What New Rules on Children's Online Safety Mean for Families

Two federal deadlines this spring changed what apps and platforms owe families. Since April 22, 2026, sites and apps covered by the FTC's updated children's privacy rule have needed a parent's separate permission before passing a child's data to third parties such as ad networks, unless the sharing is integral to the service. Since May 19, 2026, platforms have had to remove nonconsensual intimate images, real or AI-generated, within 48 hours of a valid request. Most other "new rules" in the headlines are state age-check laws, and only some can be enforced today: Texas's app-store law can, because an appeals court paused the order blocking it and the Supreme Court declined on July 6 to intervene, while Virginia's one-hour daily limit for under-16s is blocked for NetChoice members' platforms and Congress has not finished the Kids Online Safety Act.

Key takeaways

The amended COPPA Rule took effect June 23, 2025, and compliance has been required since April 22, 2026. It covers children under 13 and adds separate consent for most third-party sharing, limits on how long data is kept, and a written security program.
Under the TAKE IT DOWN Act, covered platforms must remove a reported intimate image, real or AI-generated, within 48 hours of a valid written request and make reasonable efforts to remove known identical copies. The FTC began enforcing this on May 19, 2026.
Texas's app-store law requires age verification and a parent's approval for each download or purchase by a minor. It can be enforced while the appeal continues. Utah's and Louisiana's app-store laws and California's device age-signal law do not start until 2027.
State social-media laws are split. No court order currently stops Florida, Mississippi or Tennessee from enforcing theirs. Virginia's is blocked for NetChoice members, and Louisiana's is blocked for ten named companies. All five are still in court.
No new federal law covers teens' social media. COPPA 2.0 has passed only the Senate, the KIDS Act only the House, and KOSA only a Senate committee.

What it means for you

Parents of children under 13: expect consent requests that ask separately about sharing your child's data with third parties. You can say yes to the service and no to the sharing. You can also ask a site to let you review or delete what it holds. See "COPPA changes for kids under 13."
Parents of teens: COPPA covers only children under 13, so most teen protections come from state laws and from platforms' own settings. If an intimate image of your teen is shared, real or AI-generated, there are two routes: the platform's 48-hour removal process and NCMEC's Take It Down tool. See "Getting intimate images removed."
Families in Texas, Florida, Mississippi or Tennessee: these states' age-check or parental-consent laws can be enforced right now, but each is still in court. Tennessee's could be blocked after an August appeals ruling. Families in Utah and Louisiana will see app-store age checks in 2027, and California will require age prompts on new devices from January 1, 2027. See "Age checks and the court fights."
Families traveling to the UK or Australia: the UK requires age checks for some harmful content, and Australia requires major social platforms to keep Australians under 16 off accounts. See "If your family travels abroad."

In force, pending or blocked

The table shows where each federal measure and state app-store law stood on October 3, 2026. Court orders in these cases can change quickly. This article explains laws and rulings for general information and is not legal advice.

Rule or bill	Status as of October 3, 2026	Key dates
Amended COPPA Rule (16 CFR part 312)	In force	Published April 22, 2025; effective June 23, 2025; compliance required by April 22, 2026
TAKE IT DOWN Act, platform removal duty	In force; FTC enforcing	Signed May 19, 2025; platforms' deadline May 19, 2026
Free Speech Coalition v. Paxton (age checks on adult sites)	Decided; Texas law upheld	June 27, 2025
Kids Online Safety Act (S. 1748)	Pending	Revised version approved by Senate Commerce Committee August 5, 2026; no floor vote
COPPA 2.0 (S. 836)	Pending	Passed Senate March 5, 2026; held at the desk in the House
KIDS Act (H.R. 7757)	Pending	Passed House June 29, 2026, 267 to 117; no Senate vote
Texas app-store law (SB 2420)	Enforceable while the appeal continues	Effective date January 1, 2026, but blocked by a district court; injunctions stayed June 4, 2026; Supreme Court declined to lift the stay July 6, 2026
Utah app-store law, as amended by HB 498	Not yet in effect	Duties begin May 6, 2027
Louisiana app-store law (Act 185 of 2026)	Not yet in effect	Begins July 1, 2027; the 2025 version (Act 481) never took effect
California Digital Age Assurance Act (AB 1043)	Not yet in effect	Begins January 1, 2027; follow-up bill AB 1856 signed September 10, 2026

