When did the new COPPA rules take effect?

The amendments were published on April 22, 2025, took effect in June 2025, and had a compliance deadline of April 22, 2026.

What is the biggest COPPA change for games?

Operators need separate verifiable parental consent before disclosing children's personal information to third parties for non-integral purposes such as targeted advertising.

Can kids games still show ads under COPPA?

Yes, but targeted advertising to children generally needs separate parental consent. Most kids games use contextual advertising with networks configured for child-directed traffic, or avoid ads.

Do small studios need a written security program?

Yes. The amended rule requires a written information security program and a data retention policy appropriate to the size of the business and the data collected.

Does COPPA apply to general-audience games?

It applies if the game is directed at children under 13, or if the operator has actual knowledge it collects personal information from children under 13.

COPPA Rule Update 2026: What Kids Game Developers Must Do

The short answer

The FTC's amended COPPA Rule had a compliance date of April 22, 2026. Games directed at children under 13, or that knowingly collect their data, now need separate parental consent before sharing children's data with third parties for purposes such as targeted advertising, more detailed notices naming who receives data, and written security and data retention policies. If you have not reviewed your SDKs and ad setup since then, do it now. This is not legal advice.

Who COPPA applies to

COPPA applies to websites, apps and online services directed at children under 13, and to general-audience services that have actual knowledge they collect personal information from children under 13. Many casual, educational and family games fall into the first group, and games with large young audiences can fall into the second.

What changed

Area	New requirement
Third-party sharing	Separate verifiable parental consent before disclosing children's data to third parties for non-integral purposes, such as targeted advertising
Notices	Direct notices and privacy policies must identify third parties or categories receiving data, and why
Security	A written information security program appropriate to the data
Retention	A written data retention policy; keep data only as long as necessary, then delete it
Personal information	Expanded definition, including biometric identifiers
Consent methods	New options such as text plus, where data is not disclosed to third parties

Key dates

April 22, 2025: amendments published in the Federal Register.
June 2025: amendments took effect.
April 22, 2026: compliance deadline for most requirements.
February 2026: FTC policy statement on limited enforcement where data is collected only for age verification.

What it means for monetisation

Targeted advertising to children generally requires separate parental consent under the new rule, which most games will not obtain. In practice, games directed at children usually rely on contextual advertising, which uses the content being viewed rather than the child's data, along with ad networks configured for child-directed traffic, or move away from ads toward premium or parent-approved purchases.

Auditing your SDKs

Most COPPA problems in games come from third-party code. Analytics, ads, attribution, crash reporting and social SDKs can all collect identifiers.

List every SDK in the game and what data each collects.
Mark which are integral to running the game and which are not.
Configure child-directed settings in every SDK that supports them.
Remove SDKs that cannot be configured safely.
Update notices to name the third parties or categories and purposes.

Security and retention

Write down how you protect children's data: who can access it, how it is stored, how incidents are handled. Write a retention policy: what you keep, for how long and why, and how it is deleted. Then follow both. Small studios can keep these short, but they must exist and match what you actually do.

Parental consent flows

If your game needs consent, design the flow for parents, not children: clear language, a simple way to approve or decline, and a working game experience if consent is not given. Test it end to end. Platform tools help, including app store parental controls and the new age APIs described in app store age verification laws.

Mixed-audience games

Many games appeal to children and adults. If your game is directed at a mixed audience, you may be able to age-screen players and apply COPPA protections only to those under 13, but the screen must be neutral and must not encourage children to lie. Child players then get the protected experience: no targeted ads, limited data collection and parental consent where needed. Get legal advice on whether your game counts as directed at children, because content, art style, music and advertising all affect the answer.

Common problems we see

An ad SDK still collecting device identifiers in a child-directed game.
Analytics events that include free-text fields where children type names.
Privacy policies that do not match what the game actually collects.
No written retention policy, so data is kept indefinitely.
Social features switched on by default for young players.

Store rules add to COPPA

Apple and Google have their own rules for apps aimed at children, including limits on third-party analytics and ads in Kids categories and Families programs. Meeting COPPA does not automatically meet store rules, and vice versa. See app store rules for kids games.

A practical checklist

Decide whether your game is directed at children or has actual knowledge of child users.
Audit and configure every SDK.
Switch to contextual or child-safe advertising, or remove ads.
Update your privacy policy and direct notices.
Write and follow security and retention policies.
Test parental consent and the no-consent experience.
Get legal advice for your situation.

Getting help

We build educational and family games with privacy designed in from the start. See mobile game development and our educational game cost guide.

Sources: Federal Register: Children's Online Privacy Protection Rule (2025) · Davis Polk: new COPPA obligations take effect · Latham & Watkins: FTC publishes updates to COPPA Rule. Checked October 27, 2026.

COPPA rule update: what kids game developers must do