Gen Z and Youth Marketing: Where COPPA Stops

What to take away

What COPPA and 15 U.S. Code section 6501 actually cover

The Children's Online Privacy Protection Act is a short federal statute, 15 U.S. Code section 6501, that directs the Federal Trade Commission to write rules protecting children's online privacy. The statutory text defines the actors and the terms that the FTC then fills in.

It is the starting point for any legal analysis of teen data limits because it fixes who counts as a child and what counts as covered activity, as set out in the 15 U.S. Code section 6501 definitions.

COPPA reaches operators of commercial websites and online services directed to children under 13. It also reaches general-audience services that have actual knowledge they are collecting personal information from a child under 13. A site does not escape the statute by claiming a broad audience if the design, content or ad inventory points at young children.

The law is enforced by the FTC and, for certain entities, by state attorneys general. Civil penalties per violation are set by statute and adjusted for inflation, which is why enforcement actions against large platforms have produced eight-figure settlements.

The FTC's COPPA statute page lays out the boundaries that marketing teams must treat as fixed.

For marketers, the practical question is not whether a campaign is cool. It is whether the property is directed to children, and whether the data flows behind it trigger COPPA or a state law. That determination belongs in writing before creative is approved.

Email campaigns should follow the same age and data rules as other youth campaigns; review gen z email marketing benchmarks alongside the audience and data flows.

Directed to children, in practice

The FTC looks at subject matter, visual content, music, language, characters, ad content and whether child celebrities appear. It also weighs whether the service is advertised to children and whether it has a child-focused audience. A cooking app with cartoon hosts and a coin economy is a different case from a general recipe site.

Age screening matters. Asking for a birth date and then ignoring the answer is worse than not asking. If a user enters an age under 13 and the service keeps collecting, the operator has actual knowledge and loses the benefit of the doubt.

Mixed-audience services can comply by treating all users as children, or by segmenting. Segmentation requires neutral age gates, no encouragement to lie, and technical controls that keep under-13 users out of data-collecting features. It also requires documentation that the controls work.

What the statute does not cover

COPPA does not regulate advertising content directly. It regulates data collection and the use of children's personal information. Advertising limits for children come from the self-regulatory CARU guidelines and from the FTC's general authority over deceptive practices.

COPPA does not set a national age of digital consent for teens. A 14-year-old is outside the statute. Their protection comes from state privacy laws, platform terms of service and sector rules such as FERPA in schools.

COPPA does not ban targeted advertising to children outright. It bans certain uses of personal information collected from children without consent, including many behavioral advertising practices. The distinction matters when reviewing ad tech partners.

The FTC COPPA Rule: personal information, verifiable parental consent and retention

The FTC COPPA Rule is the operative regulation. It defines personal information broadly, sets the consent standard, requires a privacy notice and caps how long data may be kept. The text of the COPPA Rule is the reference document for compliance teams.

Persistent identifiers are the point that catches youth marketers. A device ID, cookie ID or hashed email used for behavioral advertising or audience measurement can be personal information when tied to a child. Collecting it without consent is a violation even if no name is attached.

Verifiable parental consent must be obtained before collection, unless a narrow exception applies. Exceptions cover collecting a parent's contact information to get consent, responding once to a child's request, protecting a site's security, and some internal operations. Each exception has conditions and a short retention limit.

The consent methods the FTC accepts

The Rule lists methods that are presumed verifiable. These include signed consent forms returned by mail or fax, a credit card or debit card transaction, a toll-free call staffed by trained personnel, a video call with trained personnel, and government-issued ID checked against a database. Email alone is not enough for most uses.

Email plus is a limited option. A service may send an email to the parent, then confirm with a second contact such as a phone call or a letter. This method is only allowed for internal use of the data, not for disclosure to third parties or behavioral advertising.

The FTC has approved self-regulatory safe harbor programs with their own consent mechanisms and oversight. Examples include the kidSAFE Seal Program, ESRB Privacy Certified, iKeepSafe and TRUSTe. A safe harbor changes the compliance path, not the underlying obligation.

Retention and deletion

The Rule requires operators to keep personal information only as long as reasonably necessary for the purpose collected, then delete it securely. It also requires a reasonable procedure to delete a child's information at a parent's request.

