COPPA's Data-Retention Rule: Why Your Existing Policy Probably Fails

This post is informational and reflects the state of the law as of April 2026. For a policy tailored to your product, consult a licensed attorney.

Most companies that collect data from children already have a retention policy. Most of those policies do not satisfy the amended COPPA Rule, whose data-retention requirement takes full effect April 22, 2026.

The provision is Section 312.10. It requires a written data-retention policy that identifies the specific purposes for collecting children’s personal information and sets a concrete timeframe for deleting it. The generic line most policies rely on, some version of “we retain data as long as necessary for business purposes,” no longer does the job.

What the rule actually requires

Three points do most of the work:

Specific purpose, specific timeframe. The policy has to name why you collect children’s personal information and how long you keep it. Open-ended retention will rarely satisfy the standard. The FTC said as much during the rulemaking.
It lives in the privacy notice. The retention policy has to appear inside your privacy notice itself, not in a separate linked document.
Deletion is tied to purpose. When the original purpose for collection is fulfilled, the data goes. You cannot hold children’s data indefinitely on the theory that it might be useful later.

What to do

You do not necessarily need a standalone children’s-data retention policy. Your existing policy can work, but only if it explicitly covers children’s personal information and meets every element of Section 312.10.

The practical test: pull your current privacy notice and read the retention section. If it does not identify the data you collect from children and set a specific deletion timeline, you are not compliant, and a generic “as long as necessary” clause is the most common reason. (For the broader children’s-privacy picture, see the firm’s Privacy & Data Security practice.)

If your product collects data from anyone under 13 and you are not sure your retention language holds up, talk to MB Legal.

This post is informational and does not constitute legal advice. COPPA compliance depends on your data practices and audience. For guidance on a specific policy, consult a licensed attorney.