While the UK has recently announced its intention to ban children under 16 from social media, with a measure that the current Prime Minister plans to introduce to Parliament before Christmas, the United States presents a very differentpicture. In fact, the US has no comparable federal move. Instead, it has a 28-year-old federal baseline, a patchwork of state laws and a wave of constitutional litigation that is challenging children’s data protections at every turn. In the privacy world, such instability can easily translate into a compliance risk. Here is where things stand.
The federal picture
The Children’s Online Privacy Protection Act (COPPA) was enacted in 1998 and remains the primary federal law governing children’s data in the United States. It requires operators of online services that are directed at children, or who have actual knowledge they are collecting data from children, to obtain verifiable parental consent before collecting personal data from children under 13. At the statutory level, it hasn’t been substantially updated since it was passed. Thismeans that the current federal law on children’s online privacy predates the arrival of smartphones and social media.
The Federal Trade Commission (FTC) amended the implementing rule in 2025, with a compliance deadline of April 2026. The amendments significantly expand obligations around parental consent, data security, retention and transparency: that’s the most meaningful regulatory update to the COPPA framework in nearly three decades. However, the statute itself remains structurally narrow: it covers under-13s only and focuses on data collection rather than design, algorithmsor addictive product mechanics.
A few federal efforts have attempted to fill that gap over the years. COPPA 2.0, which would extend protections to teenagers under 17 and restrict targeted advertising directed at minors, passed the Senate by unanimous consent on 5 March 2026 but has not cleared the House. The Kids Online Safety Act (KOSA), which would impose a duty of care on platforms to mitigate harms to minors arising from certain design features such as recommendation algorithms and autoplay, passed the Senate in 2024 but died at the end of that Congress after stalling in the House. A Senate version of KOSA, including the duty of care standard, is under consideration in the current Congress. Separately, on 29 June 2026, the House has passed its own package, the KIDS Act. That includes a modified version of KOSA (without the duty-of-care provision) and a version of COPPA 2.0 and is now before the Senate. Whether the Senate will approve the House approach, amend it or insist on a different version remains uncertain. None of these measures is currently law.
Absent a federal reform, and within a system where states cannot go below the federal baseline but are free to go further, states have taken matters into their own hands. Yet the picture remains unsettled.
State laws and the constitutional challenge
At least a dozen US states have passed laws specifically targeting children’s online safety and data privacy. Several have modelled their approach on the UK’s Age-Appropriate Design Code, requiring platforms to act in children’s best interests by design, conduct data protection impact assessments before offering products that children are likely to access and apply privacy-protective defaults. Others have introduced age verification mandates, parental consent requirements or restrictions on algorithmic feeds.
However, the pattern that follows is now consistent: state passes a law, then NetChoice, a trade association representing major technology companies including Google, Meta and TikTok, files a constitutional challenge arguing that the law violates the First Amendment to the American Constitution. Courts have already granted injunctions in Arkansas, Utah, Virginia, Colorado and elsewhere.
The challenges typically rest on two arguments: that child safety laws unlawfully restrict free speech and that key terms like “best interests of children” and “materially detrimental” are too vague to give businesses clear guidance on what compliance actually requires.
Three cases illustrate the range of outcomes.
California
California’s Age-Appropriate Design Code Act (CAADCA), enacted in 2022 and modelled on the UK’s design code, requires businesses providing online services likely to be accessed by children to prioritise children’s privacy and best interests by design. It covers anyone under 18. The law requires data protection impact assessments and privacy-protective defaults and prohibits practices detrimental to children’s health or wellbeing.
The law has never been fully enforceable and has faced constitutional challenge since before it came into force. As of March 2026, following the Ninth Circuit’s most recent ruling, several of its most important provisions remain blocked on vagueness grounds, including restrictions on how children’s data may be used and a prohibition on manipulative design practices. The DPIA requirement also remains blocked. However, the court allowed the coverage definition and the age estimation requirement to take effect. The case is ongoing and the compliance picture for companies in scope remains uncertain: it will shift as proceedings progress. Therefore, close monitoring of developments is advisable.
Maryland
Maryland’s Age-Appropriate Design Code Act took effect in October 2024. It applies to businesses that meet certain size thresholds and do business in Maryland. The law requires them to act in the “best interests of children” when offering online products that people under 18 are likely to access, complete data protection impact assessments for each such product and to restrict data practices inconsistent with that standard. A DPIA deadline for existing products passed in April 2026. Penalties for intentional violations can reach $7,500 per affected child and $2,500 for negligent violations.
A constitutional challenge is ongoing, with a federal court finding in November 2025 that the case could proceed. The law remains enforceable in the meantime. So, even if the legal questions around the law’s core standard remain unresolved, the compliance obligation stands now.
Ohio
Ohio’s Social Media Parental Notification Act, passed in 2023, required parental consent before children under 16 could use social media and gaming apps, and obliged companies to provide their privacy guidelines to inform families of what content would be censored on their child’s profile. It never came into force, and in April 2025 a federal court struck it down on First Amendment grounds. Ohio appealed and recently, on 18 June 2026, the Sixth Circuit reversed that decision. It may now come into effect. This shows how the legal status of any given law can change direction more than once.
Looking ahead
The US children’s data protection landscape is in a state of continued legal flux. The US requires a different compliance approach from the EU or UK: less about implementing a settled framework and more about tracking a contested one. That means ongoing monitoring of which state laws are in force and which are enjoined is imperative. It also means that designing for children’s privacy as a product principle rather than waiting for legal certainty before acting is the safer approach.
If you would like to discuss how your organisation’s approach to children’s data holds up across jurisdictions, please contact our team.