A retention schedule should name each data type, its purpose, its storage location and its deletion trigger. Vendors must be able to honor the same schedule. If an ad partner cannot delete on request, it should not receive the data.

The notice requirement

The Rule requires a clear, understandable privacy notice describing what is collected, how it is used, whether it is disclosed, and that the parent can review and delete the child's information. The notice must be posted where it is easy to find, with a direct link from the home page and from every page where personal information is collected.

The six-step COPPA compliance plan applied to youth marketing data collection

The FTC publishes a six-step COPPA compliance plan for businesses. It is written for operators, but it maps cleanly onto marketing workflows. The steps below adapt that plan to campaign data collection.

A seventh operational step sits under all six: training. Media buyers, community managers and agency partners need to know which audiences are off limits and how to escalate a suspected under-13 user. The FTC's children's privacy hub collects enforcement actions and guidance that make good training material.

Worked example: a toy brand's launch

A toy brand plans a campaign for a new building set. The target is families with children aged 6 to 11. The brand buys YouTube placements, runs a sweepstakes and builds a landing page with an email signup.

The sweepstakes collects names and addresses from entrants. Because the site is directed to children, the brand needs verifiable parental consent before collecting that information. It adds a consent step with a credit card verification and a toll-free call option.

The landing page uses a pixel for retargeting. That pixel creates a persistent identifier tied to a child, so it cannot run without consent. The brand removes it from the child-directed page and runs contextual ads instead.

The email list is retained for 12 months, then purged. The vendor contract requires deletion within 30 days of a parent request. The brand documents each decision in a data map, which becomes the audit trail.

CARU guidelines and self-regulatory limits on under-13 advertising

The Children's Advertising Review Unit, part of BBB National Programs, runs the main self-regulatory program for advertising to children in the United States. CARU guidelines cover advertising to children under 13 and, in some sections, to teens. They are not statutes, but compliance is expected by major platforms and by state attorneys general.

CARU guidelines require that advertising be truthful, not misleading and not exploitative of children's inexperience. They address blurring between advertising and content, pressure to buy, and the use of celebrities and characters. They also cover privacy practices and online safety.

For digital campaigns, CARU expects clear separation between ads and content. Native ads and influencer posts aimed at children must be identifiable as advertising. That means disclosure in language a child can understand, placed where it is seen before the pitch.

CARU can refer cases to the FTC. It also publishes decisions that function as guidance. A brand that ignores a CARU decision risks both reputational damage and a federal referral, so the guidelines belong in the creative review checklist.

Where CARU and COPPA overlap

COPPA governs data. CARU governs claims and presentation. A campaign can violate one without the other, and often violates both at once. A child-directed app that collects device IDs without consent breaches COPPA; the same app running an ad that looks like gameplay breaches CARU.

Both regimes expect age-appropriate design. That means no manipulative loops, no dark patterns pushing purchases, and no data collection hidden behind a game feature. Design reviews should log these checks alongside legal sign-off.

Teen-directed advertising under CARU

CARU's teen provisions address alcohol, vaping, gambling and other age-restricted products. They expect advertisers to avoid implying that such products are necessary for social success, and to avoid media placements where a significant teen audience is unintended.

For mainstream brands, the practical rule is to keep teen campaigns honest about commercial intent. Disclosure fatigue is not a defense. If a teen cannot tell that a post is paid, the campaign fails the guideline.

Teen-adjacent targeting: where COPPA stops and state law begins

COPPA's boundary is under age 13. For ages 13 to 17, COPPA no longer supplies the privacy rule; obligations depend on the state, the data involved, the business and the platform. California, Colorado, Connecticut, Virginia and other states have privacy laws that can affect teen data, but their requirements are not identical.

California requires businesses to obtain opt-in consent before selling or sharing the personal information of consumers under 16, and under 13 the consent must come from a parent. That is a state rule, separate from COPPA, and it applies to many campaigns that fall outside the federal statute.

State laws that may matter include California's CCPA, as amended by the CPRA; Illinois' Biometric Information Privacy Act (BIPA); Texas' Capture or Use of Biometric Identifier Act (CUBI); and Washington's My Health My Data Act. California Civil Code section 1798.120(c) requires opt-in consent to sell or share personal information for consumers under 16, with parental consent for children under 13. Florida's social-media law for minors and Texas' Securing Children Online through Parental Empowerment (SCOPE) Act also address minors online. Applicability varies by law, data and business, and the state laws' current status should be checked before a campaign launches.

