USA publishes updated Children’s Online Privacy Protection (COPPA) Rules
May 8, 2025 |
Children’s privacy is a strong focus of privacy regulators. The COPPA Rules have been in place for some time and do provide protection for use of children’s data and privacy online. They are quite effective in protecting children’s online privacy and have been relied on in taking action against companies who collect children’s data. In Australia there is no fit for purpose regulation dealing with the protection of children’s privacy. While the e Safety Commissioner has peripheral responsibility, dealing with the sharing of images, the Privacy Commissioner has primary responsibility through the Privacy Act 1988. Last year the Australian Parliament amended the Privacy Act to provide for a Children’s Online Privacy Code which will come into effect on 10 December 2026. Australia is definitely behind the regulatory best practice when protecting children’s data. To emphasise that point the US Government has updated the COPPA rules, which will take effect on 23 June 2025.
While the Australian Children’s Code will have its own focus and emphasis and operate within the strictures of the Privacy Act it is worth being across COPPA Rules. Australian Codes are drafted in very broad and general terms.
Features of the updated COPPA are:
- A new definition for the term ‘mixed audience website or online service’
- Modifications to definitions for terms such as:
- ‘online contact information’ to include telephone numbers; and
- ‘personal information’ to include government-issued identifiers and biometric identifiers;
- Limits on data retention, requiring operators to retain personal information as long as reasonably necessary to fulfill the specified purpose for which it was collected;
- Transparency requirements, requiring Safe Harbor programs to publicly disclose membership lists and report additional information to the FTC; and
- Opt-in consent rules for targeted advertising, requiring website and online service operators to obtain separate, verifiable parental consent before disclosing children’s personal information to third parties.