COPPA for AI Products That Serve Children or Process Their Information

By Hank FasthoffSeptember 11, 2026

AI products receive information through typed messages, voice recordings, uploaded files, and connected accounts. A product that accepts those submissions from a child collects information from the child, while a product that receives a child’s schedule through a parent’s connected calendar collects that information from the parent.

The Children’s Online Privacy Protection Rule governs covered collection of personal information online from children under 13. Its application depends on the product’s audience, the source of the information, and what the operator knows about its users. The FTC’s 2025 amendments took effect June 23, 2025, with most amended requirements subject to an April 22, 2026 compliance deadline.

The AI Products COPPA Covers

COPPA applies to operators of websites and online services directed to children under 13 that collect personal information from them. It also applies to general audience operators with actual knowledge that they’re collecting personal information from a child under 13.

The factors in § 312.2 include subject matter, visual content, animated characters, activities, language, advertising, and evidence about the audience. An AI product marketed to elementary school children is directed to children. Describing a product as educational, without identifying its intended audience, doesn’t resolve the classification. A product marketed to adults preparing for professional exams targets adults.

Information supplied by an adult requires a different analysis. The FTC’s COPPA guidance states that the Rule doesn’t cover information collected from parents or other adults about children. A parent’s upload of a child’s schedule therefore doesn’t, by itself, trigger COPPA.

If the product also collects personal information through features children use, the operator must assess that collection separately. COPPA applies when those features are directed to children under 13 or the operator has actual knowledge that it collects personal information from users under 13. Collection includes persistent identifiers obtained through analytics or other tracking, even on a screen that accepts no typed input.

A mixed audience service is directed to children under the Rule’s factors but doesn’t target them as its primary audience. It may use a neutral age screen before collecting personal information to distinguish children from older users and apply the required protections.

COPPA doesn’t require a general audience operator to ask every user’s age. Once the operator learns that a user is under 13, it has actual knowledge of the user’s age and must apply COPPA to its collection of personal information from that user.

Personal Information in an AI Product

The Rule’s definition of personal information includes names, contact information, certain persistent identifiers, precise geolocation, and files containing a child’s image or voice. The amendments also added government issued identifiers and biometric identifiers that can be used for automated or partly automated recognition of an individual. A voiceprint used to recognize a child is one example.

A child submits information to an AI product by typing a message, recording audio, or uploading a file. A typed message containing the child’s full name or an audio file containing the child’s voice is personal information under the Rule. Information about the child or the child’s parents also falls within the definition when the operator collects it from the child and combines it with a listed identifier.

An operator must assess saved conversations, user profiles, uploaded files, and session summaries alongside registration fields. Removing a name from a message doesn’t remove other personal information, such as a voice recording or a persistent identifier associated with the submission.

COPPA also covers passive collection. An analytics tool that receives a qualifying persistent identifier from a child’s session collects personal information even though the child never entered a name. The operator must account for collection through its vendors as well as information it receives directly.

The Internal Operations Exception

Section 312.5(c)(7) permits collection of a persistent identifier, with no other personal information, without prior parental consent when the collection is solely to support internal operations. Permitted purposes include maintaining or analyzing the service’s functioning, authentication, specified personalization, security, contextual advertising, legal compliance, and fulfilling a child’s request. Using the information for a purpose outside the Rule’s permitted purposes defeats the exception.

Bot detection used to protect the service’s security or integrity qualifies as an internal operations purpose. Using the information to develop unrelated products or build profiles for purposes the Rule doesn’t permit falls outside the exception. The operator must assess both the data collected and every purpose for which the vendor uses it.

A vendor’s general description as an analytics or security provider is insufficient to establish the exception. You should identify the data it receives and the purposes permitted by its agreement. If it also receives a child’s voice, contact information, or other personal information, the persistent identifier exception won’t cover that additional collection.

