COPPA was the floor. 2026 raised it.
The Children's Online Privacy Protection Act (COPPA) has been the foundational U.S. children's privacy law for decades, built around a core requirement: verifiable parental consent before collecting personal information from children under 13. As of 2026, that foundation is no longer the whole picture. Indiana, Kentucky, and Rhode Island all brought new comprehensive privacy laws into effect on January 1, 2026, and each specifically addresses children's and teens' use of AI and app stores — areas COPPA's original text, written before generative AI existed, simply doesn't reach.
What COPPA still requires, and where compliance commonly slips
COPPA's verifiable-parental-consent requirement means more than a checkbox a child can click themselves — consent needs to be obtained through a mechanism reasonably designed to confirm an actual parent or guardian is providing it. A surprising number of apps still rely on age-gate mechanisms (a simple birthdate field) that are trivially bypassed, which increasingly draws regulatory scrutiny as enforcement priorities sharpen.
The new frontier: AI-specific requirements for minors
The 2026 state laws extend beyond traditional data collection concerns into how minors' data is used in AI systems specifically — profiling, personalization algorithms, and AI training. Excluding minors' data from AI training and profiling by default is rapidly becoming an explicit expectation rather than a voluntary best practice, distinct from and additional to COPPA's original consent framework.
App store age ratings matter more than teams often realize
An app store age rating that doesn't accurately reflect actual content and data practices creates a specific and growing compliance exposure — new state laws increasingly place obligations on app stores themselves regarding age verification and parental consent, which puts pressure on developers to ensure their own rating and disclosed data practices are consistent and accurate.
Why "we have a privacy policy" isn't the same as compliance
A general privacy policy that technically mentions children's data, buried in dense legal language written for an adult reader, doesn't meet the bar current expectations are moving toward: a clear, plain-language notice written specifically for a parent or guardian audience, alongside a functional dashboard for reviewing, exporting, or deleting a child's data — not just a policy statement claiming that capability exists.
Why this needs periodic re-review, not a one-time audit
With new state laws taking effect on a rolling basis — three states added children's/teens' AI provisions in a single January alone — a compliance posture assessed once and left unrevisited goes stale within a year. Teams handling minors' data at any meaningful scale need this built into a recurring review cycle, not treated as a project with a defined end date.
Frequently Asked Questions
Not fully anymore. COPPA remains the foundational requirement for verifiable parental consent before collecting data from under-13 users, but new 2026 state laws in Indiana, Kentucky, and Rhode Island specifically address children's and teens' AI use and app store obligations — areas COPPA's original framework doesn't reach, since it predates generative AI.
It means consent obtained through a mechanism reasonably designed to confirm an actual parent or guardian is providing it — not a simple checkbox or birthdate field a child could complete themselves. A growing number of apps face scrutiny for relying on easily bypassed age-gate mechanisms that don't meet this bar.
New 2026 state laws extend privacy obligations into how minors' data is used in AI systems — profiling, personalization, and training — an area traditional COPPA compliance doesn't directly address. Excluding minors' data from AI training by default is rapidly moving from a voluntary best practice toward an explicit legal expectation.
Generally not on its own. Current expectations increasingly call for a separate, plain-language notice written specifically for a parent or guardian audience, plus a functional dashboard letting parents actually review, export, or delete their child's data — not just a policy statement claiming that capability exists somewhere in dense legal text.
Yes — the Children's Privacy Law Compliance Checklist is a weighted 14-point checklist covering both COPPA fundamentals and the newer AI-specific and state-level requirements effective in 2026, giving a live 0-100 compliance posture score.