FTC Updates Children's Online Privacy Rule

- The amendments, published in the Federal Register on April 22, 2025, become effective on June 23, 2025, but operators have until April 22, 2026, to achieve full compliance. - A significant change requires operators to obtain separate verifiable parental consent before disclosing children's personal information to third parties for targeted advertising; access to the service cannot be conditioned on this consent. - The rule now explicitly prohibits the indefinite retention of children's data, requiring operators to establish a written data retention policy and delete information once it is no longer reasonably necessary for the purpose it was collected. - Operators must now establish, implement, and maintain a comprehensive written information security program, a more prescriptive requirement than the previous mandate for "reasonable procedures." - The definition of personal information has been expanded to include biometric identifiers such as fingerprints, retina patterns, voiceprints, and facial templates. - Proposed amendments that would have codified the process for schools to consent on behalf of parents for the use of educational technology were omitted from the final rule to avoid potential conflicts with the Department of Education's future updates to the Family Educational Rights and Privacy Act (FERPA). - FTC-approved "Safe Harbor" programs, which provide self-regulatory guidelines for compliance, are now required to publicly disclose their membership lists and report additional information to the commission to increase transparency and accountability.