The Kids Online Privacy Protection Act – What Changed in 2026
Understanding COPPA and Why It Matters
The internet has always been a complicated space for children. From social media platforms to educational apps, kids are spending more time online than ever before. And with that comes real concerns about who is collecting their data, how it is being used, and whether parents have any say in the matter.
The Children’s Online Privacy Protection Act, better known as COPPA, has been the main law protecting kids’ privacy online in the United States since 1998. For a long time, it worked reasonably well. But the internet changed dramatically over the decades, and the original law simply could not keep up. That is exactly why the 2026 updates became so important.
This article breaks down what COPPA is, what changed in 2026, and what those changes mean for parents, kids, and the companies that build digital products.
A Quick Look at the Original COPPA Law
Before diving into the changes, it helps to understand what COPPA originally said. Passed in 1998 and enforced by the Federal Trade Commission (FTC), the original law required:
- Websites and apps to get parental consent before collecting personal data from children under 13
- Companies to post clear and honest privacy policies
- Parents to have the right to review and delete their child’s data
- Companies to keep children’s data secure and not hold it longer than necessary
These were solid rules for the late 1990s. But the digital world of 2026 looks nothing like it did back then. Social media, targeted advertising, artificial intelligence, and connected devices have completely transformed how data gets collected and used. The law needed a serious update.
What Changed With COPPA in 2026
The 2026 updates brought some of the most significant changes to children’s internet privacy law in the United States since COPPA was first written. Here is a look at the key changes:
The Age Limit Was Raised
One of the biggest and most talked-about changes was the expansion of COPPA’s age protections. The original law covered children under 13. The 2026 update extended that protection to cover teenagers up to the age of 16.
This change acknowledged a simple truth: teenagers are not fully grown adults when it comes to understanding how their data is used. A 14-year-old scrolling through social media does not necessarily grasp that every click, like, and search is being tracked and sold to advertisers. The updated law recognizes this gap and fills it.
Stronger Rules Around Targeted Advertising
The original COPPA law did not specifically address targeted advertising in a meaningful way. That loophole allowed companies to collect enormous amounts of behavioral data on young users and use it to serve them highly personalized ads.
The 2026 changes put a much harder stop to this practice. Companies are now prohibited from using personal data collected from users under 16 for targeted advertising purposes. This applies across platforms, including social media apps, gaming sites, and streaming services.
Clearer Consent Requirements
Under the old rules, getting “verifiable parental consent” was sometimes interpreted loosely. Some companies used simple checkboxes or email confirmations that were easy to bypass or ignore. The updated law tightened this up considerably.
Companies must now use more reliable consent methods that actually verify the identity of the parent or guardian. The FTC was given authority to approve and update acceptable consent methods as technology evolves, which means the rules can adapt without needing a full act of Congress every time something changes.
A Ban on Certain Dark Patterns
Dark patterns are design tricks that companies use to push users into giving up more data or agreeing to things they did not intend to agree to. Things like confusing menu layouts, pre-checked boxes, or making it very hard to find privacy settings are all examples of dark patterns.
The 2026 update explicitly bans the use of dark patterns when dealing with children and teenagers. Companies cannot use manipulative design choices to get around the spirit of the law. This is a meaningful step because it targets not just the written policies but the actual user experience.
Increased Penalties for Violations
The previous maximum fine under COPPA was around $50,000 per violation. Critics argued this was not nearly enough to deter large tech companies from cutting corners. The 2026 changes dramatically increased the penalties.
Fines can now reach into the millions of dollars per violation, with higher penalties for repeat offenders or companies that knowingly targeted children in violation of the law. This gives the FTC much more power to actually enforce the rules.
Data Minimization Requirements
A new concept built into the updated law is data minimization. This means companies can only collect the data that is actually necessary for the product or service they are providing. They cannot collect extra data “just in case” it might be useful later.
