Technical corrections only. The diff between v2 and v3 primarily involves a minor punctuation adjustment in Section 2(a)(6)(18)(B)(iii) related to exclusions for individual-specific advertising to children or teens. No substantive policy changes were made to the bill's operative provisions, maintaining the same framework for online privacy protections for children and teens.
Children and Teens’ Online Privacy Protection Act
- Sponsor
- Sen. Markey, Edward J. [D-MA]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Mar 16, 2026
Bottom line
This bill substantially strengthens online privacy protections for individuals under 17 by updating and expanding COPPA to address contemporary digital practices, imposing stricter data handling and advertising rules, and empowering young users with greater control over their personal information.
What it actually does
This bill significantly amends the Children's Online Privacy Protection Act of 1998 (COPPA) by expanding its scope to include 'teens' (individuals aged 13 to under 17) and broadening the definitions of 'operator' and 'personal information' to cover modern online services, applications, and connected devices. It prohibits individual-specific advertising to children and teens, introduces new requirements for verifiable consent, and grants children and teens enhanced rights to access, delete, and correct their personal data. The bill also establishes specific provisions for data collection in educational contexts and mandates studies and reports from the FTC and GAO.
Proponents argue
Supporters argue that the bill is crucial for safeguarding children and teens from exploitative online data collection practices and manipulative targeted advertising, which can leverage their developmental vulnerabilities. They emphasize the necessity of updating COPPA to encompass the full spectrum of digital platforms, including mobile applications and connected devices, and to provide both young users and their parents with more robust control over personal data in an evolving online landscape.
Opponents contend
Critics might contend that extending COPPA's stringent requirements to teens and broadening definitions could impede innovation within online services, particularly for platforms that serve a diverse user base. They may also voice concerns regarding the practical difficulties and increased costs for operators to implement new age verification and verifiable consent mechanisms, potentially resulting in reduced access to online content and services for younger users, or a shift to more restrictive age-gating for all users.
The bill is moderately long but clearly structured, allowing an informed reader to grasp its core changes within a reasonable timeframe.
Sec. 2(a)(1), amending 15 U.S.C. 6501(2)
Broadening the Scope of 'Operator'
This provision redefines the term 'operator' to explicitly include any person who, for commercial purposes, operates or provides a website, online service, online application, or mobile application. It clarifies that an operator is deemed to collect personal information if they directly collect it, allow another person to collect it directly from users, or allow users to publicly disclose it. The amendment also excludes certain nonprofit entities from this definition.
Supporters argue
Supporters argue that this expansion ensures privacy protections are applied to the full range of digital platforms that children and teens utilize today, effectively closing loopholes that previously allowed some entities to avoid COPPA's regulations.
Critics contend
Opponents may argue that this broader definition will increase compliance costs for a wider array of businesses, potentially disproportionately impacting smaller developers or startups who may struggle to meet the new regulatory demands.
Tradeoffs
The provision balances the need for comprehensive privacy protection across modern digital platforms against the potential for increased regulatory burden and compliance costs for a broader range of businesses.
Sec. 2(a)(3), amending 15 U.S.C. 6501(8)
Redefining 'Personal Information' to Include Biometric and Geolocation Data
This amendment significantly expands the definition of 'personal information' to cover a wider array of data types. It now explicitly includes persistent identifiers (such as IP addresses, device serial numbers, or unique device identifiers), photographs, videos, audio files containing a specific child's or teen's image or voice, geolocation information, and biometric data (like fingerprints, voice prints, facial templates, DNA, or gait). It also details specific exclusions for certain audio files and defines what constitutes 'support for the internal operations' of a website or application.
Sec. 2(a)(6), adding 15 U.S.C. 6501(17) and (18)
Extending Protections to Teens and Banning Targeted Advertising
This provision introduces the definition of 'teen' as an individual aged 13 to under 17, thereby extending COPPA's protections to this age group. Crucially, it defines and prohibits 'individual-specific advertising to children or teens,' which includes any marketing effort directed at a specific child or teen based on their personal information, profiling, or unique device identifiers. Specific exclusions are provided for contextual advertising or advertising in response to direct user requests, ensuring some forms of non-personalized advertising remain permissible.
