Amid a growing wave of regulatory scrutiny aimed at protecting Children’s safety and privacy, amendments to the COPPA Rule that go into force this year set out new data retention requirements for Children’s personal information that Covered Companies must implement.
Although the amended COPPA Rule has been in effect since June 23, 2025, there is a 365-day grace period. As the April 22, 2026, enforcement deadline approaches, now is the time for Covered Companies to begin implementing the operational changes necessary to comply with the COPPA Rule’s new requirements regarding the retention of Children’s personal information.
This article addresses those requirements.
Section 312.10 of the amended COPPA Rule requires Covered Companies to establish, implement, and maintain a written data retention policy that describes:
In addition, Covered Companies must “provide” the data retention policy in their online notice of their Children’s information practices (Online Privacy Notice).
Below are some common questions that Covered Companies may find themselves asking as they prepare for compliance with the amended COPPA Rule’s data retention requirement.
No. The COPPA Rule does not require a Covered Company to establish a separate written Children’s data retention policy so long as the company’s existing data retention policy is in writing, covers Children’s personal information, and satisfies all of the requirements of § 312.10. It is important to review an existing data retention policy to ensure it complies with the amended COPPA Rule retention requirements.
No. The data retention policy must be included as part of the Online Privacy Notice. Merely including a link to the data retention policy is not sufficient. To alleviate concerns that this may result in “unduly long, complex, or cluttered online notices,” the Federal Trade Commission (FTC) recommends using “various design features, such as expandable sections, [which would allow] reader[s] to obtain more detail within a given section, or intra-notice hyperlinks, [which would allow] reader[s] to quickly navigate between sections within the [Online Privacy Notice].”
Describing categories of Children’s personal information, such as contact information, account information, or education information, will likely suffice (i.e., those categories correlating with the categories typically found in a privacy notice under a section describing collection of personal information). Granular detail is not required. The FTC has clarified that it “declines to require that operators provide in their [Online Privacy Notice] an item-by-item matrix correlating each item of personal information collected with the particular use or uses of that item of information.”
No. The data retention policy must establish and state reasonable and specific retention periods for Children's personal information. Covered Companies must ensure that they do not retain Children's personal information indefinitely.
For example, a Covered Company may be able to retain Children's personal information for a specific amount of time after the Child has last used the Covered Company's website or online service, or after a subscription has ended, if there is a business need for retaining the information, and the Covered Company’s data retention policy explains that the Covered Company will take such action.
The COPPA Rule requires that personal information collected from Children online is retained only for “as long as is reasonably necessary to fulfill the purpose for which the information was collected” (the COPPA Reasonable Retention Requirement). Although the amended COPPA Rule is silent on specific retention timeframes, the FTC’s past enforcement actions offer guidance for best practices based on stipulated orders. Covered Companies should note that based on prior enforcement history, retention timelines vary, but indefinite retention will rarely, if ever, satisfy COPPA’s Reasonable Retention Requirement. Covered Companies should identify and document the purposes for which they retain Children’s personal information when establishing their retention period.
Companies may look to prior FTC enforcement actions for examples of retention periods the FTC found were unnecessarily long:
The FTC indicated that the COPPA Rule “expressly permits operators to collect Children's personal information for more than one specific purpose.” The purposes listed in the data retention policy should match the purposes that were disclosed in the Covered Company’s Online Privacy Notice. The FTC prohibits collecting Children’s personal information for any purpose that is not disclosed in the Online Privacy Notice.
So long as this is disclosed, and the Covered Company ensures that it does not retain Children's personal information indefinitely, the FTC has stated that the purposes can include:
As the effective date for compliance with the amended COPPA Rule approaches, Covered Companies may consider the following action items when preparing for compliance: