Data Protection Monitor
Global Privacy & Data Protection Intelligence

United States (US) · Module Detail

United States: Children & Vulnerable Groups

#

Children's protections are comparatively mature and actively enforced, but coverage is capped at under-13 federally (teens are not covered by COPPA) and dependent-adult protections are largely unaddressed.

Primary frameworkCOPPA Rule (16 C.F.R. Part 312, as amended 2025)
Supervisory authorityFederal Trade Commission (FTC)
Traffic-light rationale — AmberChildren's protections are comparatively mature and actively enforced, but coverage is capped at under-13 federally (teens are not covered by COPPA) and dependent-adult protections are largely unaddressed.

Sub-modules (5)

Age VerificationAmber

The FTC's February 2026 COPPA policy statement will not pursue enforcement against operators using personal data solely to determine a user's age via age-verification technology, subject to specified conditions.

Claims (1):

  • The FTC's February 2026 policy statement announces it will not bring COPPA Rule enforcement actions against general-audience and mixed-audience operators that collect, use, or disclose personal information solely to determine a user's age via age-verification technologies, subject to specified data-minimization and retention conditions.

Minor Profiling BansAmber

No general federal minor-profiling ban was identified; California's forthcoming age-assurance/parental-consent rulemaking under the Protecting Our Kids from Social Media Addiction Act is the most proximate state-level development.

Claims (1):

  • California's Attorney General's office has indicated it may soon begin rulemaking on age assurance and parental consent under the Protecting Our Kids from Social Media Addiction Act.

Education SettingsAmber

The FTC's 2025 COPPA amendments deliberately declined to adopt ed-tech-specific provisions, deferring to the pending FERPA amendment process at the Department of Education.

Claims (1):

  • The FTC's 2025 COPPA Rule amendments declined to adopt proposed changes relating to requirements applicable to educational technology companies operating in a school environment.

Dependent AdultsRed

No dependent-adult-specific data-protection provisions were identified in this research pass.

Absence provenance: unavailable. Searched: US federal dependent adult data privacy protections, elderly data protection statute US 2026.

Category narrative83 words

COPPA remains the anchor federal children's-privacy statute, applying to children under 13 and requiring verifiable parental consent; its 2025 amendments strengthen opt-in consent for third-party disclosure, add biometric/government-ID identifiers to 'personal information,' and increase Safe Harbor transparency. The FTC's February 2026 policy statement creates enforcement-discretion space for age-verification data use. California's Protecting Our Kids from Social Media Addiction Act is expected to be the subject of forthcoming AG rulemaking on age assurance and parental consent. Dependent-adult-specific protections were not identified in this pass.

Periodic update · new data 2026-09-28

Children & Vulnerable Groups

The FTC issued an Enforcement Policy Statement Promoting the Adoption of Age-Verification Technology on February 25, 2026, sustaining an active enforcement priority around protecting children online and signaling continued regulatory attention to age-verification mechanisms as a compliance tool for entities handling children's data. This is a non-binding guidance instrument rather than a rule, and it does not itself impose new binding obligations, but it indicates the direction the FTC intends to push compliance expectations for entities subject to children's-privacy obligations.

This sustained COPPA-adjacent enforcement priority continues a pattern of active federal attention to children's online privacy even in the absence of comprehensive federal privacy legislation covering the general population.

Outlook

Entities handling children's data should expect continued FTC attention to age-verification technology adoption as an enforcement and compliance-expectation priority. No new binding rule was identified this cycle beyond the February 2026 policy statement.

Sources and claims (2)
  1. ProbableFTC — The FTC's February 2026 policy statement announces it will not bring COPPA Rule enforcement actions against general-audience and mixed-audience operators that collect, use, or disclose personal information solely to determine a user's age via age-verification technologies, subject to specified data-minimization and retention conditions.observed
  2. ProbableIAPP — California's Attorney General's office has indicated it may soon begin rulemaking on age assurance and parental consent under the Protecting Our Kids from Social Media Addiction Act.observed