The principal amended-rule compliance deadline was 22 April 2026. COPPA concerns covered collection of children’s personal information; it is not limited to paid games or services requiring deposits. The rule addresses child-directed online services and general-audience services with relevant actual knowledge concerning children under 13. (govinfo.gov)
What is materially different for procurement?
The FTC’s amendments strengthen parental control over third-party disclosures, including separate verifiable parental consent for covered disclosures associated with targeted advertising. They also restrict indefinite retention and expand the personal-information definition to include specified biometric and government-issued identifiers. (ftc.gov)
The final rule additionally addresses written information-security and retention practices. Persistent identifiers can fall within personal information, so the absence of a name-and-email registration form does not end the assessment. Applicable exceptions and the actual purposes of collection still matter. (govinfo.gov)
What should buyers request from an embedded-game supplier?
Recommended evidence includes:
- An audience and COPPA applicability assessment.
- A field-level description of identifiers collected before and after launch.
- The purposes and recipients of each data flow.
- The consent mechanism relied upon, where required.
- A documented retention schedule and deletion process.
- Security responsibilities and escalation contacts.
- Confirmation that supplier-side changes cannot silently introduce unreviewed advertising or tracking.
Do not accept “the publisher handles consent” as the entire allocation of responsibility. The FTC’s guidance addresses circumstances in which both site operators and third-party services have obligations. The parties should document their respective roles against the actual collection arrangement. (ftc.gov)
Did the FTC’s 2026 age-verification policy remove COPPA obligations?
No. It announced conditional enforcement discretion, not a general exemption. On 25 February 2026, the FTC issued a policy concerning certain general- and mixed-audience operators collecting information solely to determine age. Conditions include purpose limitation, prompt deletion, security, clear notice and reasonable steps concerning accuracy and third-party safeguards. (ftc.gov)
The statement says it remains effective until relevant final amendments are published or it is withdrawn. It should not be interpreted as permission to reuse age-verification information for advertising, or as a requirement that every demo publisher collect identity documents. (ftc.gov)
Recommended action: if age assurance is proposed, assess it as a separate data-processing project. Ask whether a less intrusive implementation meets the actual requirement; do not add sensitive collection merely to make the site appear more compliant.