The Interactive Advertising Bureau’s new white paper, Protecting America’s Youth: A Balanced Framework for Modernizing Children’s Privacy Law, offers something increasingly rare in U.S. privacy debates: a thoughtful, evidence-based proposal that tries to protect children without pretending the ad-supported internet can simply be wished away.
Unlike many legislative efforts that treat all digital advertising as inherently suspect or impose blunt age cutoffs with little regard for developmental reality, the IAB framework distinguishes between three distinct risks — comprehension, product, and data — and matches each with a proportionate response. That distinction matters. It avoids the trap of overbroad rules that would starve legitimate content creators while still imposing meaningful restrictions where the risks are greatest.
A graduated approach grounded in developmental science
The IAB’s most significant contribution is its graduated consent model for targeted advertising:
- Under 13: Maintain the COPPA standard of verifiable parental consent.
- Ages 13–15: Require opt-in consent from the minor, with parental notification.
- Ages 16–17: Require opt-in consent from the minor.
This structure recognizes what developmental psychology has long shown: a 16-year-old is not a 6-year-old. Treating them the same way, as some state laws effectively do, is both poor policy and poor child protection. The IAB proposal aligns protections with actual capacity while still giving parents meaningful visibility for younger teens.
Practical standards instead of wishful thinking
The framework is equally clear-eyed on implementation realities. It supports an “actual knowledge” standard paired with a well-defined “willful disregard” test, rather than the vague “should have known” or strict liability approaches that some states have floated. It also calls for risk-based age assurance instead of one-size-fits-all verification mandates that would burden low-risk services and raise serious constitutional questions.
Most importantly, the IAB correctly identifies that the core privacy harm in this context is the use of children’s personal data for targeted advertising. Contextual advertising, which does not rely on profiling, remains available as a less intrusive alternative that still helps fund free content. This is the kind of nuanced thinking that has been largely missing from the conversation.
Why this matters beyond the advertising industry
While the white paper focuses on digital advertising, its underlying principles have broader relevance. The emphasis on data minimization across the full lifecycle, heightened diligence for youth data, clear age-appropriate notices, and practical deletion mechanisms reflects sound privacy program design that applies to any organization handling minors’ information.
Companies that currently scrape or collect data involving minors — whether for AI training, analytics, or product development — should pay close attention. The same expectations around documentation, legitimate interest assessments (or equivalent analysis), sensitive data controls, and safeguards against unintended use will likely appear in other contexts. The IAB framework essentially puts companies on notice that “we didn’t intend to collect that” will not be a sufficient defense if adequate filters and controls were not in place from the start.
A constructive alternative to the current patchwork
Perhaps the most valuable aspect of the IAB proposal is its implicit critique of the current U.S. landscape. We now have a growing thicket of state laws with inconsistent age thresholds, varying consent requirements, and different knowledge standards. This creates real compliance burdens without necessarily delivering better protection for children.
A national framework that standardizes age bands, clarifies the knowledge standard, and focuses restrictions on the actual use of personal data for targeting would be a significant improvement. It would also reduce the risk that overly aggressive state rules get struck down on First Amendment or other constitutional grounds, leaving children with less protection than intended.
The IAB has done something constructive here. It has acknowledged that children and teens deserve meaningful protections online while refusing to accept that the only way to achieve them is to dismantle the economic model that makes vast amounts of educational and creative content freely available.
Policymakers should take this framework seriously. Not because it comes from industry, but because it is more carefully reasoned and developmentally grounded than much of what has been proposed in statehouses over the past two years. The alternative — continuing down the path of fragmented, sometimes performative legislation — serves neither children nor the broader digital ecosystem well.
Companies should treat the IAB white paper as required reading. Even if it never becomes law, it articulates the kind of risk-based, proportionate approach that sophisticated privacy programs should already be moving toward. Those that wait for a regulator or plaintiff to force the issue will find themselves at a significant disadvantage.
The debate over how to protect children online is not going away. The question is whether we will approach it with the nuance and practicality this issue deserves, or continue settling for simplistic solutions that feel good but deliver little. The IAB has offered one of the better roadmaps yet. It would be a mistake to ignore it.