Right on time for the new school year, the FTC rolled out multiple enforcement actions related to children’s privacy, highlighting a renewed focus on federal regulation of minors’ personal data and the evolving challenges of establishing effective, privacy-protective age assurance solutions. The FTC also announced a Section 6(b) inquiry into the impacts of AI chatbot companions on children and teens.

On September 2, 2025, the FTC announced a $10 million settlement with Disney over the unlawful collection of children’s data in violation of the Children's Online Privacy Protection Act (COPPA). The complaint alleges that Disney posted kid-directed YouTube videos without labeling them as “Made for Kids”, allowing the company to collect personal data from children and use it for targeted advertising without parental notification and consent.

The same day, the DOJ filed an FTC settlement with China-based “app-enabled” robotic toy maker Apitor in California federal court over claims that Apitor allowed a Chinese analytics provider to gather geolocation data from children under 13 without parental consent in violation of COPPA. The settlement includes a $500,000 penalty and compliance requirements, including vendor oversight for COPPA requirements and disgorging unlawfully collected data. In conjunction with the settlement, the FTC reiterated the importance of getting verifiable parental consent even when a third party is collecting data on behalf of the company.

On September 3, 2025, the FTC announced a joint order with Utah against the operators of Pornhub and other pornography-streaming sites, over charges that the operators did not block content involving child sexual abuse material (CSAM) and nonconsensual material (NCM) despite claiming that this content was “strictly prohibited” under a zero-tolerance policy. The order imposes a $15 million fine and numerous compliance requirements related to preventing NCM and CSAM content and establishing age and consent verification requirements.

On September 11, 2025, the FTC formally announced the launch of a Section 6(b) inquiry on the impacts of AI-powered chatbots on children and teens. The FTC reported that it has issued orders to seven companies that provide “consumer-facing AI-powered chatbots”, citing the power of generative AI to mimic human communications and interpersonal relationships. In particular, the goal is to determine what steps companies have taken “to evaluate the safety of their chatbots when acting as companions, to limit the products’ use by and potential negative effects on children and teens, and to apprise users and parents of the risks associated with the products.” The FTC is seeking a range of information from the companies, including how the companies monetize user engagement. The FTC’s inquiry follows the passage of a novel New York law that places guardrails for providers of AI companion models. 

Why This Matters:

These announcements reinforce federal and state regulators’ continued focus on children’s data privacy issues across a range of industries and contexts. Though the FTC under the current administration has signaled its intent to scale back enforcement in certain areas and limit its privacy focus to dedicated statutes within the FTC’s purview, such as COPPA, it appears the Agency is pressing forward with enforcements related to children’s data, use of AI, and other areas—some of which falls under the Agency’s expansive Section 5 authority. These actions underscore the importance of understanding existing and evolving privacy practices related to children’s and minors’ personal data, as a rapidly complex patchwork of state-level laws targets children’s privacy practices through age-appropriate design codes, age assurance requirements, content restrictions, heightened requirements for notice and consent for a range of ages, and prohibits certain practices outright.

Key Compliance Requirements:

1. Assess updated COPPA Rule and COPPA requirements for gaps and implement corresponding controls, including:
   • Updated direct and online notices
   • Separate consents for non-integral third-party sharing
   • Updated methods of obtaining verifiable parental consent
   • Heightened security program requirements
   • Establishing robust vendor diligence
   • Implementing retention and deletion requirements'
   • Additional safe harbor program reporting obligations
2. Determine whether amendments to COPPA Rule definitions impact the compliance program (e.g., “mixed audience website or online service.")
3. Understand how SDKs incorporated into apps work and make sure SDK vendors are COPPA compliant.
4. Inventory the state privacy laws with special rules for minors’ and children’s data to determine the impacts on the business, including notices, consents, opt-ins/opt-outs, design requirements, and restricted or prohibited practices. For global businesses, international regulations should be evaluated as well.
5. Determine where age assurance/age verification is required and assess appropriate methods.
6. Establish strong data minimization controls with respect to sensitive data, including children’s and teens’ data, and avoid unnecessary collection. Evaluate guardrails related to chatbot use. 
7. Ensure that privacy notices accurately represent the collection, use, sharing, and handling of minors’ data, particularly when combined with other sensitive data, such as geolocation, health information, and biometrics.

How Nelson Mullins Can Help:

Our Global Privacy & Security team can assist with:

1. Conducting compliance assessments for children’s/minors’ personal data and other sensitive data.
2. Reviewing and updating privacy policies, notices, and technical configurations, including age assurance considerations.
3. Providing training and guidance to mitigate enforcement risk.

If you have questions or would like to schedule a compliance review, please contact your Nelson Mullins attorney or a member of our Global Privacy & Security team.