COPPA Rule, parental consent, general requirements (as amended 2025) (16 CFR 312.5(a)(1)-(2))
Since the 2025 amendments (effective June 23, 2025; compliance required by April 22, 2026), disclosing a child's data to a third party needs its own, separate verifiable parental consent unless the disclosure is integral to the service. Consent to use the service does not cover selling or licensing the child's data.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“(a) General requirements. (1) An operator is required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented. (2) An operator must give the parent the option to consent to the collection and use of the child's personal information without consenting to disclosure of his or her personal information to third parties, unless such disclosure is integral to the website or online service. An operator required to give the parent this option must obtain separate verifiable parental consent to such disclosure.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide