As the landscape of kids’ privacy regulation evolves rapidly at both the state and federal level, the Federal Trade Commission (FTC) has been clear that kids’ privacy is a priority. Indeed, Chairman Ferguson told Congress that enforcing the Children’s Online Privacy Protection Act (COPPA) is some of the agency’s “most valuable work,” and “protecting children and teens online is similarly of paramount importance” to this FTC.
Businesses that collect information from children and teens should be prepared for increased scrutiny by the FTC. Below we highlight potential areas of kids’ privacy enforcement by this FTC.
Statutory Enforcement: COPPA and the Take It Down Act
The FTC is responsible for enforcement of COPPA, which specifically governs children’s personal information, as well as the Take It Down Act, which is aimed at protecting minors in addition to adults.
COPPA was amended earlier this year, when the FTC adopted the first changes to the COPPA Rule since 2013. Certain elements of the amended law are likely targets for enforcement activity, including its notice and consent requirements and the compliance obligations for “mixed audience” services, both of which were expanded in the revised rule.
Covered website and online service operators must now obtain separate, verifiable parental consent to disclose children’s personal information to third-party companies for targeted advertising (or other purposes). And each of these separate notices must identify third-party recipients by name and category. Additionally, the updated rule introduces new methods for obtaining verifiable parental consent, including knowledge-based authentication, facial recognition tied to government ID, and SMS-based verification.
Chairman Ferguson has also indicated that COPPA’s limited age verification requirements are likely to be under a microscope, stating that “[t]he Commission should more aggressively enforce COPPA’s age verification requirements and encourage platforms to adopt robust gating tools that reflect the seriousness of their obligations to children.” Under the revised rule, certain websites and platforms directed to a mixed audience are limited to collecting personal information for only limited purposes prior to “collecting age information” or using a method “reasonably calculated, in light of available technology, to determine whether a visitor is a child.” Determining whether a website or online service is subject to these requirements can be a complex analysis that will depend on that website or service’s business practices. Websites and platforms directed to mixed audiences should carefully assess the applicability of the rule to their business practices.
In May 2025, Congress enacted the Take It Down Act, which is intended to combat online publication of nonconsensual intimate images, including images of minors. Key elements of this law will be enforced by the FTC. Specific areas of enforcement are likely to focus on “reasonable” compliance with takedown requests, as the law requires that covered platforms create a process for requesting the takedown of nonconsensual intimate images, and they must remove any such content within 48 hours of a request. Importantly, the legislation explicitly covers nonprofits, even if they may otherwise be exempt from FTC jurisdiction.
Both COPPA and the Take it Down Act authorize the FTC to obtain civil penalties of up to $53,088 per violation. They also represent an explicit congressional directive to protect privacy that the FTC is likely to prioritize.
Chatbots: A New Enforcement Frontier With Complex Considerations
At the FTC’s June 4, 2025 workshop, titled “The Attention Economy: How Big Tech Firms Exploit Children and Hurt Families,” several speakers raised concerns about the dangers of children interacting with chatbots online. Many of the speakers (including Commissioners and key enforcement decision-makers) specifically mentioned media reports of chatbots encouraging self-harm, suicide, and also having romantic and sexually explicit conversations with children.
This may be an area where the FTC looks more closely at enforcement and also addresses concerns through means other than enforcement. At the June workshop and at other events, Commissioner Holyoak has suggested the FTC may conduct an industry study to gather information (using compulsory requests) and issue a public report about AI chatbots “that simulate human communication and effectively function as companions.”
Age Gating: State Laws Could Also Increase FTC Enforcement Risk
Emerging state laws attempting to limit kids’ online access generally fall into two buckets: laws that restrict access to adult content, and laws that require app stores to verify age prior to downloading an app or using certain features within an app (such as in-app purchases). In the first bucket, several states have adopted laws that require publishers of certain content not intended for access by a minor (e.g., pornography) to undertake age verification practices. At the “Attention Economy” workshop hosted by the FTC, several speakers encouraged the FTC to enforce age-gating requirements against websites and platforms where children may be able to access content they deem inappropriate, using its broad authority to address unfair and deceptive acts and practices.
The “Attention Economy” workshop also featured discussion and support of state app store age verification laws, such as one recently enacted in Texas. Those laws typically require app stores to verify the ages of users and obtain parental consent for minors to download apps and make purchases for each download or transaction. These laws also impose various compliance obligations on app developers, including providing app stores with an age category for the app. App stores and developers should carefully consider and be prepared to support affirmative representations about the appropriate age for users of their apps or services to avoid a misrepresentation claim.
Children’s privacy is likely to be a priority of this FTC. Companies that provide online services to children should be prepared for increased scrutiny of their privacy practices.
[View source.]
