Training AI on children's data now needs its own consent

Ask a parent what worries them about their child and AI and you will almost always hear about what comes out of it. What might the chatbot say back? Is it going to be weird, or wrong, or worse? Fair question. But it only looks down one end of the pipe.

The other end gets asked about far less: what does the thing keep of what your child said, and who gets to build something out of it? That question picked up a legal answer this year, and it is worth understanding even if you live nowhere near the country that wrote it.

The rule that quietly changed in April

America’s Children’s Online Privacy Protection Act rule, usually just called COPPA, had not been seriously rewritten since 2013. The Federal Trade Commission published its update on 22 April 2025, it took effect that June, and firms were given until 22 April 2026 to comply in full. That deadline has now passed, so the new obligations are live.

One line in it has real teeth. The FTC stated that handing a child’s personal information to third parties in order to “train or otherwise develop artificial intelligence technologies” is “not integral to the website or online service and would require consent”. Read that in plain language: a company can no longer bundle “and we will feed all of this into an AI model” into the same tick box you clicked so your child could use the app. It has to ask you for that separately, and you can refuse that piece on its own while keeping the service.

Two quieter changes travel with it. Operators can no longer sit on children’s data indefinitely, and they must keep a written retention policy setting out what they hold, why, and when it gets deleted. The definition of personal information also widened to take in biometric identifiers, things like fingerprints, iris patterns and genetic data.

The wording is specific because it already happened

This is not a hypothetical drafted by people imagining a bad future. In May 2023 Amazon agreed to pay a $25 million civil penalty over Alexa. The FTC alleged that Alexa “was programmed to keep children’s recordings indefinitely to improve its Alexa algorithm”, that Amazon retained transcripts of children’s voice recordings even when parents had asked for the files to be deleted, and that parents were not adequately told they could have their child’s information removed at all. The settlement required Amazon to delete inactive child accounts, voice recordings and geolocation data.

Sit with the shape of that for a second. Children’s speech is genuinely useful training material precisely because it is not adult speech, which gives a company a quiet commercial reason to keep it. The new consent requirement reads the way it does because it was written with a real incident report on the desk.

Where the rule stops

Here is the part we would want a friend to tell us. The consent requirement bites hardest on disclosure to third parties. As the Public Interest Privacy Center has pointed out, the rule does not clearly stop a company from training its own in-house model on children’s data without asking you again, so long as nothing is handed outside. The Amazon case suggests the “internal operations” exception has limits, but where exactly those limits fall is still unsettled.

Enforcement is also young. The FTC has been signalling hard: its Division of Privacy and Identity Protection has said the commission “has been loud and clear for a while that protecting kids is going to be a high priority”, and recent settlements include $20 million from Cognosphere in January 2025 and $10 million from Disney in September 2025. Meanwhile Congress keeps stalling. COPPA 2.0 passed the Senate unanimously on 5 March and then jammed in the House.

And of course it is one country’s rule. The global picture is softer. On 7 July 2026, UNICEF and the governments of France and Spain launched a Coalition for Children’s Rights and Protection in the Age of Artificial Intelligence at the UN Global Dialogue on AI Governance in Geneva, with seventeen countries signed on. Its framing is genuinely good: children should be treated not as users to be protected after the fact but as “rights holders whose voices should shape how AI is built in the first place”. It is also a declaration, not a law. Nobody gets fined for ignoring it.

What to do with this at your own kitchen table

You do not need to read the rule. You need the question it implies, because that question works in any country, on any app, toy or school tool your child uses.

Stop opening with “is this safe?” and open with “where do my child’s words go, and how long do they stay?” Then check three things, which takes about five minutes:

• Is there a separate permission for AI training or “product improvement”, and did you grant it without noticing when you set the thing up?
• Is there a delete control, and does it claim to delete transcripts as well as recordings?
• Does the privacy policy state an actual retention period, or does it just say “as long as necessary”?

We should say plainly that we have skin in this. Mentus AI is a mentoring product, and children’s conversations pass through it, so a rule about children’s data and AI training is a rule about us. We think the standard is the right one anyway.

The real shift here is small and useful: the law has started treating “we will train on this” as a separate thing you are owed a say in, rather than a footnote to signing up. Once you start looking for that question, you will notice which products ask it. The ones that never do have told you something.