Where Congress stands

Congress has three main bills, and no two of them match. As introduced, the Senate's Kids Online Safety Act would make platforms used by people under 17 exercise reasonable care in designing features, to prevent harms such as mental health disorders and severe harassment. The Senate Commerce Committee approved a substitute version on August 5, 2026. The Senate passed COPPA 2.0, the Children and Teens' Online Privacy Protection Act, by unanimous consent on March 5, 2026, but the House has not acted on it.

The House instead passed an amended version of the KIDS Act on June 29, 2026. As introduced, it would require default settings for minors that limit compulsive-use features and contact from other users, plus parental controls on social media and online games. KOSA's Senate sponsors criticized it for stripping out KOSA's duty of care. None of the three is law.

COPPA changes for kids under 13

COPPA applies to sites and apps directed to children under 13. It also applies to general-audience services that know they are collecting a child's personal information.

The FTC announced the amendments on January 16, 2025. According to the final rule in the Federal Register, they took effect June 23, 2025, and companies had until April 22, 2026 to comply. Three provisions for industry "safe harbor" programs have their own dates. The current text is in 16 CFR part 312.

Separate consent for sharing. A parent must be able to approve collection and use of a child's data without approving disclosure to third parties, unless the disclosure is integral to the service. Disclosure needs its own verifiable parental consent. The FTC's example is sharing for targeted advertising.
Retention limits. Children's data may be kept only as long as reasonably necessary for the purpose it was collected for, and never indefinitely. The operator's online notice must include a written retention policy that gives the business need and a deletion timeframe.
Written security program. Operators must name a coordinator, assess risks at least once a year, and test and update their safeguards.
Broader "personal information." The definition now includes government-issued identifiers and biometric identifiers, such as fingerprints, voiceprints and facial templates.
New ways to confirm you are the parent. These include a knowledge-based quiz, a photo ID matched to a live picture of the parent's face, and, for services that do not disclose children's data, a text message followed by extra confirmation steps.

When a covered service asks for permission, look for a separate yes-or-no choice about third-party sharing. The FTC also kept its long-standing position that a child's participation cannot be made conditional on the parent agreeing to that sharing. Your rights are set out in section 312.6: a description of the types of data collected, a way to review your child's data, and the right to refuse further collection or use and have the data deleted. The operator may then end the child's access, within the limits of section 312.7, which bars requiring more information than an activity reasonably needs.

Getting intimate images removed

The TAKE IT DOWN Act (Public Law 119-12) was signed on May 19, 2025, and does two things. It made it a federal crime to knowingly publish an intimate image of an identifiable minor, whether real or an AI-generated "digital forgery", with intent to abuse, humiliate, harass or degrade the minor, or for sexual gratification. Separate offenses cover adults.

It also gave platforms one year to set up a removal process, so that duty began on May 19, 2026. The FTC announced it was enforcing the removal duty that day.

The duty applies to "covered platforms," meaning public sites and apps that mainly host user-generated content, including messages, videos, images and games. Email and internet service providers are excluded. So are sites built mainly around their own preselected content, unless their business is hosting nonconsensual intimate images. A written request must include four things:

A physical or electronic signature from the person shown, or someone authorized to act for them
Enough information for the platform to find the image
A short statement that the person believes in good faith the image was published without consent
Contact details

Each platform must post a clear, plain-language notice explaining how to submit a request. According to the FTC's compliance guidance, the duty covers real photos and videos as well as images created or altered with software or AI, and the person shown does not need an account on the platform. The FTC says violations can bring civil penalties of $53,088 per violation.

Illustrative example: a valid request reaches a platform at 9 p.m. on Friday, October 2, 2026. The 48-hour deadline is 9 p.m. on Sunday, October 4.