Sec. 2(b)(2)(A), amending 15 U.S.C. 6502(a)(1)
Prohibiting Specific Data Practices and Limiting Retention
This amendment makes it unlawful for operators to collect personal information from children or teens in violation of prescribed regulations, or to use, disclose to third parties, or maintain such information for individual-specific advertising. It further prohibits collecting personal information unless it is consistent with the context of a transaction or service, or explicitly required by law. Additionally, it bans storing or transferring children's or teens' personal information outside the United States without explicit notice and restricts retaining such data longer than reasonably necessary to fulfill a transaction or provide a requested service, unless legally mandated.
Sec. 2(b)(3)(A)(iv) and (C), amending 15 U.S.C. 6502(b)(1)
Requiring Verifiable Consent for Teens and Granting Data Access/Deletion Rights
This provision mandates that operators obtain 'verifiable consent' from a parent (for a child) or the teen themselves (for a teen) before collecting, using, or disclosing personal information, and for any subsequent material changes to these practices. It also grants teens the right to access a description of their collected personal information, delete their data or content, challenge the accuracy of their information for correction, and obtain their personal information, mirroring rights previously available to parents for their children.
Sec. 2(b)(3)(C), adding 15 U.S.C. 6502(b)(3)
Streamlined Consent for Educational Contexts
This provision allows operators to forgo individual verifiable consent when acting under a written agreement with an educational agency or institution. This exemption is conditional: the operator must limit data collection, use, and disclosure solely to educational purposes, provide specific notices to the educational agency, and offer means for the agency to review and delete data. In turn, the educational agency must publicly identify the operator, provide notice of information practices, and facilitate parent/teen data requests.
Sec. 2(d), amending 15 U.S.C. 6502(d)
Clarifying Relationship with State Privacy Laws
This amendment clarifies that the provisions of this Act will preempt any State law, rule, or regulation only to the extent that such State law conflicts with a provision of this Act. Crucially, it explicitly states that nothing in this Act shall be construed to prohibit any State from enacting a law, rule, or regulation that provides greater protection to children or teens than the provisions of this Act.
Sec. 2(e)(3), adding 15 U.S.C. 6505(f)
FTC Guidance on Implied Knowledge of User Age
This provision requires the Federal Trade Commission (FTC) to issue guidance within 180 days on how it will determine 'knowledge fairly implied on the basis of objective circumstances' regarding whether a user is a child or teen. It explicitly states that operators are not required to affirmatively collect age information or implement age-gating or age verification functionality. The guidance itself will not confer rights or bind enforcement actions unless a specific violation of the Act is alleged, but State attorneys general must take it into account.
Sec. 3
Mandating FTC Reports on Application Oversight and Enforcement
This section mandates two types of reports from the Federal Trade Commission (FTC). Within three years, the FTC must submit an oversight report to Congress detailing how platforms ensure that child-directed applications comply with this Act and other FTC rules on unfair or deceptive marketing practices. Annually thereafter, the FTC must submit an enforcement report outlining the number of actions, investigations, complaints, and policy recommendations related to violations of the Children's Online Privacy Protection Act.
Sec. 4
GAO Study on Teen Financial Technology, Privacy, and Mental Health
This section directs the Comptroller General of the United States (GAO) to conduct a comprehensive study on the privacy and mental health implications for teens who use financial technology products. The study must identify the types of products teens are using, assess the potential risks to their privacy and mental health, and determine whether existing laws are sufficient to address these identified risks. The GAO is required to submit a report containing its findings and recommendations to Congress within one year of the Act's enactment.
