20 years since children's online protection law COPPA was passed, it has been weakened by court rulings, uneven enforcement, and relentless technological change
Craig Timberg / Washington Post : Tweets: @geoffreyfowler and @byheatherlong See also Mediagazer Tweets: Geoffrey A. Fowler / @geoffreyfowler : How does YouTube get around a law aimed at protecting kids? It doesn't ask your age. Great deep dive on how tech companies shirk their legal responsibilities to children by @craigtimberg @washingtonpost https://www.washingtonpost.com/ ... Heather Long / @byheatherlong : Children's websites routinely have: -Ashley Madison ads -Dating service ads -Ads touting pics of “Hot Survivor Candidates” -Ads for online scams All of this is legal under under the 1998 Children's Online Privacy Protection Act. https://www.washingtonpost.com/ ... via @craigtimberg See also Mediagazer
Context & Ripple Effects
Twenty years in, COPPA's core design choice — making 13 the internet's age of adulthood — is under pressure from both directions at once. The Washington Post reports the law has been hollowed out by court rulings, uneven enforcement, and platforms that never verify age, while a bipartisan COPPA 2.0 bill pushes the age threshold up to 16.
The reporting landed days before sources confirmed the FTC was in late stages of a probe into YouTube's children's privacy practices, forcing the platform to rethink strategy — and the erosion documented here set the stage for the FTC's later push to make targeted ads for under-13s opt-in.
First-order effects
- Platforms serving children's content face direct regulatory exposure: the FTC probe into YouTube shows complaints about kids' video privacy converting into formal enforcement action against the largest player.
- Children's websites remain legally free to run adult ad inventory — dating services and scam promotions included — because COPPA's weakened enforcement leaves that inventory unpoliced.
Second-order effects
- The compliance gap is measurable downstream: Pixalate found 67% of the top 1,000 children's apps in Apple's App Store and 76% in Google Play send location data to the ad industry, meaning app stores and ad-tech intermediaries inherit the liability platforms avoid.
- State-level child safety legislation aimed at age-gating minors' access has emerged as the workaround when federal enforcement falters, with bipartisan backing raising the compliance bar beyond what COPPA demands.
Third-order effects
- If the pattern holds, child privacy regulation migrates from a single age-13 statute toward layered regimes — FTC rulemaking on opt-in targeting, legislative attempts to raise the age to 16, and state age-gating laws — forcing age verification into the infrastructure of the consumer internet itself.
The trend: US child online protection is shifting from one under-enforced 1998 law toward overlapping federal rulemaking and state age-gating legislation, with the FTC's enforcement cadence against major platforms setting the pace.