The Federal Trade Commission has issued an enforcement policy statement creating a safe harbor for operators that deploy age verification technologies under the Children’s Online Privacy Protection Rule, a significant policy shift intended to remove a legal obstacle that had discouraged platforms from implementing age-gating tools.
The statement, approved 2-0 by the Commission on February 26, 2026, declares that the FTC will not pursue COPPA enforcement actions against general-audience or mixed-audience website and online service operators that collect personal information solely to determine a user’s age, provided they comply with a set of defined conditions.
COPPA, enacted in 1998, requires operators to obtain verifiable parental consent before collecting personal information from children under 13. Age verification systems themselves often require collecting personal data, creating a legal tension: an operator seeking to identify whether a user is a minor could inadvertently trigger COPPA’s consent requirements in the process of trying to comply with them.
The policy statement directly addresses that tension. To qualify for the safe harbor, operators must restrict use of age verification data to the sole purpose of determining a user’s age, delete the information promptly after it is no longer needed, limit disclosures to vetted third parties, provide clear notice to parents and users, apply reasonable security safeguards, and take reasonable steps to verify the accuracy of the age verification method they use.
“Age verification technologies are some of the most child-protective technologies to emerge in decades,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “Our statement incentivizes operators to use these innovative tools, empowering parents to protect their children online.”
The move follows an FTC workshop in January 2026 at which the agency had examined biometric age verification technologies and their implications for COPPA compliance. The policy represents a reversal from the FTC’s earlier posture: in 2024, the agency rejected a facial age estimation application submitted under COPPA by a consortium including Yoti and SuperAwesome.
The policy is also a response to growing state-level action. Multiple states have enacted laws requiring online platforms to verify user ages, creating pressure on operators to deploy solutions even as federal guidance remained unclear. The FTC’s statement provides a uniform federal floor while the Commission initiates a broader formal review of the COPPA Rule to address age verification mechanisms.
The statement remains in effect until the Commission publishes final COPPA Rule amendments or withdraws it. That broader rulemaking will determine whether the conditions outlined in the safe harbor are codified into regulation.
Sources: FTC Press Release, Enforcement Policy Statement
–
By the ID Tech Editorial Team
