What the FTC Can Do About Social Media Practices Affecting Minors

Last updated 2 weeks ago. Our resources are updated regularly but please keep in mind that links, programs, policies, and contact information do change.

A child’s 13th birthday changes one of the clearest protections a parent can invoke against a social media company. Under the federal children’s privacy rule, covered services must let parents review and delete their child’s collected information. That rule protects children under 13.

For teenagers, the Federal Trade Commission has to look beyond that particular privacy law. It can challenge practices that are deceptive or that meet the FTC Act’s test for unfairness, but those cases require proving what the company did wrong. The concern about a child’s data may persist; the government’s route for acting on it changes.

The power depends on the practice

Section 5 of the FTC Act prohibits unfair or deceptive acts or practices in or affecting commerce. That makes the company’s conduct the focus: what it collects, what it promises, and how its product works. The FTC can investigate and restrict unlawful social media practices affecting minors, but the legal route and remedy depend on the conduct, the user’s age and the statute involved. The kind of company matters too: the FTC’s Section 5 authority excludes some businesses, including banks, federal credit unions, common carriers and air carriers.

The Children’s Online Privacy Protection Act (COPPA) defines a child as someone under 13. So COPPA does not cover everyone below adulthood: a privacy concern involving a teenager needs another legal route.

A separate law, the TAKE IT DOWN Act, addresses one kind of content: nonconsensual intimate images shared on social media, messaging, and image or video sharing apps and websites. Platforms the law covers must provide a request process and remove those images and known identical copies within 48 hours of a valid request. That duty covers real images and digital forgeries, including images created or altered using artificial intelligence. This is a specific removal obligation, not a general guarantee that every distressing post can be taken down.

Children’s privacy turns on data and age

COPPA’s rule applies to commercial websites and online services directed to children under 13 that collect their personal information. It also applies to general-audience services with actual knowledge that they are collecting personal information from children under 13. The child-directed assessment considers factors such as subject matter, visuals, child-oriented activities, language, advertising and evidence about the audience.

A general-audience operator is not required by COPPA to ask every visitor’s age, but later knowledge that a user is under 13 triggers the notice and parental-consent requirements. What matters is what the operator actually knows about its users, not the minimum age stated in its terms of service.

Covered operators must post a privacy policy, directly notify parents and obtain verifiable parental consent before collecting children’s personal information, subject to limited exceptions. Parents must be able to review and delete the collected information and prevent further collection or use. A child’s participation cannot be conditioned on providing more information than is reasonably necessary for the activity.

The amended COPPA rule took effect June 23, 2025, with most regulated entities required to comply by April 22, 2026. Parents can consent to collection and use of a child’s information while refusing third-party sharing, unless that sharing is necessary to provide the service. Sharing children’s information with third parties for targeted advertising requires separate parental consent.

The amended rule requires a written data-retention policy and permits keeping children’s information only as long as reasonably necessary for the specific purposes for which it was collected. It also requires a written information-security program with safeguards suited to the sensitivity of the data and the operator’s size and activities. The 2025 amendments also cover biometric identifiers, such as fingerprints or voiceprints, that can be used for automated or partly automated recognition of an individual.

The FTC issued an age-verification policy statement on February 25, 2026. It covers general-audience services and child-directed services whose primary audience is not children. Under it, the FTC will not bring a COPPA enforcement action against an operator that collects personal information solely to check a user’s age without first getting parental consent, if the operator meets specified safeguards. Those safeguards include age-only use, prompt deletion, vetted third parties and written assurances, clear notices, reasonable security, and reasonable steps to ensure accurate age results. The policy addresses a narrow collection problem; it is not permission to repurpose an age check into advertising data.

Unfairness and deception can reach teenagers

The FTC treats a claim, omission or practice as deceptive when it is likely to mislead a consumer acting reasonably in the circumstances and is material. Material means likely to affect the consumer’s conduct or decision about a product or service. When a practice primarily affects or targets a particular group, the FTC evaluates reasonableness from that group’s perspective. A safety claim aimed at young users must be assessed as those users would understand it, rather than assuming an adult audience.

A practice is unfair under the statute only if it causes or is likely to cause substantial injury that consumers cannot reasonably avoid and that is not outweighed by benefits to consumers or competition. The FTC may weigh established public policy as evidence, but policy cannot be the primary basis for calling a practice unfair. To challenge an app’s design as unfair, the FTC therefore has to show the injury, why users could not reasonably avoid it and why benefits do not outweigh it. Describing a feature as addictive does not, by itself, meet that test.

