A new year. A new administration in Washington. While protecting kids and teens is likely to remain an issue that drives legislation, litigation, and policy discussions in 2025, issuance of 1,000 Executive Orders on day one of the Trump Administration may result in new or changed priorities and some delay in the effective date of the recently updated Children’s Online Privacy Protection Rule (COPPA Final Rule).
We start with a recap of significant actions affecting kids and teens from the beginning of 2024 to the end of the Biden Administration in January 2025 and some early action by the Trump Administration.
Key Actions Affecting Kids and Teens:
- FTC Regulation and Reports
- The Federal Trade Commission (FTC or Commission) kicked off 2024 with proposed rules updating the Children’s Online Privacy Protection Act (COPPA) and issued a COPPA Final Rule in the closing days of the Biden Administration. FTC Commissioner and now Chair Andrew Ferguson identified several areas requiring clarification, and publication of the COPPA Final Rule will likely be delayed due to President Trump’s Executive Order freezing agency action.
- The FTC released a highly critical staff report, A Look Behind the Screens: Examining the Data Practices of Social Media and Video Streaming Services, in September of 2024. The report, based on responses to the FTC’s 2020 6(b) FTC Act orders issued to nine of the largest social media platforms and video streaming services, including TikTok, Amazon, Meta, Discord, and WhatsApp, highlighted privacy and data security practices of social media and video streaming services and their impacts on children and teens.
- Policy debates centered on Artificial Intelligence (AI), and one of the Commission’s final acts was a January 17, 2025, FTC Staff Report on AI Partnerships & Investments 6(b) Study.
- The Project 2025 report, Mandate for Leadership 2025: The Conservative Promise, recommends possible FTC reforms and highlights the need for added protections for kids and teens and action to safeguard the rights of parents. The report stresses in particular the inability of minors to enter into contracts.
- The Federal Trade Commission (FTC or Commission) kicked off 2024 with proposed rules updating the Children’s Online Privacy Protection Act (COPPA) and issued a COPPA Final Rule in the closing days of the Biden Administration. FTC Commissioner and now Chair Andrew Ferguson identified several areas requiring clarification, and publication of the COPPA Final Rule will likely be delayed due to President Trump’s Executive Order freezing agency action.
- Litigation and Enforcement: the FTC
- On July 9, 2024, chat app maker NGL Labs settled with the FTC and Los Angeles District Attorney after they brought a joint enforcement action against the company and its owners for violations of the COPPA Rule and other federal and state laws.
- On January 17, 2025, the FTC announced a $20 million settlement of an enforcement action alleging violations of COPPA and deceptive and unfair marketing practices against the developer of the popular game Genshin Impact. In addition to an allegation that the company collected personal information from children in violation of COPPA, the complaint alleged that the company deceived users about the costs of in-game transactions and odds of obtaining prizes. As a result, the company is required to block children under 16 from making in-game purchases without parental consent.
- On July 9, 2024, chat app maker NGL Labs settled with the FTC and Los Angeles District Attorney after they brought a joint enforcement action against the company and its owners for violations of the COPPA Rule and other federal and state laws.
- Federal and State Privacy Legislation
- Federal privacy legislation, including the Kids Online Safety Act (KOSA 2.0) and its successor, the Kids Online Safety and Privacy Act (KOSPA), failed to make it through Congress, although 32 state attorney generals (AGs) sent a letter to Congress urging passage of KOSA 2.0 on November 18, 2024.
- Last year, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Rhode Island enacted comprehensive privacy laws, and they include provisions affecting children and teens. Those states join California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia.
- Federal privacy legislation, including the Kids Online Safety Act (KOSA 2.0) and its successor, the Kids Online Safety and Privacy Act (KOSPA), failed to make it through Congress, although 32 state attorney generals (AGs) sent a letter to Congress urging passage of KOSA 2.0 on November 18, 2024.
- Litigation and Enforcement: the Courts
- Throughout 2024, state attorneys general and private plaintiffs brought litigation targeting social media platforms and streaming services, alleging that they are responsible for mental and physical harm to kids and teens.
