The US FTC says it won't enforce COPPA against companies using age verification tools as long as they use the collected data only to verify a user's age
The Federal Trade Commission (FTC) on Wednesday issued a policy statement advising industry that it will not bring enforcement actions …
Context & Ripple Effects
The FTC’s position refines an enforcement arc that has emphasized limits on commercial uses of children’s data, including its warning to edtech companies over ad-related data use. It also follows the agency’s proposal for tighter child-data rules, including restrictions around targeted advertising and notifications for younger users.
The practical significance is the agency’s attempt to separate age assurance from broader data collection: verification data gets enforcement latitude only when its use remains confined to establishing age.
First-order effects
- Companies deploying age-verification tools gain a clearer COPPA enforcement posture, provided collected data is used solely to verify a user’s age.
- Age-verification workflows will need purpose limits around the data they collect; using that data for advertising or other commercial purposes would fall outside the stated policy.
Second-order effects
- Platforms and service providers may reassess age-gating designs in favor of tools and contracts that can demonstrate data is not repurposed after verification.
- The policy puts greater weight on operational data governance: vendors and customers must be able to distinguish age verification from the broader child-data practices the FTC has previously scrutinized.
Third-order effects
- If this approach holds, age assurance could become a more established compliance layer in child-safety regulation, with data minimization—not verification alone—determining regulatory acceptability.
- The move illustrates an access-control regulatory model that seeks to enable age checks while constraining the secondary uses that can turn those checks into a new source of personal-data collection.
The trend: Child-privacy enforcement is increasingly pairing stronger protections for minors with conditional pathways for age-assurance systems that limit secondary data use.