Checklist: Online advertising directed to children (USA)

Introduction

This checklist will assist in-house counsel, private practice lawyers, and sales and marketing departments with online advertising directed towards children.

This checklist addresses the following steps:

1. Understanding the scope of online advertising
2. Understand the specific areas of concern when online advertising to children
3. Establish best practices online advertising online to children

This checklist can be used in conjunction with the following How-to guides: Avoiding false or misleading advertising, Issues surrounding online advertising and Checklist: Using product endorsements.

Step 1 – Understanding the scope of online advertising

Step 2 – Understand the specific areas of concern when online advertising to children

Step 3 – Establish best practices when advertising online to children

Explanatory notes

Online advertising is a burgeoning sector of the economy. However, the advantages of innovative and creative technology when targeting consumers is not without challenge, especially when directed at ‘vulnerable’ customers like children. For the avoidance of doubt, in US business, advertising is a part of marketing, but the rules tend to refer only to advertising.

Children are being taught technology at school and are increasingly online at home for educational and leisure purposes (eg, playing games or watching streaming platforms with integrated advertising content). Although few statutes and regulations expressly focus on protecting children from unfair advertising, general provisions do exist. Non-binding standards also exist as safe harbors for compliance with existing laws and regulation. It is best practice for companies that advertise to children to familiarize themselves with current law, regulation and industry standards within the relevant business sector. This is important to protect against the potential risks of harm to children and serves as a useful guide to companies operating in the online environment.

Legal framework

There are few statutes and regulations that apply specifically to advertising directed at children, either at the federal or state level. The Federal Trade Commission (FTC) is the US federal government’s principal consumer protection agency and has oversight of and protects generally against the use of unfair practices in advertising, including advertising to children. The Children’s Online Privacy Protection Act (COPPA) protects the privacy of children under 13 from the exploitation of their personal information by imposing specific requirements on website owners and operators of online services. This is explored in more detail at sections 2.1 and 2.4 below. Section 6503 of COPPA, creates a safe harbor for private organizations to establish non-binding standards for guiding those who advertise products and services to children. This safe harbor provides that an advertiser who follows standards set by an organization that are approved by the FTC will be deemed to be in compliance with FTC regulations.

Step 1 – Understanding the scope of online advertising and marketing

1.1 Understand the basics of online advertising

Online advertising is the use of the internet to communicate with customers, to enhance brand awareness, and to drive sales. Online advertising is a marketing strategy utilizing online channels and platforms through placement in social media, through optimization of results in search engines, advertising on websites (including web banner advertising), and through other channels, such as email campaigns.

1.2 Understand the basics of social media marketing

Social media marketing (SMM) is part of an overall marketing strategy to promote a product, service or brand via social media platforms like Facebook, Twitter and Instagram to engage with existing customers and reach new ones. The marketing cycle includes the development of a brand strategy, the creation of social media posts, engagement with the target customer base, the oversight and monitoring of feedback (in the form of increased media interaction or sales), and the company response to customer feedback to adjust SMM strategy as needed.

1.3 What are the pros and cons of online advertising?

Over the last 20 years, the world has become undeniably digital as consumers use online resources and technology to research products and services at an increasing level. This creates advantages and opportunity. Businesses in the digital world are better able to identify and to reach target customers or to engage with existing customers, especially given the cost-effective nature of online advertising and the ability of advertisers to swiftly correct the focus, scope and messaging of their marketing plans.

There are also disadvantages to online advertising. As channels for online advertising have increased, competition among vendors of online products has also increased. Consumers can be overwhelmed by the volume and scale of online messaging, and whilst success can be measured by clicks and conversions, online platforms provide a forum for customers to air grievances publicly. If not handled appropriately, this can prove damaging to a company’s reputation. Likewise, the sophistication of online scams and fraudulent activity has increased. This has led to increased efforts among consumers, consumer advocacy groups and some legislators to strengthen online privacy protections and to place new rules on online advertising to protect against potential harms. In addition, tasks such as optimising online advertising can be time consuming, and staff must have the right knowledge and expertise to ensure a return on investment.

1.4 Areas of concern for online advertising generally

Many of the concerns consumer advocates and legislators have regarding online advertising raise concerns similar to the concerns raised by advertising using conventional channels, such as television or radio. The fundamental difference is that online advertisers can target potential consumers globally located in diverse and often far-off regions, which can create challenges in the cross-border context. These include cultural differences, understanding the different currencies and exchange rates, language barriers, potential taxation considerations and transport costs. 

The principal concerns over online advertising are regulatory compliance (including privacy and data collection), false advertising, and issues regarding claims, testimonials and endorsements. The FTC is generally responsible for protecting consumers ‘from unfair and deceptive acts and practices in the advertising and marketing of goods and services’ (16 CFR, section 0.1) The FTC provides specific guidance for digital advertising in Dot Com Disclosures. Specific regulation of endorsements, claims and testimonials can be found at 16 CFR, Part 255.

Step 2 – Understand the specific areas of concern when online advertising to children

2.1 Can you use children’s personal data for the purposes of advertising?

The current minimum age to enter into contracts is 18, meaning contracts entered into by minors under this age are generally voidable at the minor’s discretion. This doctrine is intended to protect minors from making poor financial decisions due to their lack of mature judgment.

It is best practice for the e-commerce company to familiarize itself with commercial law standards in the state(s) in which it is operating.

Under the Children’s Online Privacy Protection Act (COPPA), operators of websites, apps or online services that are directed at children under 13 years and operators of websites that have actual knowledge that a site user is under 13 must obtain parents’ consent before collecting or retaining any information on children of that age.

There are no express rules in COPPA that forbid the use of testimonials from minors, but the general tenor of COPPA is that a company cannot use or store the personal information of a minor without a parent’s consent. This would make using a testimonial from a child under 13 without the consent of a parent difficult, if not impossible.

In addition, the COPPA FAQs provide guidance on the most frequently asked questions of those seeking to comply with COPPA. These are intended to supplement the compliance materials available on the FTC website, under the FTC’s children’s privacy page for businesses.

2.2 Federal Trade Commission rules and regulations

2.2.1 FTC Rules of the Road

Beyond a general notion that the Federal Trade Commission Act prohibits ‘unfair or deceptive advertising in any medium’, the FTC provides no express regulations that govern advertising directed expressly at children. However, since children may ‘have greater difficulty evaluating advertising claims’, as noted by the FTC’s report Advertising and Marketing on the Internet: Rules of the Road, advertisers should take special care not to misrepresent advertising copy directed at children. It is important to comply with these truth-in advertising standards, and the FTC has a dedicated webpage which sets out specific guidance when advertising to children. The FTC also has a special page about food advertising to children and adolescents. It is also exploring updates to its rule implementing COPPA, as well as starting the rulemaking process to define commercial surveillance more broadly.

2.2.2 Children’s Online Privacy Protection Act (COPPA)

COPPA regulates how websites, online services, and mobile sites collect, use and disclose personal information from children under 13. Under COPPA, website operators of sites that target children (or any site that has knowledge that a user is under 13) must obtain a parent’s verifiable consent to collect any information on a child and must provide parents with the ability to review and to delete their children’s information. COPPA also requires online advertisers and operators to post a clear and comprehensive privacy policy and to take reasonable steps to protect the security of children’s personal information.

Parental consent under COPPA is usually necessary before any collection, use or disclosure of personal information obtained from children. This consent can take the form of a consent form completed by a parent, requiring a parent to use a credit card to make any purchases, having a parent call a toll-free number, or checking a government-issued ID (such as a driver’s license or state-issued identification card) of a parent. Recently, in 2023, a group of organizations applied to be permitted to use facial age estimation technology to circumvent the need to obtain parental consent. The FTC denied this application in 2024 – see FTC press release. Note that parental consent is not required to collect information to provide notice to a parent, to respond to an inquiry from a child, to protect the child, or for other safety or security purposes.

