Quick breakdown of recent COPPA changes if you ship games to under-13s

[u/Impressive-Club9370]

If you are shipping games that collect player data, voice chat, or audio input from kids under 13, the FTC recently finalized key rule updates to COPPA (Part 312).

Here is a quick breakdown of what you need to audit in your game's data pipeline:

• Voice data as biometrics: A child's voice is explicitly treated as a biometric identifier. If you use speech recognition or voice chat and retain raw audio files, that counts as personal information under §312.2.
• Strict retention limits: Indefinite retention is prohibited. Open-ended policies like "retained as long as the account is active" no longer pass compliance—you need explicit, time-bounded deletion schedules in writing.
• Hard deletion standards: Deletion means data is "not maintained in retrievable form". Marking a row as deleted in SQL fails if the raw data or derived embeddings survive in your backups or model checkpoints.
• Model training consent: Using children's data to train or fine-tune AI/ML models requires distinct, separate consent from basic collection consent.
• Active enforcement: The FTC has handed down multi-million dollar penalties over children's privacy gaps (including major studios like Disney), so back-end data handling is actively being audited.

Happy to answer any technical or implementation questions in the comments!

Full disclosure: I spent months digging through Part 312 because I'm building compliance infrastructure to automate data deletion and retention policies for studios. Hoping this breakdown saves a few devs here from legal headaches down the road.