What Is COPPA and How Does It Protect Kids Using AI Toys
By Curio Team
COPPA was built in 1998 to protect children's privacy on the internet, at a time when the biggest risk was mostly kids putting their address into a random website pop-up. But now, there are toys on the market with microphones and cameras, and thankfully those same laws are being clarified to protect children to this day. You may be asking, how do these laws actually work?
What Is COPPA
COPPA is a federal law that protects children under 13 by requiring parental permission before websites (and other online services) can collect their personal information. More recently, it was clarified that biometric data, like a voice or a face, also counts as personal information. Companies can be fined by the FTC for breaking these rules.
COPPA Origins
COPPA stands for the Children's Online Privacy Protection Act, a federal law passed in 1998 and enforced by the Federal Trade Commission (FTC). At the time, it was passed largely because of the shocking discovery that 90% of children's websites were collecting some portion of children's data. The law focused on requiring a parent's signature before taking a child's data, making it very difficult to collect information on children under age 13, the age group the law targeted.
What Information Does It Protect
Personal information isn't left up for interpretation under COPPA; it was clearly defined when the law was written. Under the law itself, this is what is protected:
- First and last name
- Home or physical address, including street name and city/town
- Email address
- Telephone number
- Social Security number
- Any other identifier that the FTC determines could allow someone to physically or online contact a specific child
- Any other information about the child or their parents that a service collects online and combines with one of the identifiers above
It's actually stricter than you'd think. That last category covers a wide range of things, literally anything that could be used to identify the child, even IP addresses, which were added to the definition in 2013. This clause is what keeps getting redefined through the AI era, and it's why COPPA relates to AI toys at all.
Legal Grey Area(13+)
COPPA only applies to children under age 13, so once a child turns 13, are companies suddenly free to collect their information? Not exactly. There's a patchwork of state laws that mostly cover minors above the age of 13.
Another thing worth keeping in mind: how exactly is a website supposed to collect information on a teenager without risking that it's actually collecting it from a child? This is why most kids' websites avoid tracking almost entirely, since it risks violating COPPA outright.
Here are a few examples of COPPA-like laws states have passed to try to bridge that gap:
- Maryland: prohibits selling the personal data of minors under 18 or using it for targeted advertising, triggered once a business knows or "should have known" the user is under 18.
- Arkansas: enacted a COPPA-like statute for minors under 16, effective July 1, 2026.
- Colorado: its Privacy Act amendment (effective October 2025) bars targeted advertising and data sales involving minors without opt-in consent.
- California: its Age-Appropriate Design Code was supposed to take effect in mid-2024 but has been blocked by a federal court since March 2025, pending appeal. A live example of the next grey area.
- New York: its Child Data Protection Act (effective June 2025) requires consent before processing minors' data, from the teen themselves if 13-17, or from a parent if under 13.
- Virginia: its CDPA amendments require informed consent to process data from minors 13-17 unless it's strictly necessary for the service, and cap minors at one hour of daily social media use unless a parent consents to more.
- Connecticut: requires opt-in consent and high-privacy defaults for minors' data under its design code amendments, and starting July 2026 treats neural and biometric data as "sensitive," triggering the same opt-in requirement.
New Developments/Clarification
Since the FTC keeps clarifying the law's implications, the rules have gotten a lot more defined as the internet has evolved. COPPA now covers the following additional data:
- Screen or username: when it functions as online contact information, letting someone contact the child directly.
- Persistent identifiers: cookies, IP addresses, or unique device IDs that can track a child across sites or over time.
- Photos, videos, or audio files: any file containing a child's image or voice.
- Geolocation information: precise enough to identify a street name and city or town.
- Biometric identifiers: added by the FTC's 2025 amendments, covering fingerprints, voiceprints, handprints, retina and iris patterns, genetic data, gait patterns, and facial templates.(This is where AI toys are primarily affected)
- Government-issued identifiers: also added in 2025, expanding beyond Social Security numbers to include state ID card numbers, birth certificate numbers, and passport numbers.
How Does COPPA Affect AI Toys
AI toys got pulled under the COPPA umbrella almost immediately upon creation. The FTC has made it clear that AI toys are not exempt, and fall under "website or online service," a definition that extends to any internet-connected device, including AI toys. For compliance purposes, a child interacting with an AI toy is treated the same as a child interacting with a website.
Under COPPA, voice data is personally identifiable information. So any AI toy that can listen and respond must comply with COPPA. However, there's a slight carve-out when it comes to audio data. Audio that's captured and then immediately deleted is allowed, think translation or speech used just to process a command. This can happen without parental consent, but it should be clearly stated in the privacy policy.
2025 COPPA Amendment
In 2025, the FTC added voiceprints and facial recognition to the list of biometric identifiers that could be used to identify a child. That means toys with personalization features, like recognizing which child they're talking to, or a toy with a camera that could identify a child, now need a parent's consent.
How Does COPPA Affect Curio?
Curio starts at the beginning, asking for parental consent and keeping full transparency about your child's data from the start. We do not take any child's data without express parental consent first. Additionally, Curio doesn't keep any raw audio from a child; it turns their speech into a transcript, which is then processed by AI to generate a response.
However, those transcripts between the AI and the child are automatically stored for 90 days, though you can view and delete them at any time. This makes Curio one of, if not the most, transparent AI toys on the market.
In addition to not keeping raw voice data, we don't train our AI on children's data either, which is why we don't need separate consent for training. We only take as much data as we need to maintain full functionality.
What Parents Should Do
For starters, parents should always look for a stated COPPA compliance claim. If you don't see the word COPPA anywhere, that's an immediate red flag. Also make sure a privacy policy and license agreement are both available. If the privacy policy is available, take a look: does it include a data retention policy in writing? If not, that's also a red flag. Pay attention to where your child's data actually goes. Does it get shared with third parties? Does it get sold for advertising? With Curio, this isn't a concern, but that doesn't mean it isn't a concern for the rest of the companies out there.
As a parent, it's your job to stay on top of things and monitor the media your child is consuming. That doesn't mean watching everything your child does at all times, but taking an active approach to the type of things they're interacting with, whether that's books or AI toys.
Conclusion/TL;DR
COPPA is a cornerstone law protecting children's privacy and information under the age of 13. Recently, the law was updated to protect children's biometric data, like their face and voice, a huge leap in safety. COPPA compliance should be the bare minimum when searching for an AI toy, and ultimately, it's your child's data. You deserve to know where it goes.
Sources:
FTC’s Website
**https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa**