Related to COPPA, as of June 2024, two pieces of legislation are being developed in Congress that will augment this federal protection of children online. The Kids Online Safety Act (KOSA) if passed will require the platforms themselves to take action against children’s harm by addressing platform designs or algorithms that are harming children. COPPA 2.0 will, if passed, bring some small modifications to COPPA, including expanding the law’s protection to minors under 17 years old.

2.2.3 Six-step compliance plan

A Six-Step Compliance Plan for Your Business (Six-Step Compliance Plan) is a guidance document prepared by the FTC, which sets out the steps each online business should take if they cater to minors, namely to:

1. Determine data collection: assess whether your business collects personal information, such as names, addresses, online contact details, or any other information that can be used to identify a child, from children under 13.
2. Post a COPPA-compliant privacy policy: create a privacy policy on your website or app that complies with COPPA requirements and display it prominently on your website or app. This policy should include a clear explanation of your data collection practices, how the information is used, and any third parties with whom the data is shared.
3. Notify parents: inform parents about your practices before collecting personal information from children under 13. Make the notification clear and easy to understand, and detail what information will be collected and how it will be used.
4. Obtain verifiable parental consent: secure verifiable consent from parents before any personal information from children is collected, used, or disclosed. This consent might involve methods such as consent forms, phone calls, or other reliable means of confirming consent.
5. Honor parental rights: respect parents' ongoing rights, including their rights to access, review, and delete their children's personal information. Give parents a straightforward process to exercise these rights and keep them informed about any changes in your data practices.
6. Implement protective procedures: establish reasonable security measures to protect the personal information of children. These measures include safeguarding data against unauthorized access, use, or disclosure, and conducting a regular review of these procedures to ensure their effectiveness.

2.3 State rules and regulations

State rules vary by jurisdiction. Many states, such as California, have robust regulations protecting children online. The California law, which went into full effect on 1 July 2024, prohibits companies that provide online services, products or features likely to be accessed by children from: using a child’s personal information; collecting, selling, or retaining a child’s geolocation; profiling a child by default; or leading or encouraging children to provide personal information. NetChoice, an industry lobbying group, has brought a lawsuit challenging the constitutionality of that law styled as NetChoice v Bonta, No. 5:22-cv-08861-BLF. On March 13, 2025, NetChoice received an order granting its request for a preliminary Injunction on the entire act claiming issues with First Amendment rights. On April 11, 2025, California’s Governor filed an appeal to the District Court’s decision. The lawsuit () is currently pending an outcome on the California’s Governor’s appeal in the Ninth Circuit of the Northern District of California.

State laws apply in any state in which the company is trading. The modern online marketplace is a complex ecosystem. If a company could reasonably be said to be trading in a particular state, it is best practice for that company and its management to familiarize themselves with any regulations governing advertising directed towards children in that state. This is especially true if the commodity being sold could contain harmful material to a minor, such as violent videogames, damaging imagery, or marketing or selling products which are illegal to minors such as tobacco, alcohol, or drug-related paraphernalia. More recently, class action lawsuits aimed at video gaming manufacturers have sought compensation for minors and young adults around the addictiveness of game designs that have had harmful effects on players leading to social isolation, mental issues, and financial constraints rooted in the legal theory ’failure to warn.’ 

2.4 Industry standards

Regulations adopted to implement COPPA (16 CFR, section 312.11) provide for the establishment of safe harbor programs for industry groups and other persons to establish self-regulatory program guidelines. The guidelines are developed to provide a way for participants in a particular industry segment to stay in compliance with the applicable regulations. Such self-regulating groups must provide substantially the same or better protections than those contained in COPPA. Foremost among such groups is the Children’s Advertising Review Unit (CARU), a private non-regulatory group affiliated with the Better Business Bureau (BBB). The BBB helps consumers find businesses they can trust, as the BBB accreditation identifies businesses that are committed to honesty and integrity. CARU Advertising Guidelines move beyond COPPA and, though not binding, provide professional guidelines for children’s advertising.

