COPPA Is 26 Years Old: Why America's Children's Data Law Is Failing in the AI Age

The Children's Online Privacy Protection Act was signed in 1998. The internet was dial-up. Google didn't exist. Facebook wouldn't launch for six years. The iPhone was nine years away. COPPA's core requirement: websites must get "verifiable parental consent" before collecting personal information from children under 13. In 2026, AI systems are building behavioral profiles of children from voice recordings, facial expressions, reading patterns, emotional responses, and sleep data. TikTok's algorithm identifies users as potentially under 13 — and continues serving them content anyway. EdTech platforms used in public schools have access to everything a child does during the school day. The gap between what COPPA was designed to do and what it actually does is the size of the entire modern internet. What COPPA Actually Requires COPPA applies to operators of websites or services directed to children under 13 , or operators with actual knowledge they're collecting data from children under 13.