Copy of The COPPA 2.0 Briefing: Navigating the New Federal Frontier for Teen Privacy (2026 Update)

Originally Posted on LinkedIn March 9, 2026

Status: Passed unanimously in the Senate, pending House action

Last updated: July 23, 2026

BLUF: The Senate’s unanimous passage of COPPA 2.0 shows bipartisan agreement that a 1998 children’s privacy law, built for dial-up internet, no longer fits a world of social media, mixed-audience platforms and AI driven advertising. If enacted, COPPA 2.0 would extend protections to everyone under 17, tighten the “knowledge” standard for covered services, ban behavioral advertising to minors, strengthen FTC enforcement and shift how platforms and data brokers handle youth data across the United States.

Key facts

• COPPA, enacted in 1998, protects children under 13 by requiring notice and verifiable parental consent before covered online services collect, use or disclose their personal information.
• COPPA 2.0, the Children and Teens’ Online Privacy Protection Act, extends protections to users under 17, bans targeted advertising to children and teens, adds data minimization duties and creates an “eraser button” for minors’ data.
• The bill updates COPPA’s “actual knowledge” standard by covering services that have actual knowledge or “knowledge fairly implied on the basis of objective circumstances” that they serve children or teens.
• COPPA 2.0 would create a Youth Privacy and Marketing Division at the FTC, codify a Digital Marketing Bill of Rights for Teens and tighten rules on transfers of teen data, including to data brokers.
• The Senate passed COPPA 2.0 unanimously in March 2026 after a 2024 package with the Kids Online Safety Act passed 91–3 but stalled in the House, which is balancing COPPA 2.0 against broader privacy legislation such as the American Privacy Rights Act and alternative youth bills like the KIDS Act.
• FTC enforced COPPA violations can lead to civil penalties over 50,000 dollars per violation, adjusted periodically for inflation, and each affected child or unlawful data collection event may count as a separate violation.
• Supreme Court decisions including Reno v. ACLU, Brown v. Entertainment Merchants Ass’n and Ashcroft v. ACLU, as well as Ninth Circuit rulings on the California Age-Appropriate Design Code, define constitutional limits on online youth safety and design-based regulations.

Why this matters to you

For families, COPPA 2.0 is about how much data platforms can collect on children and teens, how that data feeds recommendation algorithms and what kinds of ads and content are optimized for their attention. For companies, it represents a structural shift in federal law affecting product design, age assurance, advertising models and data-sharing arrangements, while interacting with the First Amendment, Section 230 and evolving state and international regimes.

COPPA 1.0: the current federal baseline

The original COPPA applies to operators of websites and online services that are directed to children under 13 or that have actual knowledge they are collecting personal information from a child. It requires clear notice of data practices, verifiable parental consent for most data collection, parental access and deletion rights and reasonable data security and retention limits.

Enforcement resides primarily with the Federal Trade Commission and state attorneys general, and COPPA does not generally provide a private right of action, which means individual families cannot usually sue under COPPA itself and must rely on regulators or other legal theories. COPPA was crafted for a pre-smartphone era and does not directly address teen privacy, algorithmic feeds or cross site ad tech ecosystems.

Why COPPA 2.0 exists

Teens aged 13–16 are now among the heaviest users of social media, gaming and video platforms, yet they have no COPPA specific protections even as they are profiled and targeted by sophisticated advertising and recommendation systems. Many enforcement actions involve mixed-audience platforms such as large video sharing, social and gaming services that do not market themselves as child-directed but nonetheless attract substantial youth audiences.

Lawmakers and regulators view the strict “actual knowledge” standard as an enforcement gap because platforms can often infer that they serve many minors while maintaining legal deniability by not asking users’ ages. COPPA 2.0 addresses these realities by expanding coverage to everyone under 17, revising the knowledge standard and building a statutory framework for teen privacy and marketing.

Old COPPA versus COPPA 2.0

Core features of COPPA 2.0

COPPA 2.0 would give teens aged 13–16 statutory privacy protections comparable to those previously reserved for children under 13, while preserving parental consent requirements for younger children. Key elements include:

• Revised knowledge standard: The bill applies to services that have actual knowledge or “knowledge fairly implied on the basis of objective circumstances” that they serve users under 17, a constructive knowledge standard (essentially a “should have known” threshold) that significantly broadens compliance obligations.
• Digital Marketing Bill of Rights for Teens: This framework limits collection, retention, use and transfer of teen data for marketing, including restrictions on the sale or sharing of teen data with data brokers and third party advertisers.
• Ban on behavioral ads to minors: Covered operators may not use personal information to serve individual specific behavioral advertising to children or teens or allow others to do so, while contextual advertising based on the content being viewed, rather than the user’s history, remains permitted as a safe harbor.
• Eraser button and minimization: Companies must provide accessible deletion tools for minors’ data and are limited to collecting what is reasonably necessary to provide the requested service, with stricter retention rules.
• FTC structure and rulemaking: COPPA 2.0 creates a Youth Privacy and Marketing Division at the FTC and expands FTC rulemaking authority to set detailed regulations governing teen data practices and digital marketing.

