COPPA Rule (16 CFR Part 312), as amended 2025

Binding law — in force AI-adjacent law

Keep children's data in AI stores only as long as reasonably necessary, under a written retention policy (COPPA 2025)

16 CFR 312.10 · official text · In force: applies since 22 Apr 2026 · United States (federal) (US)

An operator may retain personal information collected online from a child only as long as reasonably necessary for the specific purposes it was collected for, must then delete it with reasonable measures against unauthorized access, may not retain it indefinitely, and must establish, implement and maintain a written data retention policy stating the purposes, the business need and a deletion timeframe, provided in its online notice (16 CFR 312.10, as amended in 2025; 'delete' in 312.2). For AI features that covers transcripts, voice recordings, images, embeddings and model inputs and outputs kept about a child. Detect child-directed code that stores AI transcripts, recordings or embeddings with no expiry or deletion.

Who it applies to

• Duty falls on: operator
• Operators of websites or online services directed to children under 13, or with actual knowledge that they collect a child's personal information, that keep children's personal information in AI stores (transcripts, recordings, images, embeddings, training sets), for children in the United States. The amended Rule is in force from 2025-06-23; the written retention policy and the bar on indefinite retention must be complied with by 2026-04-22.
• Not covered:
  • Nonprofit entities that would otherwise be exempt from coverage under Section 5 of the FTC Act (15 U.S.C. 45) are not operators (16 CFR 312.2, 'Operator')
• Whether it applies depends on facts outside the code; a person has to decide.

transcript = client.audio.transcriptions.create(model='whisper-1', file=audio)
db.child_messages.insert({'child_id': child.id, 'text': transcript.text})
index.upsert([(msg_id, embed(transcript.text), {'child_id': child.id})])

RETENTION = timedelta(days=CHILD_DATA_RETENTION_DAYS)  # from the written retention policy
transcript = client.audio.transcriptions.create(model='whisper-1', file=audio)
db.child_messages.insert({'child_id': child.id, 'text': transcript.text, 'expires_at': now() + RETENTION})
index.upsert([(msg_id, embed(transcript.text), {'child_id': child.id, 'expires_at': (now() + RETENTION).isoformat()})])
# purge_expired_child_data() runs daily over db, index and provider files

Rule id us-coppa.child-data-retention-limit-in-ai-stores · review status: primary source derived

Binding law — in force AI-adjacent law

Get separate verifiable parental consent before disclosing a child's data to a third party to train AI (COPPA 2025)

16 CFR 312.5(a)(2) · official text · In force: applies since 22 Apr 2026 · United States (federal) (US)

From the 2026-04-22 compliance date of the 2025 amendments, an operator must let the parent consent to collection and use of the child's personal information without consenting to its disclosure to third parties, unless the disclosure is integral to the service, and must obtain separate verifiable parental consent to such a disclosure (16 CFR 312.5(a)(2)). In adopting the amendment the Commission stated that disclosures to third parties to train or otherwise develop artificial intelligence technologies are not integral and need that separate consent (90 FR 16918, Part II.D.1.b). Detect child-directed code that exports children's data to a third-party training, fine-tuning or dataset path with no separate parental consent check.

Who it applies to

• Duty falls on: operator
• Operators of websites or online services directed to children under 13, or with actual knowledge that they collect a child's personal information, that disclose children's personal information to third parties, including to train or develop AI technologies, for children in the United States. The amended Rule is in force from 2025-06-23; the separate consent of 312.5(a)(2) must be complied with by 2026-04-22.
• Not covered:
  • Nonprofit entities that would otherwise be exempt from coverage under Section 5 of the FTC Act (15 U.S.C. 45) are not operators (16 CFR 312.2, 'Operator')
  • Disclosures integral to the website or online service (312.5(a)(2)); whether a given AI vendor disclosure is integral, or the vendor is a third party (312.2: not one that only supports internal operations), is for counsel
• Whether it applies depends on facts outside the code; a person has to decide.

