The FTC widened parental-consent duties under its updated COPPA rule

The design

On 16 January 2025 the Federal Trade Commission announced it had finalized amendments to the Children's Online Privacy Protection Rule, the regulation that has required parental consent before a covered online service collects personal information from a child under 13 since it took effect in 2000 and was last revised in 2013. According to the FTC's own announcement, the amendments require operators to obtain separate, verifiable parental consent before disclosing a child's data to third parties for targeted advertising, cap how long personal data can be retained to what is “reasonably necessary,” and require FTC-approved Safe Harbor programs to publish more about how they operate. The final rule was published in the Federal Register on 22 April 2025 and took effect 23 June 2025.

What the evidence says

The FTC's own documents describe a general update to a rule that applies across online services, not an action against any named AI companion product; neither document mentions Replika, Character.AI, or any other companion app, so the connection to this archive's subject is regulatory backdrop, not a finding. FTC Chair Lina Khan's statement in the press release frames the amendments as closing gaps that let companies “share and monetiz[e] children's data without active permission,” a characterization from the agency itself rather than an independently measured before-and-after effect.

What it asks of people

A covered operator must now secure a parent's opt-in before third-party ad sharing, delete data it no longer needs for its stated purpose, and be more transparent about its Safe Harbor compliance program. None of this requires an operator to change its terms unless the rule's definitions of “operator,” “personal information,” or “actual knowledge” of a child user apply to it in the first place.

Privacy and safeguards

COPPA's protections attach only to a service “directed to children” or one with actual knowledge that a child under 13 is using it; companion apps that set an 18-and-over minimum in their own terms, as several covered elsewhere in this archive do, can argue the rule does not reach them even though a minor might still reach the product. The FTC's amendments do not resolve that gap, and neither cited document states whether the agency has evaluated any specific companion app's status under the rule.

• Does a stated 18-and-over minimum age remove a product from COPPA's reach if minors still use it?
• What would “actual knowledge” of a child user mean for a chatbot that never verifies age?
• Has the FTC applied the amended rule to any AI companion or chatbot operator since it took effect?

The amended rule strengthens a general floor for children's data, but the sources here describe policy text and an effective date, not an assessment of whether any companion product actually falls under it.