The Children and Teens' Online Privacy Protection Act significantly updates and expands the Children's Online Privacy Protection Act of 1998 (COPPA) to enhance privacy safeguards for younger users. A central provision of this bill is the extension of protections to "teens," defined as individuals over the age of 12 and under 17, alongside existing protections for children under 13. This broadens the scope of online services and applications subject to stricter privacy regulations. The legislation substantially expands the definition of personal information to include a wider array of data points. This now encompasses persistent identifiers like IP addresses and unique device IDs, photographs, videos, audio files, geolocation information, and biometric data such as fingerprints and facial templates. Operators are prohibited from collecting, using, or disclosing this personal information for the purpose of providing individual-specific advertising to children or teens, effectively banning targeted ads based on user profiles for this age group. The bill introduces new requirements for verifiable consent , mandating that operators obtain consent from a parent for a child or directly from a teen before collecting or using their personal information. It also grants parents and teens enhanced rights regarding their data. These rights include the ability to access a description of collected information, delete personal data or content, refuse further collection or use, and challenge and correct inaccurate information. For large platforms, the bill defines " high-impact social media companies " based on revenue and user count, applying a lower threshold for "knowledge" of a user's age, which includes willfully disregarding information. An exception is provided for educational agencies or institutions, allowing operators to collect student data for solely educational purposes under a written agreement, bypassing direct parental consent with specific safeguards. The Federal Trade Commission is tasked with assessing the feasibility of a common verifiable consent mechanism and is required to submit regular reports on enforcement actions and compliance by high-impact social media companies. This Act also includes a strong preemption clause, preventing states from enacting conflicting laws related to its provisions.