The law counts hours, not business days, so a weekend does not stop the clock. The platform must also make reasonable efforts to find and remove known identical copies. An edited or cropped version may not count as identical, so report each version you find.

For images taken when the person was under 18, NCMEC's Take It Down tool works differently. It creates a digital fingerprint, called a hash, of the image on your own device. Platforms that take part use that list of hashes to scan their public or unencrypted sites and apps. NCMEC notes that platforms may have limited ability to remove content that was already posted in the past, so the tool supplements a direct request to each platform rather than replacing one.

Age checks and the court fights

The Supreme Court changed the legal ground in Free Speech Coalition v. Paxton on June 27, 2025. By 6 to 3, it upheld Texas's requirement that sites with sexual content that is obscene for minors verify that visitors are 18 or older.

Because the law only incidentally burdens adults' speech, the Court applied intermediate scrutiny, a standard laws pass more easily. That ruling dealt with adult content. Laws covering general social media and app stores are still being fought over one by one.

App-store laws

Texas's SB 2420 requires app stores to verify each new account holder's age category: under 13, 13 to 15, 16 to 17, or adult. A minor's account must be linked to a parent account, and the parent must approve each individual download and purchase, including in-app purchases.

A federal district court blocked the law before its start date. On June 4, 2026, the Fifth Circuit paused those injunctions while the appeal proceeds, finding Texas likely to succeed. The challengers, a student group and an industry association, argue the law burdens access to protected speech. The Supreme Court denied their applications to lift the pause on July 6, 2026 (docket for the industry group's application). The appeal itself is not decided.

The other states are on later timetables. Utah's 2026 amendment, HB 498, moved app stores' and developers' duties to May 6, 2027, with existing accounts to be checked within 12 months after that. It removed the state agency's rulemaking role. It kept a parent's right to sue: a court must award the greater of actual damages or $1,000 per violation.

Louisiana's Act 185 of 2026 stopped the 2025 law from taking effect and re-enacted a version that begins July 1, 2027.

California's AB 1043 takes a different approach. From January 1, 2027, device operating systems must ask for a birth date or age at account setup and pass apps an age-bracket signal. Devices set up before then must get that prompt before July 1, 2027. Only the state attorney general can sue, for civil penalties of up to $2,500 per affected child for each negligent violation and $7,500 for each intentional one.

On September 10, 2026, the governor signed a package of bills. It includes AB 1856, a follow-up on the same age-verification signals, and AB 1709, on age restrictions for covered platforms. The governor's office says the package bars social media platforms from offering users under 16 addictive features such as autoplay and feeds based on their history. Neither bill is in effect yet.

State social-media laws

State law	What it requires	Court status as of October 3, 2026 (latest order checked)
Florida HB 3	No accounts for under-14s on platforms with certain addictive features; parental consent for ages 14–15	Enforceable: Eleventh Circuit stayed the injunction November 25, 2025, by 2 to 1; appeal argued March 10, 2026, not yet decided
Mississippi HB 1126	Age verification and parental consent for minors' social media accounts	Enforceable: the Supreme Court declined to lift the appeals court's stay on August 14, 2025; the Fifth Circuit heard the appeal in February 2026 and had not ruled
Tennessee Protecting Children from Social Media Act	Age verification; parental consent before a minor opens an account	Enforceable for now: no injunction. On August 28, 2026 the Sixth Circuit set aside the denial of an injunction and sent the request back to the trial court
Virginia SB 854	One hour per day per platform for under-16s unless a parent consents to change it	Blocked for NetChoice members by preliminary injunction, February 27, 2026; Virginia has appealed, and the Fourth Circuit refused to pause the injunction on April 10 and again on August 24, 2026
Louisiana Act 456	Age verification and parental consent for minors' accounts	Permanently blocked, December 15, 2025, only for ten named NetChoice members, whose services include Facebook, Instagram, WhatsApp, Snapchat, YouTube, X, Reddit, Pinterest, Nextdoor, Tumblr, Discord and Twitch; the state has appealed

Court records: Florida appeal docket, U.S. Supreme Court order in the Mississippi case, Tennessee opinion, Virginia case docket and Louisiana ruling.