Many major platforms have already started implementing stricter defaults for teen accounts, limiting certain ad categories and offering parental dashboards and time limits, in part to anticipate these kinds of obligations and in part in response to public and regulatory pressure.

Legislative history, House friction and preemption

Senator Ed Markey and Senator Bill Cassidy reintroduced COPPA 2.0 to update the privacy framework for children and teens in light of modern online harms and data practices. In 2024, the Senate passed a package including COPPA 2.0 and the Kids Online Safety Act by a vote of 91–3, but the House did not complete action before adjournment.

In this Congress, the Senate again passed COPPA 2.0 by unanimous consent, while the House considers how the bill fits alongside the American Privacy Rights Act, which would create a broader federal privacy framework, and alternative youth proposals such as the KIDS Act, which some members see as more flexible for smaller platforms. One central issue is preemption: whether COPPA 2.0 should preempt stricter state youth privacy and design laws, such as California’s Age-Appropriate Design Code or Utah style social media restrictions, or instead set a federal floor that states can exceed. That federal–state balance, combined with the choice between a standalone youth bill and a single comprehensive privacy statute, and the House Energy and Commerce Committee’s gatekeeper role, is a major reason the House process has been slower.

Enforcement and penalties

The FTC can seek civil penalties for COPPA violations that currently exceed 50,000 dollars per violation, adjusted periodically for inflation from earlier statutory baselines. Each affected child or unlawful data collection event may constitute a separate violation, so misconfigured systems that touch large numbers of minors can quickly create substantial exposure.

COPPA 2.0’s expansion of coverage to teens, its clarified standards and its new Youth Privacy and Marketing Division, along with the FTC’s own 2025 COPPA Rule updates addressing retention, targeted advertising and educational technology, signal that regulatory expectations are rising even before the statute is amended. Companies are already adjusting data practices to comply with the updated COPPA Rule, and COPPA 2.0 would layer additional obligations for teen data and marketing on top of those changes.

First Amendment, design-based regulation and states’ rights

The Supreme Court’s internet speech decisions shape the constitutional boundary for youth online safety laws. In Reno v. ACLU, the Court struck down broad indecency restrictions in the Communications Decency Act; in Brown v. Entertainment Merchants Ass’n, it invalidated limits on minors’ access to violent video games; and in Ashcroft v. ACLU, it rejected federal age verification mandates for online adult content.

In 2024, the Ninth Circuit affirmed in part and vacated in part a preliminary injunction against California’s Age-Appropriate Design Code, finding that some design and impact assessment requirements likely burdened protected speech and remanding others for further analysis. These rulings mean that both Congress and states must craft youth protections that regulate data and design in ways that are tightly linked to legitimate interests, rather than broadly restricting content or imposing heavy age verification. COPPA 2.0 reflects that approach by focusing on data practices and marketing, but future litigation will test how far design-based obligations can go.

Section 230 and platform responsibility

Section 230 generally shields online services from liability for user generated content and for good faith moderation choices, but it does not override federal privacy and consumer protection laws such as COPPA. COPPA and COPPA 2.0 focus on platform conduct: collecting, using, retaining and sharing minors’ personal information and targeting ads, rather than imposing liability for the content users post.

Recent litigation trends, however, frame claims around “algorithmic design” and “engagement maximizing” features as product defects to sidestep Section 230 and focus on design rather than speech. COPPA 2.0 will exist against this backdrop, and courts will need to distinguish between legitimate enforcement of youth privacy and design standards and attempts to impose speech based liability under a different label.

Age assurance, age verification and mixed-audience services

In practice, stronger youth protections require some way to distinguish minors from adults. Policymakers increasingly use “age assurance” to describe a spectrum of methods, from estimating age based on usage patterns to verifying age through government IDs or third party checks. “Age verification” typically refers to the most intrusive end of that spectrum, where users must present formal credentials to gain access.

Several states have adopted age verification laws for pornography or social media that rely on more intrusive methods, and these laws have faced challenges under the First Amendment and privacy doctrines. COPPA 2.0 is likely to push platforms toward more systematic age assurance, especially for mixed-audience services, which raises practical questions about how to protect both minors’ and adults’ privacy while meeting compliance expectations.

