Online Privacy Bill Expands Protections to Age 17, Bans Targeted Ads for Teens, But Blocks State Action

The new Children and Teens Online Privacy Protection Act significantly updates the 1998 COPPA law, which previously focused on kids under 13. This bill takes aim at modern online tracking by extending privacy protections to teens—defined here as individuals aged 13 through 16—and putting a hard stop to personalized advertising aimed at anyone under 17.

What’s Actually Changing Here?

First, the bill radically expands the definition of “personal information.” It’s not just names and addresses anymore. It now explicitly includes persistent identifiers (like IP addresses and unique device IDs that track you across platforms), geolocation data precise enough to pinpoint your street, and even biometric data, such as facial templates or DNA information. If an operator (the company running the site or app) knows a user is under 17, collecting this data for the purpose of individual-specific advertising is now unlawful (Section 1303). This means no more using a teen’s browsing history or location data to serve them targeted ads for sneakers or gaming gear.

Operators are also required to implement better security practices and cannot hold onto a child’s or teen’s personal information longer than “reasonably necessary” to complete a transaction or service. If you’re a parent, you gain the right to demand the deletion of this information or content submitted by your child or teen, and the service must provide a means for you to obtain any collected data (Section 1303).

The School Exemption: Trading Privacy for Convenience?

One of the most significant changes involves how schools use online services. The bill allows operators to bypass the requirement for individual parental consent if they are acting under a written agreement with an educational agency or institution. In this scenario, the school essentially gives consent for the use of student data, provided the operator limits the collection and use solely to educational purposes and not for commercial gain (Section 1303). For parents, this means you might not get a direct notification every time your child starts using a new educational app; instead, you’ll rely on the school’s public notice and oversight.

While this streamlines things for teachers and schools, it’s a big shift. It relies heavily on the school district to be the gatekeeper of your child’s data, rather than requiring direct parental authorization. If you’re concerned about how much data the school’s vendor is collecting, the bill requires the educational agency to post a public notice identifying the operator and linking to their disclosure practices.

The Catch: Federal Preemption and Loopholes

Here’s where the policy meets the pavement: the bill retains the existing federal preemption clause (Section 1305(d)). This means that even if a state—say, California or New York—wanted to pass a law offering even stronger privacy protections for its children and teens, they are blocked from doing so. The federal standard becomes the ceiling, not the floor, for privacy protections in this area. This is a big deal for citizens who might want more robust safeguards than the FTC ultimately enforces.

Another potential soft spot lies in the broad definition of “Support for the internal operations.” This allows operators to collect persistent identifiers and other data for activities like “personalizing content,” “serving contextual advertising,” and “protecting integrity or security.” While this data can't be used to build a profile for targeted ads, the language is broad enough that companies could still process significant amounts of user data under the guise of necessary operations, raising questions about how much data is truly off-limits.

Ultimately, this bill is a necessary update that brings privacy law into the 21st century by covering teens and modern tracking tech. It offers real, tangible protections against targeted advertising for younger users. However, it also centralizes control at the federal level, shuts down state innovation in privacy protection, and includes exemptions that could allow significant data collection to continue under the banner of internal operations or educational necessity.