This provision defines 'support for the internal operations' of a website, online service, online application, or mobile application. This definition is crucial because it outlines specific activities for which operators can use persistent identifiers (part of 'personal information') without requiring verifiable consent. These activities include maintaining functionality, network communications, user authentication, serving contextual advertising (with strict limits on identifier use), security, compliance, or fulfilling user requests. Importantly, it explicitly states that information collected for these internal operations cannot be used or disclosed for individual-specific advertising to children or teens, or for profiling.
Sec. 2(a)(3)(C), amending 15 U.S.C. 6501(8)(C)
Why it matters:This is standard legislative practice to define terms and exceptions within definitions sections, ensuring clarity on the scope of regulated activities. However, its technical nature makes it easy for a casual reader to overlook its significant operational implications.
Case for: Supporters argue that this definition is essential for allowing core website and application functions, such as security, performance analysis, and basic contextual advertising, to continue without triggering onerous verifiable consent requirements. This prevents unnecessary disruption of services while still safeguarding user privacy by prohibiting profiling and targeted advertising.
Case against: Critics might contend that even data used for 'internal operations,' if not meticulously managed, could potentially be aggregated or misused. They may also point out that the distinction between 'contextual advertising' and 'individual-specific advertising' can be nuanced and challenging to enforce in practice, potentially creating loopholes.
Estimated impact: This provision has significant implications for the operational continuity and technical implementation of online services, providing a framework for permissible data use without explicit consent for essential functions.
This 'Rule of construction' clarifies that the prohibition on 'individual-specific advertising to children or teens' does not prevent an operator from delivering advertising or marketing that is age-appropriate and intended for a child or teen audience. The crucial condition is that the operator must not use any personal information other than the knowledge that the user is under the age of 17 for this purpose.
Sec. 2(a)(6), adding 15 U.S.C. 6501(18)(C)
Why it matters:This is standard legislative practice to include clarifying language or carve-outs within complex definitions to address potential ambiguities or unintended consequences. While technically placed, its impact on advertising models is significant.
Case for: Supporters argue that this clarification allows operators to continue serving relevant, age-appropriate advertisements to younger audiences, thereby maintaining some revenue streams without resorting to exploitative personalized data tracking. It ensures that content providers can still monetize their services in a non-invasive way.
Case against: Some critics might argue that any advertising directed at children or teens, even if not 'individual-specific,' can be problematic due to the developmental vulnerabilities of these age groups. They might contend that this carve-out could potentially be exploited, or that the distinction between 'age-appropriate' and 'individual-specific' advertising could become blurred in practice.
Estimated impact: This provision has a moderately significant impact on advertising models that target younger demographics, allowing for a limited form of non-personalized advertising to continue.
This 'Rule of construction' specifies several limitations on the data deletion and correction rights granted to parents and teens. It clarifies that these rights do not limit law enforcement's authority to obtain data with a warrant, do not require operators or third parties to delete or correct information mandated for maintenance by other Federal or State laws, or information republished by another person. Furthermore, it does not prohibit operators from retaining minimal records for compliance with deletion requests, preventing security incidents or fraud, protecting system integrity, or ensuring data remains deleted.
Sec. 2(b)(3)(E), adding 15 U.S.C. 6502(b)(6)
Why it matters:This is standard legislative practice to clarify the scope and boundaries of newly established rights, ensuring they do not conflict with other legal obligations or essential operational functions. While technically phrased, these exceptions are critical for the practical implementation of data rights.
Case for: Supporters argue that these limitations are essential to ensure that individual data deletion rights do not inadvertently undermine critical functions such as law enforcement investigations, compliance with other legal mandates (e.g., financial record-keeping), or the fundamental security and integrity of online services.
Case against: Some privacy advocates might view these exceptions, particularly regarding information republished by others or retained for security, as potentially weakening the 'right to be forgotten' for children and teens, making it harder for them to fully erase their digital footprint.
Estimated impact: This provision has significant implications for balancing individual privacy rights with broader legal, security, and operational necessities, defining the practical limits of data deletion.