Domestic and international comparisons

States are already experimenting with their own youth protections, including age-appropriate design codes and youth specific privacy provisions in broader state privacy laws. Many of these laws impose design and risk assessment obligations for services likely to be accessed by children, which overlap conceptually with COPPA 2.0’s focus on services reasonably likely to be used by minors.

Internationally, GDPR’s child specific provisions and the United Kingdom’s Age Appropriate Design Code require high privacy defaults, limits on profiling and attention to how design choices affect children, and many large platforms have applied UK style protections more broadly.

Beyond Europe, Indonesia has just announced one of the most aggressive approaches to youth online safety, banning social media accounts for anyone under 16 on “high risk” platforms such as YouTube, TikTok, Facebook, Instagram, X, Bigo Live and Roblox, with account deletions scheduled to begin March 28. Officials there frame the move as a response to pornography, cyberbullying, online fraud and addiction and describe it as a way to ensure parents are not “fighting algorithmic giants alone,” highlighting how some governments are turning to outright access restrictions rather than the data and design focused model embodied in COPPA 2.0.

COPPA 2.0 would bring U.S. federal law closer to these international approaches by explicitly recognizing teens, limiting behavioral advertising and emphasizing design and data practices for youth, while U.S. constitutional constraints and federal–state dynamics remain distinct.

AI, profiling and recommendation harms

Artificial intelligence underlies how platforms infer age, recommend content and optimize advertising, often by profiling users based on a wide range of behavioral signals. Profiling minors feeds recommendation algorithms that can amplify harmful or addictive content, which is one reason lawmakers are targeting the data and marketing incentives that support these systems.

Generative AI further complicates youth privacy because prompts and outputs may include sensitive information, and models trained on minors’ data can be used to support unrelated commercial services. By emphasizing minimization, teen specific marketing limits and a dedicated FTC division, COPPA 2.0 sets a baseline framework that future AI specific rules can build on as youth focused AI services and risks evolve.

What COPPA 2.0 means for compliance and design

For in house counsel, privacy officers and product teams, COPPA 2.0 translates into concrete tasks. Priorities will likely include:

• Age assurance and audience assessment: Designing age assurance methods that minimize new data collection and documenting when services are “directed to” or “reasonably likely to be used by” children or teens, especially for mixed-audience platforms.
• Data mapping, minimization and retention: Identifying all data flows involving users under 17, applying stricter minimization and retention rules and segmenting teen data where possible.
• Advertising and data broker relationships: Auditing ad tech stacks and data sharing arrangements to ensure minors’ data is not used for targeted behavioral advertising or sold or shared in ways inconsistent with the Digital Marketing Bill of Rights for Teens.
• User facing tools and eraser buttons: Implementing deletion and preference tools that minors and parents can understand and use, backed by governance processes that reliably execute those requests.
• Monitoring safe harbors and guidance: Watching how COPPA “safe harbor” programs and FTC guidance evolve, as COPPA 2.0 is expected to tighten transparency and standards for these programs, which many companies rely on for structured compliance.

Companies that align early with both the updated COPPA Rule and COPPA 2.0’s core concepts will be better positioned to manage risk and influence how regulators interpret ambiguous provisions.

Key takeaways for the public

• COPPA 2.0 would move U.S. youth privacy law from an under 13 model to a framework that treats everyone under 17 as deserving heightened protection from pervasive tracking, profiling and targeted behavioral advertising.
• The shift to a “knowledge fairly implied” standard and coverage of services reasonably likely to be used by minors targets mixed-audience platforms that have substantial youth use even if they are not branded as child-directed.
• A new Youth Privacy and Marketing Division, a Digital Marketing Bill of Rights for Teens, stricter COPPA Rules and inflation adjusted penalties over 50,000 dollars per violation together signal a new era of focused youth privacy enforcement.
• First Amendment decisions and Ninth Circuit rulings on California’s Age-Appropriate Design Code confirm that data and design regulations for minors must be carefully tailored and that federal law will coexist with, and sometimes constrain, state experiments.
• The House Energy and Commerce Committee’s debate over preemption, the American Privacy Rights Act and alternative youth bills like the KIDS Act will determine whether COPPA 2.0 becomes law on its own, as part of a comprehensive privacy framework, or not at all.
• For families, COPPA 2.0 would likely mean fewer behavioral ads aimed at minors, more meaningful deletion tools and more age related prompts; for platforms, it would mean treating youth privacy and platform design as core legal obligations rather than optional product features.