Consent Before Collection

Unless an exception applies, § 312.5 requires the operator to obtain verifiable parental consent before collecting, using, or disclosing personal information from a child. A checkbox stating that the person is a parent, without any verification, doesn’t satisfy that requirement. The operator must make reasonable efforts, considering available technology, to ensure that the person providing consent is the child’s parent.

Available methods include a signed consent form, a qualifying payment transaction, a telephone call or video conference with trained personnel, and specified identity verification methods. The Rule also permits knowledge based authentication using questions that a child under 13 couldn’t reasonably answer. Each method has conditions, and selecting its name in a vendor’s dashboard doesn’t establish that those conditions are satisfied.

The photographic identification method requires more than an automated face comparison. It requires checking the authenticity of the government identification, having trained personnel confirm the match, and promptly deleting the identification and facial image after verification. Email plus and text plus methods are available only when the operator doesn’t disclose children’s information as the Rule defines disclosure.

A subscription product that relies on payment verification must use a monetary transaction that notifies the primary account holder of each discrete transaction. Collecting a card for a free trial without charging it doesn’t satisfy that method. If the product collects children’s personal information during the trial, the operator needs valid consent before that collection or an applicable exception.

Demonstrations and onboarding require the same analysis. When COPPA applies, a public demo that collects a child’s voice or other personal information requires prior parental consent unless an exception covers that collection. A bot challenge establishes neither parental status nor parental consent.

Model Training and Separate Consent

Under the amended Rule, parents must have the option to consent to collection and use without consenting to disclosure to third parties, unless that disclosure is integral to the service. The FTC explained that disclosures for third party AI training or development aren’t integral and require separate consent. Under the FTC’s final rule, an operator must allow parents to consent to the basic service without consenting to that training disclosure.

Sending a child’s typed message, audio recording, or uploaded file to a model provider solely to generate the requested response requires a different analysis from allowing the provider to use that information for training. The provider’s role, contractual permissions, and actual use of the information determine the applicable notice and consent requirements. A contract prohibiting training restricts the provider’s permitted use of the information. COPPA doesn’t impose a universal contractual ban on every training use.

The operator may permit a disclosure for nonintegral third party training if it obtains the required separate consent and satisfies the Rule’s other requirements. Retention limits, security duties, parental rights, and the provider’s terms also apply. Consent to training doesn’t excuse indefinite retention or authorize conduct the model provider prohibits.

You should review the terms governing every provider that receives children’s information, including speech, image, and avatar services. Training permissions may appear in the commercial agreement, product terms, or account settings. A general statement that a vendor protects privacy doesn’t establish what it may do with the data.

What the Notices Must Say

Section 312.4 distinguishes the direct notice sent to parents from the online privacy notice. When third party disclosures are involved, the direct notice must identify the recipients or their specific categories and explain the purposes of disclosure. The online notice must include both the identities and specific categories of third parties, along with the disclosure purposes.

The online notice also must identify the operators collecting or maintaining children’s information through the service. Those operator identification duties differ from the third party disclosure provisions. A person supporting internal operations who uses the information for no other purpose is excluded from the Rule’s definition of a third party, so every vendor doesn’t automatically require identical treatment in both notices.

The operator should classify each recipient’s role and permitted uses before drafting the notices. That review should distinguish processing necessary to deliver the product from separate uses such as advertising or model training. Notices must describe the arrangement the business uses, including the parental choices required for nonintegral disclosures.

Retention and Security

Under § 312.10, an operator may retain children’s personal information only as long as reasonably necessary for the specific purpose for which it was collected. Indefinite retention is prohibited. The operator must maintain a written policy stating the collection purposes, the business need for retention, and the deletion timeframe.

For an AI product, that review should include prompts, recordings, uploaded images, summaries, and copies held by vendors. A deletion promise requires a process that performs the promised deletion. Your technical team and vendors should account for logs, backups, and other retained copies when describing what deletion means and when it occurs.

In United States v. Amazon.com, Inc., the government’s 2023 complaint concerning Alexa alleged that Amazon retained children’s voice recordings indefinitely and failed to honor deletion requests fully. Amazon agreed to a $25 million civil penalty and restrictions on its use of children’s data.

