabeling as creating downstream safety harms through autoplay into unrestricted content and open comments.

What has changed is the explicitness with which enforcers now describe the connection. In the Meta multistate matter, the attorneys general’s theory was that Meta collected and used children’s data without verifiable parental consent in violation of COPPA, then used the resulting engagement data to refine features that maximized time spent on the platform. The data collection was not incidental to the alleged harm; it was the mechanism that made the engagement-maximizing design possible and profitable. COPPA supplied both the federal hook that allowed roughly 50 jurisdictions to litigate together and the substantive core of the case. The settlement’s age-assurance requirements, including commitments tied to a “U13 Age Model,” sit on top of that foundation. Releases for COPPA claims are carefully limited so that age information cannot be reused for advertising or algorithmic optimization.

Age Assurance Is the New Enforcement Priority

The FTC’s February 2026 Enforcement Policy Statement on age-verification technology makes the shift concrete. On its face, the statement clarifies how operators may collect limited information from children for age-assurance purposes without triggering a full COPPA violation. In practice, it is an incentive. Agency officials have been open that self-declared age gates provide little real barrier. The statement elevates technical methods—including predictive facial age estimation—while grounding the permitted collection in COPPA’s existing purpose-limitation, minimization, and retention rules. Subsequent settlements, including the Meta judgment and Alabama’s TikTok decree, cite the policy statement by name. Age assurance is no longer merely a defensive compliance step; it is becoming the operational requirement that makes both under-13 removal and teen protections enforceable.

This creates real operational demands. An age model that must meet specified false-positive thresholds, that can be audited, and that cannot leak its outputs into advertising or recommendation systems is a different engineering and governance problem from a checkbox. Companies that treat age assurance as a one-time product feature rather than an ongoing, documented control will find the settlements difficult to implement and future investigations difficult to defend.

Why the Architecture Matters

The practical effect is a layered regime. COPPA remains the federal privacy floor and the jurisdictional glue for multistate actions. UDAP theories reach design choices that exploit the data COPPA seeks to protect. Age-assurance expectations, now anchored in FTC guidance and settlement language, make the floor harder to evade. The result is more coherent than a pure “COPPA is outdated” critique suggests, even while Congress has failed to pass broader updates such as COPPA 2.0 or the Kids Online Safety Act.

It is also incomplete. COPPA still stops at 13. Many of the design harms that concern enforcers affect older teens. The statute’s “directed to children” and “actual knowledge” thresholds remain technical and fact-intensive. And heavy reliance on age assurance raises its own privacy and accuracy questions—questions the FTC’s policy statement tries to constrain but does not eliminate. Companies operating across multiple states will face the additional complexity of aligning federal COPPA obligations with state laws that sometimes set different age thresholds or impose design duties directly.

Still, the direction is clear. Nearly thirty years after Senator Richard Bryan warned that the online collection of children’s information could affect both their privacy and their safety, enforcers are treating the two as linked. Operators that continue to view COPPA as a narrow notice-and-consent box to check, while treating engagement features as a separate product decision, are misreading the current enforcement environment. The statute that was written to keep strangers from collecting children’s data is now being used to constrain the systems that use that data to hold children’s attention. That evolution is already shaping settlements, policy statements, and the practical requirements of age assurance. It is unlikely to reverse.