Open workspace

Guide · US federal law

COPPA: children, ads and the FTC's new rules

COPPA protects the data of children under 13 in the United States. In 2025 the FTC updated the rules and began requiring separate parental consent to pass data to third parties, including for advertising. See who must follow the law and how to tag content in AdSense and Ad Manager.

Audit my children's siteRead the guide
  • ✓Based on the FTC rule and Google Help Centers
  • ✓Examples of sites with ads, including Brazilian ones
  • ✓Read-only scan, no changes to the site
13years: below this age the child is protected by COPPA
$53,088maximum civil penalty per violation, an amount adjusted for inflation in 2025
Apr 22, 2026end of the deadline to comply with most of the rules updated in 2025
$275Mfine paid by Epic Games in 2022, the largest ever imposed for violating an FTC rule

What it is

A federal law to protect children online

The Children's Online Privacy Protection Act, or COPPA, is a US federal law from 1998. The FTC, the Federal Trade Commission, enforces it and writes the detailed rules. The FTC rule has applied since 2000, was expanded in 2013 and went through its biggest update in 2025.

The law applies to those who operate commercial websites, apps and online services directed to children under 13 that collect personal data from them. It also applies to general audience sites that actually know they are collecting data from a child, for example when the user themselves provides their age.

Ad companies, plugins and other third parties are also covered when they know they are collecting data from users of a site directed to children. And sites outside the United States must follow the law when they are directed to American children or when they know they collect data from them.

For those who live off ads, the central point is this: on a site directed to children, a cookie or device identifier is personal data. Using it for personalized ads requires verifiable parental consent.

Checklist

What you need to meet

What COPPA, the FTC rule and Google require of a site directed at children or that knows it collects data from children under 13.

  1. Clear policy on children's data

    Publish a clear and complete privacy policy on how the site handles children's data.

  2. Direct notice and verifiable parental consent

    Before collecting a child's personal data, notify the parents directly and get their verifiable consent, except for the exceptions in the rule.

  3. Separate consent for disclosure

    Since the 2025 rule, disclosing a child's data to third parties, including for targeted advertising, requires parental consent that is separate from the others.

  4. No behavioral advertising without the parents

    Cookies and device IDs are personal data, and they only skip consent when used for internal operations, never for behavioral advertising. Google also prohibits personalized ads for known children under 13 and on sites directed at them.

  5. Flag the content in Google

    Report a children's site through Search Console or mark each block with the age treatment. With the value 1, Google turns off personalized ads and remarketing.

    <ins class="adsbygoogle"
     data-ad-client="ca-pub-0000000000000000"
     data-ad-slot="0000000000"
     data-tag-for-age-treatment="1"></ins>

  6. Parents' rights

    Parents can see their child's data, ask for deletion, and stop further use and collection. Offer a simple way to do this.

  7. Keep only what is necessary

    Keep data only as long as needed for its purpose and delete it securely afterward. The 2025 rule prohibits keeping it indefinitely.

  8. Security and minimal collection

    Keep data confidential and secure, including when disclosing it. Do not require a child to provide more data than necessary to take part in an activity.

In practice

Right and wrong

Official tools

Certified CMPs and official links

For COPPA, Google does not ask for a certified CMP, and what it offers is the age treatment flag, so the links below lead to that and to the FTC.

Definitions

The concepts that decide whether the law applies to you

COPPA is applied based on these definitions. Getting one of them wrong is often the source of problems.

Child

Anyone under 13. Teens 13 or older are not covered by COPPA, although state laws may protect them.

Directed to children

The FTC looks at the whole picture: subject, visuals, animated characters, children's activities, music, age of models, the site's ads and, since 2025, marketing materials and reviews.

Mixed audience

A site directed to children that does not have children as its primary audience. Since 2025 it has its own definition and can ask for age before collecting data.

Personal information

Name, address, email, phone, photo, voice, location, persistent identifiers such as cookies and device IDs and, since 2025, biometric data and official documents.

Internal operations

Uses that do not require parental consent, such as keeping the site running, security, capping ad frequency and contextual ads. Behavioral advertising is not included.

Actual knowledge

When the site knows the user is under 13, for example from the age entered in a signup. From then on, COPPA applies to that user.