Other industries have also taken steps regarding advertising directed at children. Social media companies such as Instagram and YouTube have made policy changes to their terms of service intended to protect children and teens. These changes include defaulting accounts to private rather than public, disabling push notifications at night, and limiting targeted advertising. In addition, the BBB has worked with the food and beverage industry to develop the Children’s Food and Beverage Advertising Initiative and the Children’s Confection Advertising Initiative. Participants in these initiatives agree to limit advertising to children in the interests of protecting the health of children by steering them away from the consumption of unhealthy food.

Step 3 – Establish best practices when online advertising to children

3.1 Develop policies regarding personal information

3.1.1 Obtain verifiable parental consent

As mentioned above, this is as easy as obtaining written permission from a parent, speaking with him or her over the phone, or providing a government-issued ID or a credit card.

3.1.2 Protect personal information obtained

This can be accomplished in a manner similar to how other data is protected. Data may be protected by encryption, strong passwords and authentication systems, and by physical security at the information storage site.

3.2 Build a compliance policy regarding FTC rules and regulations

The Six-Step Compliance Plan is a good starting point to consider compliance policy development plans. It is also best practice for a company to familiarize itself with state rules in any state in which they do business and to familiarize themselves with safe-harbor standards for a non-regulatory industry body that may be applicable to the company’s industry. The FTC maintains a list of approved safe harbors.

The situation of the online gaming site Fortnite is a cautionary tale. In late 2022, the company was ordered to repay US$245 million to consumers for a COPPA violation for failure to notify parents and for failure to obtain consent. Much of this damage was self-inflicted. The company did not engage in a thorough self-assessment of end-users to determine who those end-users were. A significant number of the site’s users were under 13 (a fact known to company officers), and despite that knowledge, the company did not consider itself a site that focused on underage users. As a result, the company engaged in a COPPA analysis that was too lax to ensure compliance with the requisite standards.

Any online business must carefully analyze the standards of CARU and to treat the CARU Advertising Guidelines as what they are; namely, a safe harbor – the observance of which will ensure that the company is compliant with the applicable regulations in its interactions with minors.

3.3 Evaluate state laws where the company is trading

State laws will vary. Some states have no online advertising regulations that apply specifically to minors, while others will have stringent requirements. It is best practice for the company to familiarize itself with the standards of any state in which it does business.

It may be advisable to build a compliance program based on following the most restrictive laws. This likely would include a program that combines elements of the CARU Advertising Guidelines and the FTC’s Rules of the Road.

3.4 Develop policies to avoid misleading advertising

Such policies should be based on fact that advertising to children should not encourage irresponsible or dangerous practices. Children often lack the sophistication and understanding of business affairs that the average adult possesses. Online businesses and marketers should therefore take extra care when specifically targeting this group with clear disclosures to show the commercial intent of a communication.

3.5 Follow guidelines for best practice in advertising procedure

It is best practice for a company to familiarize itself with industry standards (or with the standards of closely related industries) when dealing with advertising directed towards children. Company officials should challenge themselves to adopt policies that avoid exploitation, reduce legal exposure and to act in a socially responsible manner.

3.6 Ensure adequate review and approvals are in place

All marketing plans and advertising copy should be scrutinized by in-house personnel and by any other stakeholders within the company. It is good practice to establish an in-house working group who has responsibility for sign-off of advertisements and copy. The group should include not just members of the sales and marketing team but could also include members from the legal and compliance teams too to ensure consistency of approach. They should adhere to industry standards, government regulations and the best practices of the company.

Additional resources

FTC advertising and marketing guidance, Children
The ABCs at the FTC: Marketing and Advertising to Children

Related Lexology Pro content

How-to guides:

Avoiding false or misleading advertising
Issues surrounding online advertising

Checklist

Using product endorsements

Reliance on information posted:

While we use reasonable endeavours to provide up to date and relevant materials, the materials posted on our site are not intended to amount to advice on which reliance should be placed. They may not reflect recent changes in the law and are not intended to constitute a definitive or complete statement of the law. You may use them to stay up to date with legal developments but you should not use them for transactions or legal advice and you should carry out your own research. We therefore disclaim all liability and responsibility arising from any reliance placed on such materials by any visitor to our site, or by anyone who may be informed of any of its contents.