Google and YouTube paid a record $170 million settlement for letting advertisers quietly track kids watching toy review channels. That number should be stapled to every creator brief touching a family vlog, a youth sports app, or a back-to-school giveaway. Minors and data collection in creator campaigns is no longer a legal footnote, it’s a budget line and a vendor requirement. Building a COPPA safe workflow means knowing exactly where children’s data enters your funnel before you brief a single creator.
Why “We Don’t Target Kids” Won’t Save You
Most brand marketers assume COPPA is someone else’s problem: a kids’ app issue, a toy company issue, a YouTube Kids issue. That assumption is exactly what got Google and YouTube into trouble. The FTC and New York Attorney General alleged that while YouTube claimed to be a general-audience site, some of YouTube’s individual channels, such as those operated by toy companies, are child-directed and therefore must comply with COPPA. YouTube wasn’t running a kids’ platform on paper. It was running one in practice, and regulators looked at the actual audience, not the marketing copy.
The legal trigger here is “actual knowledge.” The Rule applies to operators of commercial websites and online services directed to children under the age of 13 that collect personal information, and it also applies to operators of sites and online services geared toward general audiences when they have “actual knowledge” they are collecting information from children under 13. Translation for a brand team: if your influencer program runs a quiz funnel, a giveaway, or a CRM capture form that a family-content creator pushes to a largely under-13 audience, and your team has any signal that the audience skews that young, you may already be an “operator” under the Rule.
You don’t need to market to children to inherit COPPA risk. You just need enough visibility into your audience that regulators can argue you should have known.
What Changed When the Amended COPPA Rule Took Full Effect
The compliance bar moved substantially this year. Amendments to the FTC’s Children’s Online Privacy Protection Act Rule took effect on April 22, 2026, with FTC leadership underscoring its commitment to robust enforcement. For brand and agency teams running creator programs, the practical changes worth knowing are:
- Separate consent for third-party sharing. Beyond the existing requirement to allow parents to consent to collection of their child’s data without consenting to disclosing that data to third parties, the amended Rule adds an exception to the consent requirement for disclosure that is “integral” to the service and newly requires eligible operators to obtain separate parental consent for third-party disclosure.
- AI training and advertising are never “integral.” The FTC has noted that disclosure necessary to provide the product or service would qualify as integral, while disclosure “for monetary or other consideration, for advertising purposes, or to train or otherwise develop artificial intelligence technologies” would not be. That has direct implications if your team is feeding creator-collected engagement data into a model, a scoring tool, or an AI-generated ad variant. For a closer look at how that liability flows through vendor contracts, see our breakdown of AI training data clauses.
- Hard limits on retention. Covered operators must only retain personal information for as long as reasonably necessary to fulfill a specific purpose, and the rule explicitly states operators cannot retain the information indefinitely.
- Expanded “personal information.” The final rule’s amended definitions expand personal information to include biometric identifiers as well as government-issued identifiers. That sweeps in facial-recognition age checks and some AR filter data captured during branded content.
The direction of travel is also notable. The Commission’s policy statement says it will not bring an enforcement action against operators of general audience and mixed audience services that collect, use, or disclose personal information for the sole purpose of determining a user’s age without first obtaining verifiable parental consent, provided they do not retain the information longer than necessary and meet several other conditions. That’s a narrow carve-out for age verification tech, not a green light for broader data collection, and brands should not read it as license to skip parental consent elsewhere in the funnel.
Where Brands Actually Touch Children’s Data in Creator Campaigns
This is the part most compliance checklists skip. COPPA exposure rarely shows up in the sponsored post itself. It shows up in the infrastructure wrapped around the campaign.
- Lead gen quiz funnels. A creator drives traffic to a “find your skin type” or “build your dream setup” quiz that captures email, birthdate, or school. If that creator’s audience skews young, the intake form is now a COPPA touchpoint. We’ve mapped the broader consent and storage risks in quiz funnel lead gen campaigns.
- CRM and retargeting pools. Pixel data from a family-vlog landing page gets pulled into a CRM, then used to build lookalike audiences. That’s precisely the kind of downstream use the amended Rule targets. See our audit framework for creator CRM data practices.
- UGC moderation and comment harvesting. Vendors scraping comments for sentiment or UGC rights clearance can inadvertently collect identifying details from child commenters. This is one reason vendor vetting matters so much; our guide on UGC moderation vendor vetting covers the diligence questions to ask before signing.
- Platform-level data pulls. Brands pulling creator-platform analytics or audience exports for reporting need to confirm what’s actually in those exports. Our piece on creator platform data audits walks through how liability shifts when third-party data is involved.
- Giveaways and affiliate codes. Entry forms that collect name, address, and age for shipping prizes are a classic, overlooked COPPA trigger when the sponsoring creator’s audience includes a meaningful share of under-13 viewers.
Building the COPPA Safe Workflow: Five Gates Before You Brief a Creator
A COPPA safe workflow doesn’t need to slow campaigns down. It needs to move the compliance questions earlier, before media spend commits and before a landing page goes live.
- Audience-composition gate. Before briefing, pull real audience data on the creator’s channel, not just the brand’s intended target. A website or online service will not be considered “directed to children” just because some children visit the site, but if the intended audience includes kids under 13, even as only a portion of that audience, the operator must comply with the Rule’s requirements when collecting personal information. Document the pull and the date. If a dispute arises later, this record is your evidence of diligence.
- Data-touchpoint mapping. List every place the campaign collects data: landing pages, quiz funnels, comment sections, giveaway forms, AR filters, DMs. If any touchpoint reaches a creator whose audience is meaningfully under 13, treat that touchpoint as a COPPA zone, not the whole campaign.
- Consent and disclosure language, separated. The amended Rule requires direct parental notice to include how the operator intends to use the child’s information, the categories of third parties to which it will be disclosed, and the purposes for such disclosure, and eligible operators must include much of this information on their services as well. If any vendor in your stack can’t produce this language, that’s a disqualifying red flag, not a negotiation point.
- Vendor written assurances. Every third party touching campaign data, moderation tools, CRM platforms, analytics dashboards, needs a written assurance of data security practices on file before launch. Before sharing children’s personal information with vendors or other third parties, operators must take reasonable steps to confirm those parties are capable of maintaining appropriate data security and must obtain written assurances to that effect.
- Retention and deletion triggers. Set an automatic deletion clock on any data collected through a campaign that could reach minors. Operators must only retain personal information for as long as reasonably necessary to fulfill a specific purpose for which it was collected. Build that into your CRM workflow now rather than scrambling during an audit.
The YouTube case wasn’t decided on intent. It was decided on what the platform knew and kept monetizing anyway. A documented workflow is your best evidence that your brand didn’t do the same thing.
The Age Verification Wrinkle
One recent development actually gives brands a narrow, usable tool. The FTC announced it will not bring an enforcement action against certain operators that collect, use, and disclose personal information for the sole purpose of determining a user’s age via age verification technologies. If your campaign landing page needs to screen for age before collecting any other data, that screening step itself can now be built without triggering a parental-consent requirement, provided the data collected is used only for age determination and then deleted. That’s a meaningful design option for brands running mixed-audience contests or app downloads tied to creator content.
Family Vloggers Carry a Second, Parallel Risk
Campaigns featuring child creators or family-vlog content carry an additional layer beyond COPPA: state financial-protection laws in places like Illinois, California, and Minnesota that require earnings from child-featuring content to be held in trust. That obligation sits with the creator or parent, not the brand, but it doesn’t erase the brand’s exposure. The data-collection exposure is separate and runs directly to the brand whenever a campaign’s intake forms, pixels, or CRM touch a child’s information, regardless of who legally owns the trust obligation. Treat “does this content feature a minor, or reach an audience that skews that young” as a mandatory intake question, not an afterthought discovered after the content goes live.
FAQs
Does COPPA apply if our brand never directly collects data from children?
Yes, if a vendor or creator is collecting it on your behalf or with your knowledge. COPPA also applies to operators when they have “actual knowledge” they are collecting personal information directly from users of another site or online service directed to kids under 13. Outsourcing the data collection does not outsource the liability.