Parental consent and rights

Parents decide

Before collecting, using or disclosing a child's personal data, the site must notify the parents directly and obtain their verifiable consent. Verifiable means the site takes reasonable steps to confirm that the person authorizing is really a responsible adult, for example with a signed form, a card transaction, a call or video call with trained staff or an ID check.

The 2025 rule brought an important change for advertising. Passing a child's data to third parties, including for targeted ads, now requires separate parental consent, unless the transfer is an essential part of the service. Parents can authorize collection and refuse the transfer.

There are exceptions where consent is not required, such as responding once to a child's request and deleting the contact afterward, or using persistent identifiers only for the site's internal operations. Contextual ads and frequency capping fall under this exception; profiles and remarketing do not.

Parents can, at any time, see the data the site holds about their child, request deletion, revoke consent and prevent further collection. The site must offer a simple path for these requests.

Types of site

Directed to children or mixed audience

Both types are subject to COPPA. The difference is in what the site can do before it knows the age of who arrived.

Children as the primary audience

Coloring page sites, kids' games and videos for little ones. The FTC presumes every visitor may be a child.

  • Clear rules: treat everyone as a child
  • Contextual ads are still allowed
  • Simple age tag, applied to the whole site
  • No personalized ads for anyone
  • You cannot use an age screen to escape the law
  • Revenue per visit is usually lower

Mixed audience

Family sites or those with some children's content, where children are not the primary audience.

  • Can ask for age in a neutral way before collecting data
  • Adults and teens can receive personalized ads
  • Identified children receive child treatment
  • The age question cannot lead the answer
  • Must tag each ad request by age
  • Requires more careful setup

Obligations

What a site subject to COPPA needs to do

Most of the updated rules became mandatory on April 22, 2026.

Notice on the site

Publish a clear notice about the data you collect from children, how you use it, who you share it with and what rights parents have.

Direct notice to parents

Explain to parents, before collection, what will be collected and ask for consent, including the separate consent for passing data to third parties.

Retention policy

Have a written policy on retention of children's data, published in the notice, and keep the data only as long as necessary.

Security program

Maintain a written information security program proportionate to the size of the site and the sensitivity of the data.

Collect the minimum

Do not condition a child's participation in a game or contest on providing more data than necessary.

Control partners

Make sure partners that receive data maintain confidentiality and security, and know which tags run on children's pages.

Enforcement and fines

How much a mistake costs

The FTC and state attorneys general can sue those who violate COPPA. The fine is calculated per violation, and the amounts add up to a lot.

Fine per violation

The civil penalty ceiling is adjusted for inflation. In 2025 it went to 53,088 dollars for each violation.

YouTube, 2019

Google and YouTube paid 170 million dollars to the FTC and the state of New York for collecting children's data on kids' channels without parental consent.

Epic Games, 2022

The maker of Fortnite agreed to pay 275 million dollars for violating COPPA, the largest fine ever imposed for violating an FTC rule.

Disney, 2025

In September 2025, Disney agreed to pay 10 million dollars for not properly marking videos posted on YouTube as made for kids.

Timeline

From the 1998 law to the 2026 rules

The dates that weigh most for those with children's content and an American audience.

  1. 1998

    Law passed

    Congress passes COPPA and charges the FTC with writing the rules.

  2. April 21, 2000

    Rule in effect

    The first version of the FTC rule takes effect.

  3. July 1, 2013

    Identifiers enter the law

    Cookies and persistent identifiers become personal data, and ad networks become subject to the law.

  4. 2019

    YouTube case

    A 170 million dollar settlement leads YouTube to require creators to mark videos made for kids.

  5. January 16, 2025

    FTC approves the update

    The FTC announces the updated rule, with separate consent for passing data to third parties and retention limits.

  6. June 23, 2025

    Updated rule in effect

    The changes take effect, published in the Federal Register on April 22, 2025.

  7. April 22, 2026

    Compliance deadline

    The deadline for most companies to adapt to the new requirements ends.