In In re Everalbum, Inc., the FTC required deletion of models and algorithms developed using specified biometric information collected from users. The 2021 final order addressed facial recognition practices and illustrates a remedy for unlawful data use. Everalbum wasn’t a COPPA case.

Section 312.8 requires a written information security program appropriate to the sensitivity of the information. The program must include a designated coordinator, risk assessments at least annually, safeguards addressing identified risks, and regular testing and monitoring. Before releasing information to another operator, service provider, or third party, the operator must take reasonable steps to assess the recipient’s ability to protect it and obtain written assurances.

Responsibility for Vendors

A business is responsible for collection through third party tools incorporated into its product. Hiring a developer to select those tools doesn’t eliminate the operator’s COPPA duties. You should obtain enough information from your developers and vendors to understand what each tool collects, where it sends the information, and how the recipient uses it.

In United States v. Apitor Technology Co., Ltd., the government alleged that third party software in a robot toy app collected children’s precise location without parental consent. The FTC announced the case in September 2025.

The settlement included a $500,000 civil penalty, suspended because of inability to pay, and requirements addressing the information and third party software. An operator therefore needs information about embedded software as well as its primary AI provider.

Age Verification and Products for Adults

The FTC’s February 25, 2026 enforcement policy addresses general and mixed audience operators that collect personal information solely to determine age. Subject to its conditions, the agency won’t bring a COPPA enforcement action for collecting that information without prior parental consent. The policy concerns age verification information, not unrestricted collection from children identified through the process.

The conditions include restricted use and disclosure, prompt deletion, security, notice, written vendor assurances, and reasonable steps to confirm that the method is likely to produce accurate results. The statement applies until the FTC publishes final amendments addressing the subject or withdraws it. Once an operator learns that a user is under 13, continued collection for other purposes requires the applicable COPPA protections.

An operator may choose to restrict accounts to adults, but an age attestation doesn’t independently verify age or parental status. Nor does COPPA require every account holder to be 18. A general audience business should address what happens when it learns that a child is using the service, because an age screen doesn’t erase actual knowledge obtained elsewhere.

State Law and Companion Chatbots

COPPA compliance doesn’t resolve every privacy or product requirement. State laws may apply to information about children even when an adult supplied it, and some protect teenagers as well as children under 13. Their coverage depends on the business, the information, the use, and any applicable exemptions.

For example, the Texas Data Privacy and Security Act regulates covered controllers’ processing of sensitive data collected from known children by reference to COPPA. The Act generally exempts businesses that qualify as small businesses under federal standards, subject to a separate sensitive data sale provision. Its application therefore requires reviewing the business before assuming every AI startup has the same duties.

California imposes separate requirements on operators of products meeting its statutory definition of a companion chatbot. Under Business and Professions Code § 22602, an operator that knows a user is a minor must disclose that the chatbot is artificial intelligence and provide reminders at least every three hours to take a break and that the chatbot is artificial. It must also take reasonable measures to prevent specified sexual content and encouragement of sexual conduct involving minors. Covered operators must maintain and publish a protocol addressing suicidal ideation and self harm.

Those duties require reviewing whether the product meets California’s definition and which users it serves. A product that meets the statutory definition must satisfy the companion chatbot requirements in addition to any applicable privacy duties. Describing every conversational AI product as a companion chatbot would overlook the statutory limits.

Before Launch

You should establish the intended audience, how the product obtains children’s information, and what the business knows about users’ ages. For collection covered by COPPA, the next questions concern consent timing, vendor permissions, notices, parental rights, retention, and security. Demonstrations, trials, and optional features belong in that review because they may collect information before a paid account exists.

Your developers and vendors should provide accurate descriptions of the product’s data handling and implement the required safeguards. Those descriptions support the legal analysis and preparation of consent notices, privacy policies, and vendor agreements. The documents must correspond to the business’s practices.