FTC Relaxes COPPA Enforcement to Boost Age Verification Tech Adoption

The Federal Trade Commission (FTC) has fundamentally altered the compliance landscape for digital platforms with the release of its 'Enforcement Policy Statement Promoting the Adoption of Age-Verification Technology' on February 25, 2026. This strategic pivot addresses a growing friction between the Children’s Online Privacy Protection Act (COPPA) and a wave of new state laws requiring websites to verify user ages. Traditionally, COPPA created a compliance dilemma: operators were required to obtain verifiable parental consent before collecting personal information from children under 13, yet the very act of collecting data to determine a user's age could trigger a violation if that user turned out to be a minor. By signaling a relaxed enforcement stance, the FTC is effectively clearing a path for the broader deployment of age-assurance tools.

This policy shift follows a high-profile Age Verification Workshop held by the Commission on January 28, 2026, where leadership signaled that existing frameworks were struggling to keep pace with technological advancements. FTC Chair Andrew Ferguson and Commissioner Mark Meador have both championed the move, framing age-verification technologies as essential infrastructure for the modern internet. Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, characterized these tools as some of the most 'child-protective technologies' to emerge in decades. For the venture capital and startup ecosystem, this represents a significant market signal, likely to accelerate investment into privacy-preserving biometrics, third-party identity verification, and zero-knowledge proof technologies.

“

FTC Chair Andrew Ferguson and Commissioner Mark Meador have both championed the move, framing age-verification technologies as essential infrastructure for the modern internet.

However, the FTC’s flexibility is not a blanket immunity. The policy statement specifically applies to 'general' and 'mixed' audience operators—those services that cater to a broad demographic rather than those specifically targeting children. Sites primarily directed at children under 13 remain under the strict, original interpretation of COPPA; they are expected to assume their audience is underage and must align their data practices accordingly without relying on the new enforcement discretion. For mixed-audience platforms, the 'sole purpose' clause is the critical guardrail: any data collected for age verification must not be repurposed for marketing, profiling, or any other commercial use.