For people with AdSense or Ad Manager

How to mark children's content at Google

  1. Know that the tag has changedGoogle retired the old child-treatment tags, known as TFCD and TFUA. The current tool is the age treatment tag, called TFAT, with the values 1 for child, 2 for teen and 0 for unspecified.
  2. Mark the whole site when it is for childrenFor a site directed to children, Google advises reporting this through Search Console. With the tag, Google turns off interest-based ads and remarketing for that content. Google itself may treat a site as child-directed even without notice from the publisher.
  3. Mark each request on mixed-audience sitesIn AdSense, use the data-tag-for-age-treatment attribute on the ad unit. In Ad Manager with GPT, use setPrivacySettings with tagForAgeTreatment before showing ads. The tag on the request takes priority over the site's tag.
  4. Understand the effect on revenueWith the child value, Google turns off personalized ads and remarketing, blocks calls to third-party ad vendors and applies ad protections for children. Revenue per visit tends to drop, but the site keeps monetizing.
  5. Review the other partnersTags from other networks, social network pixels and analytics tools also collect identifiers. On children's pages, keep only what falls under internal operations or has parental consent.
AdSense unit marked for child treatment (value 1). Replace the numbers with those from your account.
<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-0000000000000000"
     data-ad-slot="0000000000"
     data-tag-for-age-treatment="1"></ins>

In practice

What is and is not allowed with children's content

Common examples on Brazilian sites with kids' activities, games and videos that receive visitors from the United States.

Allowed

  • Showing contextual ads, tied to the page subject, on a coloring page site
  • Capping ad frequency with identifiers used only for internal operations
  • Asking for age in a neutral way on a mixed-audience site before collecting data
  • Marking with the child value the ad requests of those who said they are under 13
  • Asking for the parents' email to send the notice and obtain consent

Not allowed

  • Using remarketing or personalized ads on a site directed to children without parental consent
  • Asking for a child's name, photo or email to take part in a game without notice to parents
  • Building the age screen in a way that suggests an answer over 13
  • Passing a child's data to ad partners without the separate consent
  • Keeping children's data indefinitely

Common errors

Where sites slip up most

Common failures on sites with content for children and an American audience.

Thinking the law is only American

A Brazilian kids' activities site with many visitors from the United States can be considered directed to American children.

Continuing to use the old tag

The TFCD and TFUA tags were retired by Google. Old code must migrate to the age treatment tag.

Relying only on a 13-and-over notice

Writing in the terms that the site is for people over 13 changes nothing if the content, visuals and audience are for children.

Forgetting third-party tags

Marking Google as child-directed and leaving social network pixels and other ad networks collecting identifiers on the same pages.

Quizzes and contests that ask for too much data

Asking for a full name, photo or city for the child to take part requires parental consent and violates the principle of collecting the minimum.

No retention policy

Since 2026, the notice must include the written policy on retention of children's data. Many notices still do not.

In ConsentMode

What the audit checks about COPPA

  • Reads the page code and identifies whether AdSense units and GPT calls use the age treatment tag, and with which value.
  • Points out use of the old TFCD and TFUA tags, which must be replaced.
  • Lists pixels, tags from other networks and third-party cookies that fire on pages with children's content.
  • Checks whether the privacy notice talks about children, parents' rights and data retention.
  • Records forms, quizzes and age screens that collect data before any notice to parents.
Run an auditSee everything that is checked

Frequently asked questions

My site is Brazilian. Does COPPA apply to me?

It applies if the site is directed to children in the United States or if you know you collect data from American children. A kids' activities site in English with an American audience is the typical case.

Can I keep using AdSense on a children's site?

Yes. By marking the content as child-directed, Google shows ads without personalization and without remarketing. Revenue per visit is usually lower, but the site keeps monetizing within the law.

What changed with the 2025 rule?

Separate parental consent to pass data to third parties, including for targeted ads, a written retention policy, a written security program, a definition of mixed audience and the inclusion of biometrics among personal data.

Does COPPA protect teenagers?

No. COPPA applies to children under 13. Some state laws protect teenagers, and Google offers the teen value in the age tag for those who need it.

Is it enough to mark Google as child-directed?

No. The tag takes care of Google ads. Other networks, pixels, analytics and site forms also have to respect the law, and Google reminds publishers that its tools do not replace the publisher's legal obligations.

Who enforces?

The FTC, which can seek fines in court, and the state attorneys general, who can also sue on behalf of residents.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

Find out whether your children's pages are tagged correctly

The audit reads the page code, finds tags without an age tag and shows what to fix, without changing anything.

Start the audit