• by Wendy Davis  @wendyndavis, January 16, 2025

The Federal Trade Commission on Thursday finalized new restrictions on companies' ability to serve behaviorally targeted ads to children under 13.

The new rules effectively require operators of websites and apps to obtain opt-in consent from parents at least twice before transferring known children's data to outside companies that facilitate behavioral advertising -- broadly meaning ads served based on children's activity over time or across apps.

First, the companies will have to obtain parents' consent to collect children's personal data, including data stored in cookies or other pseudonymous identifiers. Next, companies will have to tell parents the identities or categories of third parties that collect children's personal data, and then obtain separate parental consent before sharing that data for behavioral targeting purposes.

Previously, website operators only needed to get a single consent from parents before using behavioral targeting strategies to serve ads to children.

The new double opt-in requirement “will give parents greater control over whether their kids’ data is disclosed to third parties, including for purposes of targeted advertising,” FTC Chair Lina Khan stated Thursday.

“When the amendments go into effect, operators of child-directed sites or online services will need to obtain separate verifiable parental consent before disclosing children’s personal information to third parties,” Khan stated.

She added that the new rules also prohibit companies from denying children access to a website or service if their parents don't consent to behavioral advertising.

The FTC voted 5-0 to approve the new rules, but Commissioner Andrew Ferguson -- President-elect Donald Trump's choice to head the agency -- said in a separate statement that there were "serious problems" with the final regulations.

Ferguson said he agreed that website operators should disclose the “specific third parties” that will receive children's data, but added that he doesn't think website operators should have to obtain parental consent every time there's a change in third-party ad tech companies.

“The Commission could have clarified that such a change is material for purposes of requiring new consent only when facts unique to the new third party, or the quantity of the new third parties, would make a reasonable parent believe that the privacy and security of their child’s data is being placed at materially greater risk,” he stated.

The Association of National Advertisers previously opposed the new restrictions on behavioral advertising to children.

“Unnecessary and overly burdensome parental consent requirements hinder children’s access to online products and services,” the organization argued in comments filed with the agency last year, several months after the FTC proposed updating the regulations.

“Burdensome requirements cause consent fatigue rather than providing parents with meaningful control over personal information associated with children,” the organization wrote.

The regulations finalized Thursday additionally include data minimization requirements that prohibit website operators from retaining children's personal data indefinitely.

The FTC also expanded the definition of children's personal data to include biometric identifiers.

The advocacy group Electronic Privacy Information Center praised the FTC's move, calling it “a critical step to improving privacy and data security protections for children as they engage in the online world.”

The rules apply when website operators know they are collecting data from children -- which often is the case when sites or apps are geared toward children, or when children disclose their age to website operators.

The regulations implement the Children's Online Privacy Protection Act, a 27-year-old law that bans website operators from knowingly collecting "personal information" from children without their parents' permission.

The agency launched a review of the regulations in 2019, when it sought comments from the public on topics including how to apply the law to platforms that allow third parties to post content.

The regulations were last updated in 2013, when the FTC first required companies to obtain parental consent before using behavioral advertising techniques on children. At the time, the agency expanded the definition of “personal information” to include not only names, addresses and phone numbers, but also “unique identifiers” that can link the children's activity across more than one site or app -- such as tracking cookies, device serial numbers and, in some cases, IP addresses.