The Children’s Online Privacy Protection Act — COPPA — was written in 1998, when the internet was barely a decade old and “social media” wasn’t a phrase anyone used. The law drew a clear line at age 13: under that age, platforms needed verifiable parental consent to collect personal data. At 13, the assumption was that children became capable of managing their own privacy decisions.
That assumption has aged badly. The platforms that dominate the lives of today’s 14, 15, and 16-year-olds — social networks, video platforms, messaging apps — collect data with the same intensity for a 15-year-old as they do for a 45-year-old, and use it for the same purposes: targeted advertising, behavioural profiling, and in many cases, training AI systems.
COPPA 2.0 — formally the Children and Teens’ Online Privacy Protection Act — passed the US Senate and moves the law’s line. Here’s what it does, what it doesn’t, and what it means if you’re a parent choosing which apps and services your family uses.
What the Original COPPA Did
The original COPPA has a simple core: websites and online services directed at children under 13, or with actual knowledge that a user is under 13, must obtain verifiable parental consent before collecting personal information from that child. They can’t condition use of the service on collecting more data than necessary. They must delete children’s data when asked.
For nearly three decades, COPPA represented the US federal floor for children’s online privacy. It was enforced — the FTC has brought significant cases against violators — but its coverage was narrow. It protected children under 13. Anyone 13 or older had, under federal law, the same privacy rights as an adult: essentially none beyond what a company’s own privacy policy promised.
The problem, of course, is that the most intensive social media and digital media use happens in the early teenage years — precisely the years that COPPA didn’t reach.
What COPPA 2.0 Changes
Coverage extends to teenagers under 17
The central change in COPPA 2.0 is an expansion of the protected age range. Under the new law, platforms that are directed at teens — or that have actual knowledge a user is between 13 and 16 — must comply with requirements similar to those that currently apply for children under 13.
This more than doubles the covered population. Where original COPPA reached children under 13, COPPA 2.0 reaches children and teens under 17.
A ban on targeted advertising to minors
This is the provision with the most direct commercial impact. COPPA 2.0 prohibits operators from collecting personal information from users under 17 for the purpose of serving them targeted advertising. This isn’t a consent-and-proceed structure — parents can’t opt in on behalf of their teenagers to allow this. It’s a categorical prohibition on the data collection that feeds targeted advertising to this age group.
The advertising business model that funds most free social media platforms — granular behavioural profiling translated into ad targeting — cannot legally be applied to users under 17. For platforms that have historically made no distinction between an 18-year-old and a 15-year-old in their advertising systems, this requires substantive re-engineering, not just a policy update.
A prohibition on “pay-for-privacy” models targeting minors
COPPA 2.0 also prohibits platforms from conditioning a minor’s access to a service on the minor consenting to data collection beyond what’s necessary for the service’s basic functionality. This closes a growing pattern where platforms have introduced tiered pricing: pay a subscription fee for a “privacy-friendly” experience, or use the free version and accept data collection. For users under 17, the premium-for-privacy upsell is off the table.
Data minimisation requirements
The new law strengthens data minimisation obligations for teen users: platforms may only collect, use, and retain data that is reasonably necessary to provide the service the user is actually using. This is a harder standard than what most platforms currently apply, where data collection has historically been maximised and linked across services.
Notification and transparency
Platforms must notify parents or guardians when their child under 13 registers for a service — a strengthened version of an existing requirement. For teens 13 through 16, the requirement shifts: platforms must provide accessible, plain-language explanations of data practices directly to the teen user.
What COPPA 2.0 Doesn’t Fix
Age verification is still an unsolved problem
COPPA’s fundamental enforcement challenge has always been age verification. The law prohibits certain practices with respect to users known to be below the age threshold — but most platforms don’t know the age of their users, because they’ve never asked, or users have lied.
COPPA 2.0 doesn’t resolve this. The “actual knowledge” standard remains: platforms are subject to the law when they know a user is underage. Self-reported ages, which users routinely falsify, don’t create “actual knowledge.” Some states have moved to mandate age verification mechanisms — using government ID checks, device-level signals, or third-party verification services — but these approaches have their own privacy implications and are currently the subject of separate litigation.
The practical result is that a 15-year-old who says they’re 18 when signing up for an account remains in a difficult legal grey zone.
Non-profit and educational exemptions remain
Schools and educational platforms often receive exemptions from COPPA requirements under the School Official Exception, which allows schools to authorise data collection on behalf of parents. COPPA 2.0 doesn’t substantially change this, meaning the school app ecosystem — which has its own significant privacy concerns — remains separately governed.
