Children and teens in your app: COPPA after April 2026, design codes and app store age signals

When does COPPA apply to an app?

The Children's Online Privacy Protection Act and the FTC's COPPA Rule apply to an app that is directed to children under 13, in whole or in part, and to any app whose operator has actual knowledge that it collects personal information from a child under 13. Whether an app is directed to children depends on its subject, its visual content, its characters, its music, the ages of the people in it and its advertising, among other factors.

The operator must give notice to parents, obtain verifiable parental consent before collecting a child's personal information (subject to narrow exceptions), let parents review and delete the data, and keep it secure.

Sources: 16 CFR Part 312 (eCFR); FTC, Complying with COPPA: frequently asked questions.

What changed in April 2026?

The FTC amended the COPPA Rule in a final rule published on 22 April 2025. The amendments took effect on 23 June 2025, and operators had one year from publication, until 22 April 2026, to comply with the changes that carry no earlier date. Among the changes:

• Separate consent for sharing. An operator must obtain a separate verifiable parental consent before disclosing a child's personal information to third parties, including for targeted advertising, unless the disclosure is integral to the service.
• A written security program. The operator must keep a written information security program suited to the sensitivity of children's data.
• A written retention policy. Children's personal information may be kept only as long as reasonably necessary for the purpose it was collected for, and not indefinitely. The policy has to be in writing and published in the online notice.
• A wider definition of personal information, which now includes biometric identifiers and government-issued identifiers.

In February 2026 the FTC also issued a policy statement on the use of age verification technology under COPPA.

Sources: FTC, final rule amendments; FTC, press release of January 2025 on the final changes; FTC, policy statement on age verification (February 2026).

What do state privacy laws say about teens?

Several state privacy laws protect older minors as well. Under the California Consumer Privacy Act, a business may not sell or share the personal information of a consumer it knows to be under 16 unless the consumer (if 13 to 15) or a parent (if under 13) has opted in. Connecticut's amendments in Public Act 25-113, in force from 1 July 2026, extend its minors' protections to users under 18 and restrict targeted advertising to minors and the sale of their data. Other states have their own rules, and the thresholds differ.

Sources: CCPA, Civil Code section 1798.120; Connecticut Public Act 25-113.

Where does California's design code stand?

California's Age-Appropriate Design Code Act applies to online services, products and features likely to be accessed by children under 18. It has been in court since it was enacted. On 12 March 2026 the Ninth Circuit ruled on the second appeal:

• it vacated the preliminary injunction as to the Act as a whole, because the challenge to the Act's coverage definition had not been shown on the record;
• it vacated the injunction as to the requirement to estimate users' ages (section 1798.99.31(a)(5));
• it kept the injunction in place for the data use and dark patterns restrictions (section 1798.99.31(b)(1) to (4) and (7)), finding them too vague;
• it sent the case back to the district court on whether the rest of the Act can stand without its notice-and-cure provision.

The requirement to prepare data protection impact assessments was enjoined in the earlier appeal and remains enjoined. Which parts of the Act can be enforced now depends on what the district court does next, so check the current status before relying on any of it.

Sources: Civil Code title 1.81.47; NetChoice, LLC v. Bonta, No. 25-2366 (9th Cir. Mar. 12, 2026).

What do the app store age laws ask of developers?

A new group of laws puts age checks at the app store or the device, and asks developers to read the result and act on it.

• Texas (SB 2420). App stores must verify a user's age category and obtain a parent's consent for minors; developers must use the store's age and consent information and enforce the restrictions it calls for. A federal district court enjoined the Act in December 2025. On 4 June 2026 the Fifth Circuit stayed those injunctions while the appeal proceeds, and on 6 July 2026 the Supreme Court declined to lift the stay. The appeal itself was still pending when this guide was checked.
• Utah (SB 142, amended by HB 498 in 2026). The duties of app stores and developers, and the right of minors and parents to sue, begin on 6 May 2027.
• Louisiana. The 2025 Act was replaced in 2026 by Act 185 (HB 977), which takes effect on 1 July 2027.
• California (AB 1043, the Digital Age Assurance Act). From 1 January 2027, operating systems and app stores must send developers an age-range signal on request. A developer that requests the signal is treated as knowing the user's age range.

Apple and Google have released tools that pass an age range to apps where these laws apply. Google's Play Age Signals service, for example, also lets developers tell the store about significant changes that need a parent's approval.

Sources: Supreme Court docket No. 25A1389; Utah HB 498 (2026), enrolled; Louisiana HB 977 (2026), enrolled; California AB 1043; Apple, Declared Age Range; Google, Play Age Signals.

What do the app stores require for children?

Google Play's Families policies apply to apps aimed at children: they may use only SDKs that have certified compliance with the Families policies, and they are limited in the identifiers and ads they may use. Apple's Kids category has its own rules on third-party analytics and advertising.

Sources: Google Play, Families policies; Apple, App Review Guidelines.

Checklist

• Audience assessed: directed to children, mixed audience, or general with actual knowledge
• Parental notice and consent flows checked against the amended COPPA Rule
• Separate consent obtained before sharing children's data with third parties
• Written information security program and written retention policy in place
• Teen rules mapped for each state where the app has users
• Age signals from the app stores and devices requested, stored and acted on
• SDKs checked against the Families policies and the Kids category rules

Questions people ask

Our app is for adults. Can COPPA still apply? Yes, if you have actual knowledge that a user is under 13, for example from an age the user entered or a signal the store sent.

Does an age signal from the app store mean we know the user's age? Under California's AB 1043, a developer that requests the signal is treated as knowing the user's age range. Under the Texas and Utah laws, developers must use the store's information. Plan for the signal to change what the law expects of you.

Is California's design code in force? In part, and the position is still moving. The Ninth Circuit's March 2026 ruling lifted much of the injunction but kept the data use and dark patterns restrictions blocked, and the district court is considering the rest.

Do we need a parent's consent for teens? Not under COPPA, which stops at 13. Several state laws require opt-in consent from teens, or from a parent, for certain uses such as selling their data or targeted advertising.

Update log

• 5 November 2026: first published. Sources checked the same day.