State Children’s Privacy Law Tracker & Map (2026)

Before collecting personal information from a child under 13, a covered operator must post a clear privacy notice, obtain verifiable parental consent, collect only what is reasonably necessary, keep it secure, give parents access and deletion rights, and not retain it longer than needed.

2025 amended Rule: The FTC’s amended COPPA Rule (finalized January 2025) adds separate opt-in parental consent before disclosing a child’s data to third parties (including for targeted advertising), a written data-retention policy that bars indefinite retention, a mandatory written information-security program, and an expanded definition of “personal information” covering biometric identifiers and government IDs. Announced by the FTC Jan 16, 2025 and published in the Federal Register Apr 22, 2025; effective June 23, 2025. The compliance deadline has passed: the final rule gave regulated entities until April 22, 2026 to comply, except as to § 312.11(d)(1), (d)(4) and (g), which ran earlier. The amended Rule is fully operative today, and the eCFR versioner shows Part 312 unamended since June 23, 2025.

Federal watch: Moving in Congress but NOT enacted (as of October 1, 2026): Senate Commerce held Executive Session 24 on August 5, 2026 in SR-253 and advanced four of the five kids’ online-safety measures on the agenda. KOSA (S. 1748) was ordered to be reported favorably by voice vote, as amended by the Blackburn substitute as modified; it has not been formally reported, carries no written report, and is not yet on the Senate calendar. The same markup advanced the Youth AI Privacy Act (S. 4199), the CHATBOT Act (S. 4407) and the Children’s Artificial Intelligence Toy Safety Act of 2026 (S. 5171), each by voice vote as amended by a substitute. The SCREEN Act (S. 737) drew a 15-13 party-line roll call, but the committee’s release says a revote will be needed to comport with Senate rules on in-person attendance; the bill’s official record still shows no committee action, and Executive Session 25 on September 16, 2026 took up no kids’ online-safety measure. The Kids Off Social Media Act (S. 278) is not awaiting markup: it was reported without amendment and placed on the Senate Legislative Calendar as No. 108 on June 30, 2025, where it remains. The GUARD Act (S. 3062), which would require age verification for AI companions and bar minors from them, was reported by Senate Judiciary on May 11, 2026 and sits on the same calendar as No. 406. The KIDS Act (H.R. 7757, an omnibus carrying a SCREEN Act title, an AI-chatbot title, and modified KOSA and COPPA 2.0 text) passed the House 267-117 under suspension of the rules on June 29, 2026 and was referred to Senate Commerce on July 13, 2026, with no committee action since. COPPA 2.0 (S. 836) passed the Senate by unanimous consent on March 5, 2026 and has been held at the desk in the House since March 16, 2026, never referred to a House committee. Separately, the FTC’s February 25, 2026 policy statement grants COPPA enforcement discretion for personal data collected solely to verify age; it remains in force by its own terms until the Commission publishes final rule amendments or withdraws it, and no such amendments have published.