Is the Amended COPPA Rule Fully in Effect in 2026?

Yes, the amended COPPA Rule has been fully in effect since April 22, 2026, when the FTC's one-year compliance deadline passed for operators of child-directed sites and services. The amendments themselves took effect earlier, on June 23, 2025, but businesses had until April 22, 2026, to bring their actual practices into line.

What Changed for Determining "Directed to Children"

The amended rule expanded the factors the FTC weighs when deciding whether a site or service counts as "directed to children" — including the operator's own marketing and promotional materials or plans, its representations to consumers or third parties, and the ages of users on similar sites or services. That means a marketing plan built around a younger audience, or ad creative pitched at kids, can itself be evidence used to classify a site as child-directed, separate from the site's actual content.

Separate Consent Is Now Required for Ad Sharing

One of the amendments most directly relevant to marketers: operators must now get separate verifiable parental consent before disclosing a child's personal information to third parties for targeted advertising, on top of the initial consent for collecting and using that data. The FTC specifically said disclosures made for advertising purposes, for monetary consideration, or to train AI models don't count as "integral" to the service — so they can't be bundled into a single blanket consent. Direct notices to parents now also have to name the specific categories of third-party recipients and the purposes of each disclosure, and a parent's refusal to consent to third-party ad sharing can't be used as grounds to deny the child access to the service.

Safe Harbor Programs Had an Earlier Deadline

COPPA safe harbor programs faced their own, earlier deadline of October 22, 2025, to meet new disclosure requirements, including publicly disclosing their membership lists and providing records of disciplinary actions taken against members.

Enforcement Exposure Is Now Active

With the April 22, 2026, deadline passed, operators that haven't finished aligning their compliance programs with the amended rule now face active FTC enforcement exposure, not just a future compliance risk.

A Narrow Carve-Out for Age-Verification-Only Data

The FTC issued a policy statement saying it won't bring COPPA enforcement against general-audience or mixed-audience sites that collect data solely to determine a user's age, provided they follow specific safeguards — relevant to any business implementing age-gating rather than assuming all age-related data collection triggers full COPPA obligations.

Bottom Line

If any part of your marketing — targeting, creative, or promotional plans — could reasonably be read as aimed at an under-13 audience, treat your compliance program as subject to active enforcement now, and review your age-assurance approach against the FTC's narrow policy carve-out before assuming it covers you.

Sources: FTC, Children's Online Privacy Protection Rule amendments (effective June 23, 2025; compliance deadline April 22, 2026); Finnegan LLP, "COPPA's Amended Rule Is Now in Full Effect: What Operators Need to Know"; Hunton Andrews Kurth Privacy and Cybersecurity Law Blog, COPPA coverage.