The Bottom Line
- There is increasing attention on age verification due to state level developments and ongoing efforts to address how online services determine user age.
- The FTC clarified that it will not pursue COPPA enforcement for age verification activities when operators meet specific conditions.
- Operators must strictly limit use, retention, disclosure, and security of information collected solely for age verification purposes, and the FTC plans to review COPPA to further address age verification technologies.
Among the myriad of privacy issues on the Federal Trade Commission (FTC)’s agenda, children’s privacy has long been front and center. It was therefore no surprise to see the FTC address the topic of age verification in its first privacy-related workshop of 2026 entitled the FTC’s Age Verification Workshop. This comes on the heels of amendments to the COPPA Rules.
Growing Focus on Age Verification Requirements
Age-verification technology is once again in the spotlight thanks to the number of states that have enacted laws aimed at protecting children and teenagers online. These include laws focused on age-appropriate design codes in California, Maryland, Nebraska, Vermont, and South Carolina, as well as social media regulations (many of which are currently being challenged on constitutional grounds), and expansions of comprehensive consumer privacy laws that regulate children’s and teens’ personal information. Some of these laws require websites and online services to use age verification mechanisms to help determine the age of users.
These requirements have created tension with the Children’s Online Privacy Protection Act (COPPA ), which prohibits operators of commercial websites or online services directed to children under 13, and operators who have actual knowledge they are collecting personal information from a child under 13, from collecting personal information from a child without providing a notice to parents/guardians and obtaining verifiable parental/guardian consent.
Addressing this tension at the FTC’s Age Verification Workshop, FTC Chairman Andrew Ferguson signaled in his remarks that a policy statement on age-verification technology would be forthcoming, with the possibility of further amendments to COPPA to promote the use of age-verification technologies.
FTC Releases Children’s Privacy Enforcement Statement
Fulfilling Chairman Ferguson’s promise and recognizing the legal inconsistencies surrounding age-verification tools, the FTC recently released a children’s privacy enforcement statement promoting the adoption of age-verification technology. The policy statement clarified that the FTC will not bring an enforcement action under COPPA against operators of general audience or mixed audience sites and services that collect, use, or disclose personal information for the sole purpose of determining a user’s age— provided they comply with the following conditions:
- do not use or disclose information collected for age verification purposes for any purpose except to determine a user’s age;
- do not retain this information longer than necessary to fulfill the age verification purposes, and delete such information promptly thereafter;
- disclose information collected for age verification purposes only to those third parties the operator has taken reasonable steps to determine are capable of maintaining the confidentiality, security, and integrity of the information, including by obtaining certain written assurances from those third parties;
- provide clear notice to parents/guardians and children of the information collected for age verification purposes;
- employ reasonable security safeguards for information collected for age verification purposes;
- take reasonable steps to determine that any product, service, method, or third party utilized for age verification purposes is likely to provide reasonably accurate results as to the user’s age; and
- comply with the COPPA requirements in every other respect with regard to personal information collected from children.
Additional Clarifications and Next Steps
The second requirement – that information collected for age verification should be promptly deleted after fulfilling such purposes – offers additional protection for children’s data such that it will not be retained in a way that could expose the child to unnecessary privacy risks.
The policy statement expressly states that it does not create any substantive rights or entitlements, and the FTC retains the right to investigate and bring actions for violations of COPPA in individual cases. The FTC also stated that it intends to initiate a review of COPPA to address age-verification mechanisms, which will require initiation of a notice and comment process. Accordingly, affected stakeholders can look forward to the opportunity to comment on any proposed changes.