What counts as “personal information” under the updated rule?
The definition is broader than name and email. The final rule expands the definition of personal information to include biometric identifiers as well as government-issued identifiers, on top of the existing categories like persistent identifiers, photos, and geolocation.
Can we use a simple age-gate checkbox to stay compliant?
Self-declared birthdates are still legally permitted for general audience sites, but they are not a complete shield on their own. A site is not automatically “directed to children” just because some children visit, but if your intended audience includes kids under 13, even as a portion of your audience, you must comply with the Rule’s requirements when collecting personal information. An age gate helps establish process, but audience composition evidence can still override a checkbox.
Do we need separate consent for sharing data with our ad tech stack?
In most cases, yes. The amendments require operators to obtain separate and additional verifiable parental consent prior to disclosing a child’s personal information to third parties like advertisers and data brokers. A single bundled consent covering both collection and disclosure no longer satisfies the rule.
What’s the single biggest mistake brands make with minors and data collection?
Assuming the platform or the creator has already handled it. Most enforcement actions, including the YouTube case, were built on evidence that the operator knew the audience skewed young and kept collecting data anyway. A documented, repeatable COPPA safe workflow is the difference between demonstrating diligence and explaining negligence.
Start this week: pull real audience data on every creator currently in your pipeline, flag any channel with meaningful under-13 reach, and freeze paid amplification on those campaigns until your data-touchpoint map and vendor assurances are on file. That single gate will catch most of the exposure before it becomes a seven-figure problem.
Top Influencer Marketing Agencies
The leading agencies shaping influencer marketing in 2026
Agencies ranked by campaign performance, client diversity, platform expertise, proven ROI, industry recognition, and client satisfaction. Assessed through verified case studies, reviews, and industry consultations.
Moburst
-
2
The Shelf
Boutique Beauty & Lifestyle Influencer AgencyA data-driven boutique agency specializing exclusively in beauty, wellness, and lifestyle influencer campaigns on Instagram and TikTok. Best for brands already focused on the beauty/personal care space that need curated, aesthetic-driven content.Clients: Pepsi, The Honest Company, Hims, Elf Cosmetics, Pure LeafVisit The Shelf → -
3
Audiencly
Niche Gaming & Esports Influencer AgencyA specialized agency focused exclusively on gaming and esports creators on YouTube, Twitch, and TikTok. Ideal if your campaign is 100% gaming-focused — from game launches to hardware and esports events.Clients: Epic Games, NordVPN, Ubisoft, Wargaming, Tencent GamesVisit Audiencly → -
4
Viral Nation
Global Influencer Marketing & Talent AgencyA dual talent management and marketing agency with proprietary brand safety tools and a global creator network spanning nano-influencers to celebrities across all major platforms.Clients: Meta, Activision Blizzard, Energizer, Aston Martin, WalmartVisit Viral Nation → -
5
The Influencer Marketing Factory
TikTok, Instagram & YouTube CampaignsA full-service agency with strong TikTok expertise, offering end-to-end campaign management from influencer discovery through performance reporting with a focus on platform-native content.Clients: Google, Snapchat, Universal Music, Bumble, YelpVisit TIMF → -
6
NeoReach
Enterprise Analytics & Influencer CampaignsAn enterprise-focused agency combining managed campaigns with a powerful self-service data platform for influencer search, audience analytics, and attribution modeling.Clients: Amazon, Airbnb, Netflix, Honda, The New York TimesVisit NeoReach → -
7
Ubiquitous
Creator-First Marketing PlatformA tech-driven platform combining self-service tools with managed campaign options, emphasizing speed and scalability for brands managing multiple influencer relationships.Clients: Lyft, Disney, Target, American Eagle, NetflixVisit Ubiquitous → -
8
Obviously
Scalable Enterprise Influencer CampaignsA tech-enabled agency built for high-volume campaigns, coordinating hundreds of creators simultaneously with end-to-end logistics, content rights management, and product seeding.Clients: Google, Ulta Beauty, Converse, AmazonVisit Obviously →