rows = db.execute(text('SELECT id, user_id, prompt, reply FROM messages')).all()
write_jsonl('train.jsonl', [to_chat_example(r) for r in rows])
f = client.files.create(file=open('train.jsonl', 'rb'), purpose='fine-tune')
client.fine_tuning.jobs.create(training_file=f.id, model=BASE_MODEL)

rows = db.execute(text("""
    SELECT m.id, m.user_id, m.prompt, m.reply FROM messages m
    JOIN consents c ON c.user_id = m.user_id
    WHERE c.purpose = 'model_training' AND c.granted AND c.withdrawn_at IS NULL""")).all()
write_jsonl('train.jsonl', [to_chat_example(r) for r in rows])
f = client.files.create(file=open('train.jsonl', 'rb'), purpose='fine-tune')
job = client.fine_tuning.jobs.create(training_file=f.id, model=BASE_MODEL)
lineage.record(job_id=job.id, dataset_file=f.id, content_ids=[r.id for r in rows])

Related incidents

• FTC order requires Everalbum to delete face-recognition models trained on users' photos (2017-09; alleged (not proven)). The FTC alleged that Everalbum's Ever photo app enabled face recognition by default for most users and that, from September 2017 to August 2019, the company combined facial images extracted from users' photos with public datasets to develop its face-recognition technology, in part without affirmative express consent. Everalbum settled without admitting or denying the allegations; the final order (May 2021) requires deletion of face embeddings from users who had not consented and of any models or algorithms developed in whole or in part with Ever users' biometric information. Source: U.S. Federal Trade Commission (press release, 2021-05-07) · evidence grade: primary · cited by Train on user content only with consent specific to that purpose

Rule id us-coppa.separate-consent-before-child-data-to-third-party-ai-training · review status: primary source derived

Binding law — in force AI-adjacent law

Obtain verifiable parental consent before an AI feature collects or uses a child's personal information (COPPA)

16 CFR 312.5(a)(1) · official text · In force: applies since 22 Apr 2026 · United States (federal) (US)

An operator of a website or online service directed to children, or with actual knowledge that it collects personal information from a child under 13, must obtain verifiable parental consent before any collection, use or disclosure of the child's personal information (16 CFR 312.3(b), 312.5(a)(1)). Personal information includes a photograph, video or audio file containing a child's image or voice, persistent identifiers, and, since the 2025 amendments, biometric identifiers such as voiceprints and faceprints (312.2), so voice assistants, chatbots and image features that send what a child says or shows to a model need that consent first. Two exceptions matter for AI features: an audio file used only to answer the child's request and deleted immediately (312.5(c)(9)), and a persistent identifier used only for internal operations (312.5(c)(7)). Detect child-directed code that sends a child's input to a model with no parental-consent check.

Who it applies to

• Duty falls on: operator
• Operators of commercial websites or online services directed to children under 13, or with actual knowledge that they collect personal information from a child, whose AI features (voice assistants, chatbots, image, tutoring or game features) collect, use or disclose a child's personal information, for children in the United States. The consent duty predates the 2025 amendments; the amended Rule is in force from 2025-06-23 and operators must comply with the amendments (including biometric identifiers in 'personal information') by 2026-04-22.
• Not covered:
  • Nonprofit entities that would otherwise be exempt from coverage under Section 5 of the FTC Act (15 U.S.C. 45) are not operators (16 CFR 312.2, 'Operator')
  • An audio file containing a child's voice, and no other personal information, collected only to respond to the child's specific request, not used for any other purpose, not disclosed, and deleted immediately after responding (312.5(c)(9))
  • A persistent identifier and no other personal information collected only to support the internal operations of the service (312.5(c)(7))
• Whether it applies depends on facts outside the code; a person has to decide.

@app.post('/tutor')
def tutor(body: Ask, user=Depends(current_user)):
    age = years_since(user.birth_date)
    r = client.chat.completions.create(model=MODEL, messages=build(body, age))
    return {'reply': r.choices[0].message.content}

MIN_AGE_WITHOUT_PARENT = 14  # Law 132/2025 Art. 4(4)

@app.post('/tutor')
def tutor(body: Ask, user=Depends(current_user)):
    age = years_since(user.birth_date)
    if age < MIN_AGE_WITHOUT_PARENT and not consents.parental_consent(user.id, feature='tutor'):
        return {'status': 'parental_consent_required', 'consent_url': f'/parents/consent?child={user.id}'}
    r = client.chat.completions.create(model=MODEL, messages=build(body, age))
    return {'reply': r.choices[0].message.content}

Rule id us-coppa.verifiable-parental-consent-before-ai-collection · review status: primary source derived