For children’s apps and websites, this is a significant restriction. Many platforms had been collecting vast amounts of data far beyond what their service needed. The updated law draws a clear line and requires companies to justify what they collect.
How These Changes Affect Parents
For parents, the 2026 updates offer more peace of mind and more control. Here is what you should know:
- Older teenagers are now protected: If you have a child between 13 and 16, they now have the same privacy protections as younger kids when it comes to how companies handle their data online.
- You have stronger rights to review data: The updated law reinforces and expands your ability to request, review, and delete data that has been collected on your child.
- Consent has to be real: Companies cannot rely on vague or easily bypassed consent methods. If your child signed up for something, the company needs genuine, verified parental consent to collect their data.
That said, parents still need to stay engaged. No law replaces the role of an involved parent when it comes to what kids do online. The updated COPPA gives you better tools, but using those tools still falls on you.
What This Means for Tech Companies
For companies that build apps, games, websites, or any digital products that children or teenagers might use, the 2026 changes come with serious responsibilities.
Compliance is no longer optional in any meaningful sense. The combination of higher fines, broader age coverage, and stricter rules around advertising and consent means that companies face real financial and legal risk if they ignore the updated law.
Many larger companies had already started updating their platforms in anticipation of the changes. Smaller developers, however, may find it harder to keep up. The FTC has indicated it plans to provide guidance and resources for smaller businesses, but the legal requirements still apply regardless of company size.
Companies will also need to rethink their business models if they relied heavily on targeting young users with personalized ads. Finding new ways to generate revenue without relying on behavioral data from minors is now a business necessity, not just a nice idea.
Common Questions About the 2026 COPPA Changes
Does this apply to all websites and apps?
The updated COPPA applies to any commercial website or online service that is directed to children under 16, or that knowingly collects personal data from users under 16. This covers a wide range of platforms, from gaming apps and social media to educational tools and streaming services.
What counts as personal data under the updated law?
Personal data includes obvious information like names, addresses, and phone numbers. But it also includes things like IP addresses, device identifiers, browsing history, location data, and even biometric data like facial recognition or voice prints. The updated law is quite broad in what it considers personal information.
What happens if a company breaks the rules?
The FTC can investigate and take enforcement action against companies that violate COPPA. As mentioned, fines have been significantly increased. Repeat violations or cases where companies knowingly disregarded the rules can result in even steeper penalties. In serious cases, the FTC can also require companies to change their business practices entirely.
Are there any exemptions?
There are limited exemptions in the law, mainly around things like nonprofit organizations and certain educational services. However, these exemptions are narrow and specific. Most commercial digital platforms do not qualify for exemptions.
The Bigger Picture: Why These Changes Matter
It is easy to look at regulatory changes like this as dry legal stuff that only lawyers need to care about. But the reality is that children’s privacy online is a real and growing concern that affects everyday families.
Studies have consistently shown that children and teenagers are some of the most heavily tracked users on the internet. Their data is collected, shared, sold, and used in ways that most families know nothing about. The 2026 COPPA changes are an effort to put guardrails around that reality.
They are not a perfect solution. Laws always have gaps, and enforcement is never guaranteed. But they represent a meaningful step toward treating children’s online privacy as something worth protecting rather than something to be exploited.
For parents, kids, and anyone who cares about how the next generation experiences the internet, these changes are worth paying attention to. The digital world is not going anywhere. Making it safer for young people is a responsibility that belongs to lawmakers, companies, and families alike.
Final Thoughts
The 2026 updates to COPPA reflect the reality that children’s privacy law had to grow up along with the internet. From raising the protected age to 16 and banning targeted advertising aimed at minors, to cracking down on manipulative design and raising fines for violations, the changes are substantial and meaningful.
Whether you are a parent trying to keep your kids safe online, a developer building the next big app, or just someone who wants to understand how internet law works, the updated COPPA is something that touches the digital lives of millions of people in the United States.
Staying informed is the first step. And now you know a little more about where things stand.