NetChoice, an industry group, argues that these laws violate the First Amendment, and the states defend them as child-protection measures. In the Mississippi order, Justice Kavanaugh wrote that the law was "likely unconstitutional" under current precedent. He still voted to leave it enforceable because NetChoice had not shown the balance of harms favored it. He counted seven other federal district courts that had blocked similar laws by August 2025, including Florida's, which has since been paused on appeal. Other states' laws have their own cases, so check each one.

If your family travels abroad

In the UK, children's safety duties under the Online Safety Act became fully enforceable on July 25, 2025. Platforms must use "highly effective" age checks, such as facial age estimation, photo-ID matching or credit card checks. The checks keep under-18s away from pornography and from content that encourages self-harm, suicide or eating disorders. A US teen using these services in the UK may be asked to complete such checks.

In Australia, according to the eSafety Commissioner, age-restricted social media platforms have had to take reasonable steps since December 10, 2025 to stop Australians under 16 from creating or keeping accounts. eSafety's view is that Facebook, Instagram, Snapchat, Threads, TikTok, Twitch, X, YouTube, Kick and Reddit are covered, among others.

Online gaming and standalone messaging apps are excluded. Children and parents face no penalties, while platforms face court-imposed fines of up to A$109.2 million, according to eSafety's current figure. The eSafety page does not say how the rule treats visiting children's accounts.

Frequently asked questions

Does COPPA cover my 14-year-old?

No. COPPA protects personal information collected from children under 13, so it does not cover data a service collects from your 14-year-old. Some state laws discussed above set higher ages, such as ages 14–15 in Florida's consent rule and under 16 in Virginia's blocked law.

Can my child's school agree to an app on my behalf?

Sometimes. The FTC's COPPA FAQ says a school may consent as the parent's agent only when an operator collects students' information for the school's use and benefit, with no other commercial purpose. The operator must give the school the same notice a parent would get, and the operator, not the school, remains responsible for complying.

Is it legitimate for a site to ask for my photo ID before I consent?

It can be. Checking a government ID against databases is a recognized consent method, and so is matching a photo ID to a live image of the parent's face. For both methods, the rule requires the operator to delete the ID promptly after verification. For face matching, it must also delete the images.

Does NCMEC's Take It Down tool upload my child's photo?

No. According to NCMEC, the image or video stays on your device. Only the hash is added to a list that NCMEC shares with participating platforms. NCMEC also warns that posting the hashed image again later may get it flagged and could lead to a block on the account.

Does the 48-hour rule cover direct messages and email?

Email, no; messaging apps, often. Email and internet service providers are excluded from the law. A public service that mainly hosts user-generated content is covered, and the law's definition names "messages" as one example. The FTC lists messaging platforms among covered services and notes that intimate content may appear in messages. Neither the law nor the FTC's guidance spells out how the duty applies to private or encrypted chats, so file a request and keep a record of it.

What to do and where to complain

If an intimate image is posted: use the platform's TAKE IT DOWN removal form, which also applies to AI-generated images, and keep a copy of what you sent and when. If the image was taken before age 18, also use Take It Down. Report child sexual exploitation to NCMEC's CyberTipline. If a platform misses the 48-hour deadline, file a complaint at TakeItDown.ftc.gov.
To use COPPA rights: write to the contact listed in the service's privacy notice. Ask for a description of the types of data collected, a way to review your child's data, deletion of the data, and an end to further collection or use.
If a children's service ignores you: the FTC's parent guide to COPPA says to report it at ReportFraud.ftc.gov. Your state attorney general's consumer protection office enforces state laws, including Texas's app-store law.
Check the birth date on each account: age-based defaults and consent prompts depend on the age a service has on file. A wrong year can put a child in the wrong category.
Recheck before relying on a state law: the court orders in the tables above can change on appeal, so confirm a law's status before you count on it.