Children's Privacy in 2026: Enforcement Moves Into Product Design

Last year, we highlighted significant changes to the Children’s Online Privacy Protection Act (COPPA) Rule and the growing number of state laws focused on age-appropriate design. In 2026, the focus has shifted from lawmaking to enforcement. Two major settlements announced in August illustrate the scale of that shift: Meta agreed to pay up to $18 billion to resolve claims brought by nearly all U.S. states concerning the treatment of young users on Facebook and Instagram, while TikTok and ByteDance reached a $400 million settlement with the Department of Justice over alleged COPPA violations.

The significance of the settlements goes beyond monetary awards. The Meta settlement imposes restrictions on how teenagers may use Facebook and Instagram, while the TikTok settlement was contingent on whether parental-consent and deletion mechanisms worked as required. Together, the settlements show federal regulators and State Attorneys General examining not only what companies say about children’s privacy, but also how products are designed, how age-related information is acted upon, and what happens to children’s data after it is collected. At the same time, California recently passed a new suite of laws to protect children from perceived harms from social media and artificial intelligence, and Congress is considering legislation that would extend federal protections to teenagers and regulate advertising, recommendation systems, AI chatbots, gaming platforms, and other features used by minors.

Meta Settlement Pushes Children’s Privacy Into Product Design

On August 26, 2026, Meta agreed to pay up to $18 billion over ten years to resolve claims by nearly all U.S. states concerning Facebook and Instagram. The settlement ended a federal trial involving claims by California, Colorado, Kentucky, and New Jersey that Meta violated state consumer-protection laws by designing its platforms in ways that harmed young users and misleading the public about their safety. The litigation also included claims by 29 states that Meta violated COPPA by knowingly collecting personal information from children without parental consent and using that information to train generative AI models.

What makes the settlement particularly significant from a privacy-compliance perspective is the nature of the relief. For the next decade, Meta agreed to limit teenagers’ use of Facebook and Instagram to two hours per day and to block use between midnight and 6:00 a.m. unless a parent consents. Meta will also disable most push notifications to teenagers during school hours and strengthen protections intended to keep minors from accessing age-restricted content. The settlement does not, however, require Meta to discontinue personalized recommendations or targeted . At least $5 billion of the settlement funds are contingent upon YouTube, TikTok, and Snap implementing similar controls. YouTube’s CEO has dismissed the idea of joining the settlement.

These requirements illustrate how closely children’s privacy and product design are becoming intertwined. Historically, a company evaluating COPPA compliance might have focused principally on whether it provided the required notice, obtained parental consent, and appropriately collected and retained children’s personal information. The Meta settlement reaches further into the user experience itself: when a minor can access the service, how long the minor can use it, when the platform may prompt the minor to return, and what content the minor may encounter.

The allegations concerning generative AI are also notable. The states alleged that Meta used personal information collected from children to train its generative AI models. The settlement does not establish that any particular use of minors’ data for model training violates COPPA, but the allegation puts AI training squarely within the range of downstream data uses that regulators may examine. Companies developing or deploying AI therefore should understand whether datasets used for model development or improvement include information collected from children and whether the permissions and disclosures governing the original collection support those later uses.

TikTok Settlement Reinforces COPPA’s Operational Requirements

The TikTok settlement, announced only days before the Meta resolution, presents a different but complementary lesson. On August 21, 2026, the Department of Justice announced a $400 million settlement with TikTok, ByteDance, and affiliated entities to resolve litigation arising under COPPA. TikTok agreed to pay $300 million immediately and another $100 million upon entry of an order vacating an earlier consent decree involving its predecessor, Musical.ly, although at a September 21, 2026 hearing the court indicated it did not immediately plan to vacate the consent decree. The DOJ described the settlement as one of the largest recoveries ever obtained in a COPPA case.

The government’s allegations focused on familiar COPPA requirements rather than a novel theory of liability. The 2024 lawsuit alleged that TikTok and ByteDance collected personal information from children under 13 without obtaining the required parental consent, failed to honor parents’ requests to delete their children’s accounts, and failed to delete accounts even after learning that the users were under 13.

This settlement is a reminder that even as children’s-privacy regulation expands into platform design, advertising, and AI, the basic operational requirements of COPPA remain important enforcement targets. A parental-consent process must work as represented; a deletion mechanism must result in the required deletion; and information showing that a user is a child must be handled consistently with the company’s legal obligations.

The DOJ also noted that, after the lawsuit was filed, TikTok made significant changes to its compliance and privacy practices, including measures intended to strengthen protections for younger users, improve age-related controls, and increase parental oversight. The settlement resolved allegations only, without a determination of liability.

For businesses, the broader point is that privacy compliance cannot end with a written policy or front-end user interface. Companies should be able to demonstrate that age signals, parental permissions, account restrictions, deletion requests, retention rules, and related workflows operate consistently across the systems that actually process the data.

