Separate Consent for “Third-Party Disclosures” 

Arguably the most important and impactful change that the COPPA Rule brings is a new requirement that online operators obtain separate, opt-in parental consent for “non-integral” disclosures of a child’s personal information to third parties. This is actually something k-ID argued for explicitly in our public comments, so that children would not be totally blocked off from a service if parents did not consent to the sharing of data to third parties (the “take it or leave it approach”). We were delighted to see our comments cited with approval by the Commission in the Final Rule (see page 16,947)! 

‍

Why is this important? For years, parental consent has been presented largely on a purely “take it or leave it” basis. In most cases, a parent’s only options when approving a child’s online were (1) accept everything that the operator would do with their child’s data (including even potentially selling it to advertisers), or (2) refuse consent altogether, meaning the child simply couldn’t participate. The new COPPA Rule greatly empowers parents to say “Yes, I want my child to participate, but not share their personal data with third parties.” 

‍

Of course, there is still some ambiguity here. Does “non-integral” sharing only encompass data sales and disclosures for targeted advertising (which appears to be the FTC’s immediate concern) or does it encompass other third-party disclosures as well? For example, would an optional chat or social sharing features in a game be covered? After all, disclosure to another user is also technically a “third party.” 

‍

How does k-ID help? 

‍

‍

k-ID has always believed that empowering parents means offering granular, feature-level controls. 

‍

‍

Our Global Compliance Engine makes it super easy for companies to seek granular parental consent on a per-feature basis, with detailed parent-facing disclosures for third-party data recipients and toggles that allow parents to provide consent to features that involve personal data disclosures. Our APIs communicate the parent’s preferences back to the developer so they know exactly what to turn on and off. And if you’ve already got parental consent for one purpose, our session upgrade API makes it easy to send a one-off request to a parent to confirm their preference for a specific feature (such as targeted advertising).

What is “Child-Directed?” What is “Mixed Audience?”

The original COPPA Rule only technically conceived of a binary state: a web site or online service was either “directed to children” or it wasn’t. Through subsequent amendments and clarifications over the years, the FTC effectively created a third category of site or service, commonly referred to as “mixed audience” services.  In a mixed audience service, children under 13 may not be the primary audience, but the service might nonetheless appeal to them for a variety of reasons (for example, due to the presence of visuals, audio, or other themes that might be appealing to kids). 

‍

Under existing FTC guidance, the operators of mixed audience sites and services may use a neutral age screening mechanism to sort users into the adult or child experience. You’ve probably seen these age screening mechanisms before if you’ve spent enough time on the internet.

‍

Why is this important? Critically – and this is often misunderstood – mixed audience services are considered a subset of “child-directed” services, and are still subject to COPPA’s parental consent requirements. Many sites or services that appeal to a wide audience of users mistakenly believed that since they did not actively direct their site or service to children (and even in some cases explicitly said kids were not allowed), they were not “child-directed” and thus could ignore their COPPA obligations. But that’s not what the law says: if the site or service is likely to appeal to children, COPPA applies – see over a decades’ worth of enforcements against companies like Playdom, TikTok, Epic Games, and most recently HoYoverse, who all were determined to be operating mixed-audience services without obtaining parental consent, in violation of this rule.

‍

The new COPPA Rule hopefully alleviates this confusion by finally giving “mixed audience” sites or services their own standalone definition, and by making clear that they are subject to COPPA and need to age screen.

‍

How does k-ID help?

‍

No problem: age-appropriate design and age screening is k-ID’s bread and butter. If your company’s site or service is likely to appeal to children, our Global Compliance Engine makes it easy to deliver a COPPA-compliant experience to them, and get verifiable parental consent as required under applicable law. We can even help you collect age signals quickly and compliantly through pre-fabricated age gate UX widgets (coming soon!) and our partnerships with age assurance providers.

‍

A sneak peek at some new widgets coming soon!

‍

Everything Else

There’s a lot more we could cover here about the final COPPA Rule, such as enhanced disclosure, retention, and security requirements, increased oversight and transparency obligations for COPPA Safe Harbor Programs, clarified definitions, and the introduction of “text plus” parental consent for certain lower-risk types of data processing. The FTC continues to prioritize kids and teens privacy and safety, so we wouldn’t be surprised if there was more guidance (and likely more enforcement) between now and the 2026 effective date. 

‍

We’ll be covering more of how k-ID helps solve these issues in future posts. For now, know that we’ve got you covered!

‍