The FTC announced a settlement with Epic Games, creator of the video game Fortnite, on December 19, 2022. The FTC alleged that Epic collected children’s information without parental consent and enabled real-time voice and text communications for children and teens by default. The announced settlement required voice and text communications to be turned off by default for children and teens.

When it amended the children’s privacy rule, the FTC declined to finalize proposed requirements intended to limit push notifications to children without parental consent, while saying it remained concerned about such techniques. The final rule did not enact every proposed limit on engagement features, so a case about a specific design practice still has to meet the law the agency invokes.

An investigation and a remedy are different steps

For possible unfair or deceptive practices, the FTC’s consumer-protection bureau uses civil investigative demands to obtain documents, testimony, written reports or answers. Section 6(b) of the FTC Act also permits the FTC to compel annual or special reports about companies’ business and practices. The agency can collect that information without first finding a violation.

An instruction to stop unlawful conduct, a payment to the government and a refund to consumers are different kinds of relief. A contested administrative case can lead to an order to cease and desist, with review by the Commission and a federal appeals court. Violating a rule the FTC has issued against unfair or deceptive practices, known as a trade-regulation rule, can bring civil penalties when the violator knew, or objective circumstances fairly imply it knew, that the rule prohibited the conduct. A fine is therefore not automatic; it depends on a rule violation and on what the violator knew.

In its 2021 decision in AMG Capital Management v. FTC, the Supreme Court held that Section 13(b) of the FTC Act, the provision under which the agency asks courts for injunctions, does not authorize equitable monetary relief such as restitution or disgorgement. Those remedies restore money to victims or require a wrongdoer to surrender unjust gains. Stopping conduct through that provision does not itself create a power to recover money.

The Epic Games case produced two settlements: one included a $275 million penalty under the COPPA rule, which the FTC called the largest ever obtained for violating one of its rules, and a separate one provided $245 million for consumer refunds concerning billing practices. The COPPA penalty was not money paid to parents for privacy harms; the refunds concerned billing.

What platform cases and research establish

Google and YouTube agreed in 2019 to pay a $170 million civil penalty to settle FTC and New York allegations that YouTube collected children’s information without parental consent. The settlement also required a system allowing channel owners to identify child-directed content and training for employees who work with those owners. That remedy addressed how a platform identifies the child-directed material it hosts.

In the NGL Labs case announced in July 2024, the FTC and Los Angeles district attorney alleged that the anonymous messaging company falsely claimed its AI moderation would filter cyberbullying and other harmful messages. A court order filed July 14, 2024 required an age screen and barred users who identified themselves as under 18. That agreed order applies to one company’s specified practices; it is not a rule barring every anonymous app for every minor.

A Look Behind the Screens, an FTC staff report published in September 2024, drew on responses to Section 6(b) orders sent to nine social media and video-streaming companies, including Snap, YouTube, Facebook (now Meta) and the owners of TikTok and Twitch. Staff reported that services often treated teenagers like adults, and that some companies did not delete all user data in response to deletion requests. Staff recommended stronger teen privacy protections and federal legislation to address the gap left by COPPA’s age boundary.

A staff report can document problems and recommend change without creating a new enforceable duty for every company it discusses. Likewise, a settlement’s promised safeguards are not a measurement of whether young users’ experience improved.

Reporting a problem and following the next change

The FTC accepts reports about scams and bad business practices at ReportFraud.ftc.gov and uses them to identify trends and investigate cases. FTC staff explains that reports can support law-enforcement investigations, but the FTC and other agencies cannot resolve cases for individuals. A report contributes evidence; it is not a promise of personal representation or compensation. A parent who wants to see or delete data collected from a child under 13 should ask the service’s operator; reporting to the FTC serves a different purpose.

Reports about a covered platform’s failure to provide an intimate-image removal process or promptly remove those images can be made at TakeItDown.ftc.gov. The removal request itself goes to the platform; that site is for reporting a platform that fails to act on one.

The February 25, 2026 age-verification policy statement announced plans to review COPPA’s treatment of age checks. The FTC said the policy would last until final amendments were published or it was withdrawn. When the FTC proposes a rule, its notice asks the public for comments that the agency considers before deciding what to do next. The announced review starts a process; it does not itself amend the COPPA rule.