What is COPPA 2.0? A Developer's Guide to the April 2026 Deadline

The Children's Online Privacy Protection Act is getting its biggest update since 1998. COPPA 2.0 takes effect on April 22, 2026, extending protections from children under 13 to everyone under 17. That one change dramatically expands the number of apps and services in scope.

Does this apply to you?

Yes, if your product is directed at anyone under 17, has actual knowledge of minor users, collects personal information from them (including IP addresses, device IDs, and behavioral data), or uses tracking technologies on pages accessible to minors. "Directed at children" includes apps that appeal to children by their content or visual design, even without explicitly targeting that age group.

Five steps to take before April 22

1. Audit your data collection

Map every place your application collects, stores, or transmits personal information. This includes analytics SDKs, tracking pixels, cookie consent flows, and third-party integrations. Many teams discover data collection they didn't know about during this step.

2. Review your consent flows

COPPA 2.0 requires verifiable parental consent before collecting data from minors. "I agree" checkboxes are not sufficient. You need age gating, parental verification, and consent management that meets FTC standards.

3. Scan your codebase

Automated tools can identify common compliance patterns in your source code: tracking SDKs initialized without consent checks, geolocation collection without opt-in, push notification setup without age verification, and dark patterns that manipulate user consent.

4. Implement age verification

If your app can reasonably be accessed by minors, you need an age gate. The FTC has been clear that "neutral age screens" (where any birthday works) don't meet the standard. Consider validated approaches: date-of-birth collection with logic, third-party age verification services, or teacher/parent-mediated signup flows for educational contexts.

5. Document your compliance decisions

When the FTC investigates, they look for evidence that you took compliance seriously. Document what you scanned, what you found, how you resolved each issue, and who made the decision. This audit trail is your best defense in an enforcement action.

The cost of getting it wrong

"Per violation" can mean per user, per data point, or per instance. For apps with large user bases, the math gets painful fast. Recent FTC settlements have ranged from hundreds of thousands to tens of millions of dollars. The FTC is actively enforcing, and the updated penalty rate makes ignoring this significantly more expensive than addressing it.

The bottom line

If your product touches kids' data, every day between now and April 22 is a day to audit, fix, and document. The cost of compliance is manageable. The cost of enforcement is not.