Age assurance is the hard operational problem. Platforms offer age signals, but accuracy varies. Marketers should not assume a platform's age gate satisfies their own legal duty. Document what the platform provides and what you add on top. This is a recurring planning question when deciding whether a youth campaign's audience and data practices comply with state privacy laws.

The 13-to-17 gray zone

Teens can consent to data processing under many state laws, but not always for sensitive data. Precise geolocation, health data and biometric data often require opt-in consent regardless of age. Ad tech that infers health conditions from browsing is a high-risk area.

Platform terms add another layer. Major social platforms restrict ad targeting for users under 18, limiting interest categories and location precision. Those restrictions change, so campaign setups should be reviewed each quarter against current platform policy, alongside the gen z content marketing work that shapes where teen audiences actually spend time.

Consent language matters. A teen-facing privacy notice should be readable by a 13-year-old without a law degree. Plain language is not just good practice; regulators cite it when assessing whether consent was informed.

State attorneys general as enforcers

State attorneys general can bring COPPA actions under 15 U.S.C. § 6504 and enforce their own privacy statutes. In California, the California Privacy Protection Agency and the California Attorney General have enforcement roles under the CCPA. Check the applicable state's attorney general and privacy regulator, along with its current statutes and regulations, before launching a campaign.

FTC advertising rules that also apply to youth campaigns

Privacy compliance does not clear the ad itself. Youth-facing health and wellness claims are separately subject to FTC advertising law. Claims must be truthful, not misleading and supported by competent and reliable scientific evidence. That standard applies to supplements, apps, devices and programs.

Testimonials and influencer posts are treated as advertising. If an influencer says a product helped them focus or lose weight, that is a claim the brand must be able to substantiate. Disclosures must be clear and hard to miss.

The FTC's endorsement guides require a clear and conspicuous disclosure of a material connection, placed so it is seen before the viewer acts. A buried hashtag or a disclosure only in a bio does not meet the standard. For youth audiences, the disclosure should use words a child or teen understands.

Native advertising must be identifiable as advertising. The FTC has brought cases where an ad looked like editorial content or a news article. For youth-facing placements, the label should appear at the top of the content, not after the first scroll.

Influencer campaigns and youth audiences

Influencer campaigns for youth brands should include a written brief on disclosure, a review step before posting, and a takedown process. Brands are responsible for what their influencers say about the product, including claims made in live streams.

Platform tools that label paid partnerships help, but they do not replace the brand's own disclosure requirement. A platform label plus a spoken disclosure is safer than either alone. Keep records of the brief and the final post for at least the campaign period plus a year.

Community and creator campaigns still need clear disclosures; see our notes on gen z discord community marketing when reviewing those placements.

Health claims and minors

Claims about children's development, attention, sleep or mood are held to a high standard. The FTC expects substantiation for the specific claim made, not just for the ingredient. If the evidence is for adults, the ad should not imply it applies to children.

Advertising that suggests a health product can solve a social problem for a teen can also raise CARU issues. The combination of a health claim and a social pressure message is a common trigger for complaints.

Documenting a gen z and youth marketing data map for audits

A data map is the single document that makes an audit survivable. It lists every data element collected from youth audiences, where it comes from, where it goes and when it is deleted. Without it, a regulator or a platform partner will assume the worst.

Start with the campaign, not the database. For each campaign, list the audience, the age range, the data collected, the legal basis, the vendors and the retention period. Then reconcile that list against what the ad tech stack actually does.

Include vendor flow-down terms. Every contract with an ad tech partner, analytics provider or influencer platform should require COPPA compliance where applicable, deletion on request, and notification of any breach. If a vendor refuses, remove it from youth campaigns.

Document age assurance. Record what age signal you use, its accuracy limitations and what happens when a user is identified as under 13. If the answer is that nothing happens, the audit will not go well.

Checklist for the audit file

Keeping the map current

Review the map quarterly and after any platform policy change. State laws are still moving, and platform teen targeting rules change without much notice. A map that is a year old is a liability. Good Gen Z market research starts with the same discipline: name the decision, then collect only the data that serves it.

Assign an owner. A named person, not a committee, should hold the map and sign off on new youth campaigns. That single change prevents most of the drift that causes violations.

Common questions