- Legal challenges to more state social media laws arguing they violate First Amendment rights, among other grounds, were filed or were heard by courts in 2024, and legal action has continued into this year. On February 3, 2025, the tech umbrella group NetChoice filed a complaint in Maryland district court against the Maryland Age-Appropriate Design Code Act (Maryland Kid’s Code or Code), which was enacted on May 9, 2024. The complaint, which is similar to NetChoice’s recent challenges to other state social media laws, alleges that the Code violates the First Amendment by requiring websites “to act as government speech police” and alter their protected editorial functions through a vague and subjective “best interests of children” standard that gives state officials “nearly boundless discretion to restrict speech.” In 2024, NetChoice and its partners successfully obtained injunctions or partial injunctions against social media laws on constitutional grounds in Utah on September 9, 2024, in Ohio on February 12, 2024, and, at the eleventh hour, on December 31, 2024, against California’s Protecting Our Kids from Social Media Addiction Act. NetChoice’s complaint against Mississippi HB 1126 was heard by the U.S. Court of Appeals for the Fifth Circuit on February 2, 2025, but a decision has not yet been published as of the time of this writing.
- On August 16, 2024, a panel of the U.S. Court of Appeals for the Ninth Circuit partially affirmed the district court’s opinion that the data privacy impact assessment (DPIA) provisions of the California Age Appropriate Design Code Act (CAADCA) “clearly compel(s) speech by requiring covered businesses to opine on potential harms to children” and are therefore likely unconstitutional. However, the appeals court vacated the rest of the district court’s preliminary injunction “because it is unclear from the record whether the other challenged provisions of the CAADCA facially violate the First Amendment, and it is too early to determine whether the unconstitutional provisions of the CAADCA were likely severable” from the rest of the Act. The panel remanded the case to the district court for further proceedings.
- On July 1, 2024, the Supreme Court held that the content moderation provisions of both Texas HB 20 and Florida SB 7072, which the court decided jointly, violated the First Amendment and sent the cases back to the lower courts for further “fact-intensive” analysis.
- On January 17, 2025, the U.S. Supreme Court affirmed the judgment of the U.S. Court of Appeals for the D.C. Circuit that upheld a Congressional ban on TikTok due to national security concerns regarding TikTok’s data collection practices and its relationship with a foreign adversary. The Court concluded that the challenged provisions do not violate the petitioners’ First Amendment rights. President Trump has vowed to find a solution so that U.S. users can access the platform.
- On January 15, 2025, the U.S. Supreme Court heard an appeal of a Texas law that requires age verification to access porn sites, and it seems likely the Court will uphold the law.
- Throughout 2024, state attorneys general and private plaintiffs brought litigation targeting social media platforms and streaming services, alleging that they are responsible for mental and physical harm to kids and teens.
We Forecast:
- Efforts to advance a general federal privacy law and added protections for kids and teens will redouble. Indeed, S. 278, Keep Kids Off Social Media Act (KOSMA), advanced out of the Senate Commerce Committee on February 5, 2025. However, tight margins and the thorny issues of preemption and a private right of action will complicate enactment of general privacy legislation.
- States will continue to be actively engaged on privacy and security legislation, and legal challenges on constitutional and other grounds are expected to continue.
- Legal challenges to data collection and advertising practices of platforms, streaming services, and social media companies will continue.
- The FTC was planning to hold a virtual workshop on February 25, 2025 on design features that “keep kids engaged on digital platforms.” The FTC’s September 26, 2024 announcement outlines topics for discussion, including the positive and negative physical and psychological impacts of design features on youth well-being, but the workshop has been postponed.
Our crystal ball tells us that privacy protection of kids and teens and related questions of responsibility, liability, safety, parental rights, and free speech will continue to drive conversation, legislation, and litigation in 2025 at both the federal and the state level. While the deadline for complying with the new COPPA Rule is likely to slide, businesses will need to implement operational changes to comply with new obligations under the Rule, while remaining aware of the evolving policy landscape and heightened litigation risks.