State laws go further in some areas
While COPPA 2.0 creates a federal floor, several states have enacted or are implementing requirements that go beyond it. Arkansas and Virginia have introduced restrictions on teen social media use tied to time limits and interface design. Oregon limits behavioural advertising to teens even below the federal age threshold. California’s privacy law provides rights for minor users that exceed COPPA 2.0’s federal requirements.
The result is a patchwork: COPPA 2.0 sets a baseline, but what applies to your teenager depends in part on where you live.
What It Means for Platform Design
COPPA 2.0, if passed into law and enforced, would require significant changes to how major platforms handle teen users.
Ad systems require redesign. A platform that uses behavioural data to target ads cannot apply that system to users it knows are under 17. This requires either age-appropriate separate advertising systems or exclusion of identified teen users from behavioural targeting entirely.
Data pipelines require new age-awareness. Currently, most platforms collect the same data from users regardless of age, with differentiation only at the narrow COPPA-13 level. COPPA 2.0 requires extending age-aware data architecture up through 16.
Dark patterns for data extraction become legally riskier. The prohibition on conditioning service access on excessive data collection, combined with a minor user base, significantly raises the risk profile of the “accept all or pay” design pattern.
The State Level Is Moving Faster
Federal legislation moves slowly in the US, and COPPA 2.0 has been in various stages of Congressional consideration for years. While it has now passed the Senate, it still needs to clear the House.
State legislatures have been less patient. Beyond the three states mentioned above, Georgia requires express parental consent before a minor can open a social media account. Multiple states have enacted or proposed requirements for age estimation signals at the device or app store level.
For families navigating this practically, state law may provide rights you can exercise right now — rights to opt out of targeted advertising for your teenager, to request deletion of collected data, and in some states to request a list of third parties to whom their data has been sold.
What This Means for How You Store Family Photos and Records
COPPA 2.0 is primarily aimed at social platforms and advertising-funded services. But it has a secondary implication that’s worth noting for parents who use cloud storage for family photos, records, and shared archives.
If your family uses a free photo sharing service or cloud storage platform to share images of your children, the data practices of that platform — how it uses face data, how it trains AI on uploaded images, whether it includes your children’s faces in model training pipelines — are governed by the same terms of service as any other user’s content.
Most family photo sharing services are not covered by COPPA, because they’re not primarily directed at children. But the images of children stored on those platforms are processed under terms that were written for adult users.
This doesn’t mean you need to stop using them. It means the choice of where to store family photos is a meaningful privacy decision, not just a storage question.
How daftei Handles This
daftei is not directed at children, and does not knowingly collect personal data from users under 13. For family use, daftei provides private, encrypted storage for photos, documents, and personal files — without advertising, without selling data, and without training third-party AI models on stored content.
Files are encrypted at rest with AES-256 and in transit with TLS 1.3. daftei is GDPR and CCPA compliant. If you use daftei to keep private family archives — including photos of your children — those files stay within an account you control and aren’t fed into an advertising or AI training system.
The COPPA 2.0 question is specifically about platforms directing services at teens and collecting their data for advertising. That’s a different product category than private file storage. But the underlying principle — that children’s data deserves more protection than the default commercial internet provides — applies wherever your family keeps its files.
Practical Steps for Parents Now
While COPPA 2.0 works through Congress, here’s what you can do today:
Audit which accounts your teenagers have. Focus on platforms funded by advertising — social networks, video platforms, photo sharing services. These are the platforms most likely to be affected by COPPA 2.0 requirements, and where the most extensive profiling currently happens.
Check for age-appropriate data settings. Some platforms already provide reduced data collection settings for verified minor accounts — Google’s supervised accounts, Apple’s Family Sharing with Screen Time, Meta’s restricted teen accounts. These are imperfect but better than default settings.
Use state rights if you have them. In California, Colorado, Connecticut, Virginia, and a growing number of other states, you have the right to opt out of the sale of your teenager’s personal data, and in some states to opt out of targeted advertising. These rights can often be exercised through a platform’s privacy settings or through a formal privacy rights request.
Ask what happens to your teenager’s photos. If your family uses a platform that uses AI to tag, categorise, or search photos — including face recognition features — read the privacy policy to understand whether those AI features involve training on stored images, and whether that training can be disabled.
The Direction of Travel
COPPA 2.0 is one piece of a larger shift in how lawmakers, courts, and regulators are thinking about children’s and teens’ digital lives. The consensus moving through state legislatures and now federal legislation is that the advertising-based internet’s standard approach — collect everything, profile everyone, target accordingly — should not apply without modification to people under 18.
Whether that consensus produces effective law depends on how COPPA 2.0’s remaining legislative path unfolds, and how enforcement is resourced. But the direction of travel is clear. The question for parents in the meantime is which direction their family’s apps are already moving.