Smart toy or app for a child under 13? The COPPA rights parents have, and 2026's changes

Coding robots, smart speakers, tablets and game platforms are on a lot of holiday lists. If the child is under 13, a federal law gives you, the parent, a say over what the company collects. Updated rules that companies had until April 22, 2026 to follow make that say stronger.

What's the rule?

The Children's Online Privacy Protection Act and the FTC's COPPA Rule cover websites, apps and online services directed to children under 13. The FTC's FAQs say that includes internet-enabled gaming platforms, connected toys, smart speakers and voice assistants.

Before collecting, using or sharing a child's personal information, these services must notify parents directly and get their consent. The FTC says personal information includes a child's name, address, phone number or email, their location, photos, videos and audio recordings, and persistent identifiers such as an IP address that can track a child over time.

What changed in 2026

The FTC amended the COPPA Rule in a notice published on April 22, 2025. The changes took effect on June 23, 2025, and companies had until April 22, 2026 to comply, apart from a few provisions for industry self-regulatory programs that run on their own dates. The main changes:

• Separate consent for sharing. Services must get a separate, verifiable consent from a parent before disclosing a child's information to third parties for targeted advertising or other purposes.
• No keeping data forever. Companies can keep a child's information only as long as needed for the purpose it was collected for, and can't keep it indefinitely.
• More kinds of data covered. Biometric identifiers and government-issued identifiers now count as personal information.

What you can do as a parent

• Say yes to some things and no to others. The FTC says consent isn't all or nothing. You can let a service collect your child's information but not share it with others.
• See what they hold. You have the right to review the information collected about your child, once the company confirms you're the parent.
• Withdraw consent and have it deleted. You can stop further collection or use, and ask for your child's information to be deleted.

The cases behind it

On September 3, 2025, the FTC took action against Apitor, which sells programmable robot toys for children aged 6 to 14. The FTC said the toy's Android app included a third-party software kit, JPush from a Chinese developer, that collected children's precise location without telling parents or asking consent. The order requires Apitor to make sure third-party software it uses follows COPPA, and to delete data collected in violation unless parents consent. A $500,000 penalty was suspended because the company can't pay.

The same month, the FTC said Disney agreed to pay a $10 million penalty over claims it didn't designate some of its YouTube videos as directed to children, which let YouTube collect viewers' data for targeted ads without parental consent.

A worked example

This is an illustration, not a real case.

Alex buys a $79.99 app-controlled robot for a 9-year-old. When the app is set up, it asks for a parent's consent. Alex reads the privacy policy, agrees to the data the robot needs to work, and declines sharing with advertising partners, which under the updated rule needs its own consent. Six months later, the child loses interest. Alex emails the company to withdraw consent and asks it to delete the child's information.

What to do now

1. Read the box and the app listing for an age rating and a link to the privacy policy before you buy.
2. Look for what it collects: voice, video, location, and who it shares data with.
3. Set it up yourself before the gift is opened, so you see the consent screens.
4. Give only the consent you're happy with, and refuse third-party sharing if you don't want targeted ads.
5. Ask for deletion when the toy or app is no longer used.
6. Report problems at ReportFraud.ftc.gov.

Questions

Does COPPA cover my 14-year-old? No. The rule protects children under 13. The FTC says stronger protections may still be appropriate for teens.

Do I have to agree to everything to use the toy? No. You can consent to collection but refuse sharing with third parties.

Will the FTC sort out my problem with a company? Not individually. The FTC says it doesn't resolve individual consumer disputes. For help with your own complaint, contact your state attorney general.

Ways to save

Thinking about a learning gift instead of a gadget? Promo Magpie lists offers from CodaKid, with a 14-day free trial of its self-paced coding courses, and Novakid, with 10% off when two children sign up. As with any service for kids, read the privacy policy before you sign up.

When you shop through Promo Magpie, part of the commission the shop pays us goes to the charity or club you pick. You pay the same price.

Sources: FTC: changes to the children's privacy rule, January 2025, FTC: COPPA final rule amendments, April 22, 2025, FTC: Complying with COPPA FAQs, checked November 8, 2026, FTC: protecting your child's privacy online, checked November 8, 2026, FTC: action against robot toy maker Apitor, September 3, 2025, FTC consumer alert on Disney settlement, September 3, 2025