The Federal Trade Commission (FTC) is taking a stand on age verification technologies and protecting children’s privacy online. In a new policy statement released Wednesday, the agency clarified that it will not pursue enforcement actions under the Children’s Online Privacy Protection Rule (COPPA Rule) against websites and online service providers that collect and use personal data solely for age verification technologies, provided that strict security measures are followed.
See also: 21 states join FTC lawsuit against Uber
This move marks a practical change in how regulators approach the complex balance between privacy compliance and the actual safety of children online.
The FTC’s new policy statement aims to remove regulatory uncertainty that has long discouraged platforms from implementing age verification technologies. Under the COPPA Rule, entities must obtain verifiable parental consent before collecting personal information from children under 13. However, determining whether a user is a child often requires collecting some kind of personal data—creating a compliance dilemma for companies.
By clarifying its enforcement stance, the FTC is essentially encouraging platforms to adopt stronger age verification technologies rather than relying on outdated age self-reporting methods that are easy for children to bypass.
The policy reflects the reality that children's use of the internet has expanded dramatically since COPPA was first enacted in 1998. Today's digital ecosystem includes social platforms, gaming environments, streaming services, and artificial intelligence-powered applications—many of which were unimaginable when the law was originally written.
The FTC's position comes at a time when lawmakers around the world are questioning whether existing frameworks are sufficient to protect minors online. Several U.S. states have already begun introducing regulations requiring platforms to implement age verification technologies.
See also: FTC: Illuminate ordered to delete student data
The main issue is simple: platforms cannot protect children if they cannot reliably identify them.
Traditional age verification methods—such as asking users to enter their date of birth—have proven ineffective. More advanced age verification technologies now use biometric estimation, identity verification tools, or secure third-party validation systems to improve accuracy. However, these tools often require temporary collection of personal data, which has previously raised concerns about COPPA violations.
The FTC's updated enforcement approach attempts to resolve this contradiction.
While the FTC offers flexibility, the policy is far from a free pass. Platforms must comply with several strict terms when using age verification technologies, including:
- Use of collected data solely for age verification purposes
- Delete information immediately after verification
- Implementing strong security measures
- Providing clear transparency to parents and children
- Sharing data only with trusted third-party providers who are capable of maintaining confidentiality
- Ensuring that the verification method produces reasonably accurate results
Importantly, the FTC emphasized that entities must still comply with all other COPPA requirements when handling children’s data. This structured approach suggests that the agency is trying to promote responsible innovation rather than relax privacy protections.
See also: FTC: Senator calls for investigation into Microsoft's use of RC4
The FTC also confirmed that it plans to review the COPPA Rule to formally address age verification technologies, suggesting that this policy statement may be a transitional step toward broader regulatory updates. Ultimately, the FTC’s message is clear: identifying children online is becoming a regulatory expectation, not just a technical option.