California Enacts Social Media and AI Laws to Protect Children

The enforcement activity comes as the California legislature has taken steps to expand protections for minors online. On September 10, 2026, Governor Gavin Newsom signed a package of laws focused on increasing children’s privacy and preventing harms to children in both social media and artificial intelligence. These laws include:

AB 1709, which aims to eliminate for users under 16-years-old purportedly “addictive features” in social media platforms, including video autoplay features and other features designed to maximize engagement. The law also requires social media companies to verify a user’s age and take reasonable steps to prevent children from accessing those features.
SB 1119, or “Adam’s Law,” which adds guardrails around AI companion chatbots. Under the law, chatbot operators evaluate and address potential safety harms to children. Additionally, companies must determine a user’s age, and, if under the age of 18, the company’s chatbot must have parental controls, age-appropriate disclosures, and default usage limits of one continuous hour and two total hours per day. The law also restricts what these companion chatbots may say to children to limit emotional dependence on the chatbot and to avoid excessive praise or flattery.
AB 2246, or the “Youth Social Media Protection Act,” which requires online services that are “likely to be accessed by children” to provide high-privacy settings for child users. The law also prohibits companies from profiling any children by default or collecting more personal information than is needed to deliver the service. This law replaces the California Age-Appropriate Design Code Act.

Taken together, the laws dovetail with state and federal regulators’ increased scrutiny of social media companies and children’s privacy.

Congress Is Considering a Broader Federal Framework

While California has been quick to take action, the same cannot be said for a federal framework. Congress is once again considering, but has not passed, a substantial expansion of federal protections for minors online. On June 29, 2026, the House passed the Kids Internet and Digital Safety Act (KIDS Act), H.R. 7757, by a 267–117 vote. The package combines portions of a number of previously separate proposals, including the Kids Online Safety Act (KOSA), COPPA 2.0, legislation addressing messaging and gaming features, AI chatbot safeguards, and data-broker requirements.

For privacy teams, the COPPA 2.0 provisions are among the most consequential. The House package would bring 13-year-olds within the parental-consent framework and create protections for teenagers through age 17. . The proposal would impose restrictions on individual-specific advertising to minors and add requirements concerning data minimization, retention, and certain transfers of minors’ information.

The package also illustrates how federal children’s-privacy legislation is expanding beyond traditional data-collection rules. Among other things, it would address minor-facing default settings and recommendation systems, communications and geolocation controls, and AI chatbots. The revised House bill generally preserves state laws that provide greater protection to minors, meaning that enactment would not necessarily eliminate the growing state-law compliance patchwork.

Significant differences remain between the House and Senate approaches. In particular, the House version expressly rejects a general duty of care, while the Senate version of KOSA uses a broader duty-of-care framework. The Senate Commerce Committee unanimously advanced KOSA on August 5, and the Senate previously passed its own version of COPPA 2.0 in March. Whether and in what form those competing approaches ultimately become law remains unresolved.

Takeaways

Companies that operate services used by children or teenagers—or that otherwise process minors’ personal information—should treat the recent settlements and legislation as an indication that children’s privacy is becoming an increasingly operational area of compliance. Going forward, companies should consider the following:

Treat children’s privacy as a product-governance issue. Privacy, legal, engineering, product, and trust-and-safety teams should evaluate not only collection and disclosure practices, but also minor-facing defaults, notifications, recommendation systems, time-management tools, messaging features, and other design choices.
Test consent, age, and deletion workflows from end to end. Companies should confirm that parental-consent mechanisms work as described, that information indicating a user is a minor is acted upon appropriately, and that deletion requests are carried through all systems in which the relevant information is maintained.
Map downstream uses of minors’ data. Businesses should understand whether information collected from children or teenagers is later used for advertising, personalization, analytics, audience development, AI model training, or other secondary purposes, and whether those uses are consistent with the permissions and representations made when the data was collected.
Do not wait for Congress to act. The KIDS Act and related Senate proposals could significantly broaden federal obligations, but the Meta and TikTok matters demonstrate that regulators already have substantial enforcement tools under existing law. Companies should continue to prepare for federal developments while also accounting for state laws that may impose additional or more protective requirements.

Fall Privacy Webinar – November 17, 2026

Join Scott Hall and members of the Coblentz Data Privacy Team on Tuesday, November 17, 2026 for a timely discussion of the latest developments shaping the privacy, cybersecurity, and AI landscape and what they mean for your business. Learn practical steps to manage risk and gain insight into emerging state and federal AI developments; new and amended consumer privacy laws; enforcement trends involving children’s and sensitive data; and key privacy litigation and regulatory developments. RSVP for the webinar here.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.