United States (federal) · regulation
COPPA: what it requires, and the records to keep
COPPA requires notice and verifiable parental consent before collecting, using or disclosing personal information from children under 13. The 2025 amendments, enforced from April 22, 2026, add separate parental consent for disclosures to third parties, including disclosures to train AI, plus written retention and security programs.
01 / What it requires
What COPPA requires
Operators of commercial websites, apps and online services (including AI chatbots) directed to children under 13, or with actual knowledge they collect personal information from children under 13.
- 01Post clear notice and get verifiable parental consent before collecting, using or disclosing a child's personal information.
- 02Get separate verifiable parental consent before disclosing a child's personal information to third parties, unless the disclosure is integral to the service.
- 03Keep and publish a written data retention policy; keep children's data only as long as reasonably necessary, never indefinitely.
- 04Establish, implement and maintain a written information security program suited to the sensitivity of children's data.
- 05Let parents review, delete and stop further use or collection of their child's information.
02 / AI work
Where it touches AI work
The FTC's 2025 rule preamble states that disclosing a child's personal information to train or otherwise develop AI is not integral to a service and needs separate parental consent. AI chatbots and voice features aimed at children are covered services.
03 / Dates
The dates that matter
COPPA enacted
Prior Rule amendments took effect
Amended Rule published, 90 FR 16918
Amended Rule effective
Compliance deadline for most amended provisions
04 / Enforcement
Who enforces it
FTC (violations treated as unfair or deceptive practices) and state attorneys general; civil penalties up to $53,088 per violation (2025 level, kept unchanged for 2026).
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Verifiable parental consent records, with separate third-party disclosure consent
- 02Written retention policy published in the online notice
- 03Written information security program and periodic risk assessments
- 04Inventory of third parties receiving children's data and their purposes
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
Does the 2025 COPPA amendment apply to our ed-tech tutor product?+
Yes, if the tutor is directed to children under 13 or you know it collects personal information from users under 13. The amended COPPA Rule, with compliance required since April 22, 2026, requires separate verifiable parental consent before you disclose a child's data to third parties, unless the disclosure is integral to the service. The FTC said disclosure to train or develop AI is not integral. The Rule also requires a written data retention policy and a written security program. Whether a school can consent for parents depends on existing FTC guidance, not new rule text. Read the full answer
How do we prove an under-13 AI tutor didn't retain student data after the 2025 COPPA Rule?+
You prove it with records of your own data practices. The amended Rule requires a written data retention policy stating why you collect children's data, the business need to keep it and when you delete it, and that policy must appear in your online notice. Keep deletion logs showing data was removed on schedule, your written information security program, and the contracts and deletion confirmations for any AI provider or other third party that received the data. The Rule allows keeping children's data only as long as reasonably necessary, never indefinitely. Read the full answer
Is there a COPPA school-authorization exception for ed-tech in 2026?+
Not in the rule text. The FTC proposed a codified school-authorization exception in 2024 but did not finalize it in the April 2025 amendments, to avoid conflicting with planned FERPA changes. It continues to enforce COPPA in ed tech under its existing guidance. Under that guidance a school may consent as the parent's agent only when the operator collects data for the use and benefit of the school and for no other commercial purpose. If the operator uses the data for its own purposes, such as training its products, it needs parental consent. Read the full answer
SOURCES
Go back to the source
Federal Register via GovInfo
Federal Register public inspection
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: COPPA for education AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4