Smart speakers and children's voice recordings: what the FTC's COPPA rule requires

Smart speakers and displays answer whoever is talking, and that can be a child. The Federal Trade Commission's Children's Online Privacy Protection Rule, the COPPA Rule, sets the terms for recordings of children under 13 when a service is directed to children or its operator knows it is collecting information from a child. The FTC amended the rule in 2025, and companies had until April 22, 2026 to comply with all but three provisions that concern industry safe harbor programs. This guide explains what the rule's current text says about voice recordings, what the amendments changed, and how the FTC's 2023 case over Amazon's Alexa ended. It describes the rule, not any company's settings.

Why a recording counts as personal information

The rule defines a child as an individual under 13. Its definition of personal information includes a photograph, video or audio file that contains a child's image or voice. The 2025 amendments added biometric identifiers that can be used to recognize a person by automated or semi-automated means, and the rule's examples include voiceprints, facial templates and faceprints. An operator covered by the rule has to obtain verifiable parental consent before it collects, uses or discloses a child's personal information.

The exception for spoken requests

One narrow exception covers spoken requests. Under section 312.5(c)(9), parental consent is not needed when an operator collects an audio file of a child's voice and no other personal information, uses it only to respond to that child's specific request, does not disclose it and deletes it immediately after responding. The operator must still describe the practice in the notice on its website or online service, saying how it uses such audio files and that it deletes them immediately after answering the request.

The exception was not invented in 2025. The FTC set out this approach in an enforcement policy statement dated October 20, 2017, and the 2025 amendments added it to the rule as proposed in January 2024. The FTC rejected a request to widen it to facial images and other biometrics, explaining that it was not persuaded the benefit of such an exception for promptly deleted biometric data outweighed the risk to consumers.

The rule after the 2025 amendments

Before the amendments, the rule's text on third parties gave parents the option to consent to collection and use without consenting to disclosure, but did not call for a separate consent to the disclosure itself, as the FTC's final rule shows when it quotes the earlier wording.

The Alexa case

The rule has been enforced over a voice assistant before. In May 2023 the Department of Justice filed a complaint on the FTC's behalf. According to the complaint, Amazon kept children's Alexa voice recordings indefinitely unless a parent asked for them to be deleted. The FTC said that even after such requests, Amazon did not remove written transcripts of children's speech from all of its databases. The complaint said Amazon gave reasons for keeping the recordings, among them responding to voice commands, letting parents review them and improving Alexa's speech recognition.

Amazon settled the charges. Under the order, which the court entered on July 19, 2023, a $25 million judgment was entered as a civil penalty. The FTC said the order, as proposed, would require Amazon to delete inactive children's Alexa accounts and certain voice recordings and geolocation information, bar it from using voice and geolocation data subject to deletion requests to create or improve any data product, and require it to tell users about its retention and deletion practices. Amazon neither admitted nor denied the complaint's allegations, except as specifically stated in the order. “COPPA does not allow companies to keep children’s data forever for any reason, and certainly not to train their algorithms,” Samuel Levine, Director of the FTC's Bureau of Consumer Protection, said in the FTC's announcement on May 31, 2023.

What parents can ask an operator for

The rule also gives parents rights of their own. When a parent asks, an operator must describe the types of personal information it has collected from children, give the parent a way to review what was collected from their child, after taking steps to confirm the requester is that child's parent, and let the parent at any time refuse further use or collection and direct that the child's information be deleted. The operator may then end the service for that child, within the limits the rule sets. The FTC enforces the rule.

Our guide to smart TV viewing data covers another kind of data a connected device can collect at home.