FTC Signals Relaxed COPPA Enforcement to Boost Age Verification Adoption

The Federal Trade Commission’s (FTC) issuance of the Enforcement Policy Statement on February 25, 2026, marks a pivotal recalibration of how the agency interprets the Children’s Online Privacy Protection Act (COPPA) in an era of increasingly sophisticated age-gating requirements. By signaling a relaxed enforcement posture, the FTC is attempting to resolve a long-standing paradox: COPPA technically requires parental consent before collecting personal information from children under 13, yet verifying a user's age often necessitates the collection of that very data. This policy shift provides a narrow but critical window for general and mixed audience platforms to deploy verification tools without the immediate threat of a COPPA violation, provided the data collected is used exclusively for age determination.

The timing of this announcement is not accidental. It follows a period of intense legislative activity at the state level, where lawmakers in various jurisdictions have passed mandates requiring websites to verify the ages of their users to prevent minors from accessing harmful content. For many digital service providers, these state laws created a compliance trap. Adhering to state-level age-verification mandates could inadvertently trigger federal COPPA violations if the verification process involved collecting identifiers from a child without prior parental consent. The FTC’s new stance acknowledges this friction, offering a pragmatic path forward for operators who are not primarily targeting children but find themselves hosting a diverse user base.

“

During that event, FTC Chair Andrew Ferguson and Commissioner Mark Meador signaled that while the current policy statement provides immediate guidance, a comprehensive review of the COPPA Rule is underway.

However, the scope of this enforcement flexibility is strictly delimited. Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection, emphasized that the goal is to incentivize innovative tools that empower parents. Crucially, the policy does not extend to operators whose services are directed primarily at children. For those entities, the traditional, rigorous COPPA requirements for verifiable parental consent (VPC) remain fully in force. For mixed-audience sites, the relaxed enforcement only applies if the information collected for age verification is deleted immediately after use and is never repurposed for marketing, profiling, or any other commercial activity.

This policy statement is also a precursor to more formal regulatory changes. The FTC’s Age Verification Workshop held on January 28, 2026, served as a clearinghouse for the technical and ethical challenges of modern age assurance. During that event, FTC Chair Andrew Ferguson and Commissioner Mark Meador signaled that while the current policy statement provides immediate guidance, a comprehensive review of the COPPA Rule is underway. This suggests that the current enforcement flexibility may eventually be codified into formal law, potentially creating a permanent safe harbor for specific classes of age-verification technologies that meet high privacy and accuracy standards.