Education Brand Ads on Reddit 2026: KOSA and State Children's Codes
Reddit admits users at 13, which pulls education advertisers into a children's-privacy stack: the 2025 amended COPPA rule, state design codes, and a KOSA duty of care that is close but not yet law.
Education and edtech brands advertising on Reddit reach an audience that starts at 13 — Reddit's minimum user age — which places them squarely inside the children's-privacy compliance stack. The FTC's amended COPPA Rule, approved January 16, 2025, effective June 23, 2025, with a compliance date of April 22, 2026, now requires separate verifiable parental consent before a child's personal information is disclosed to third parties for targeted advertising, limits data retention, and expands personal information to include biometric and government-issued identifiers. State age-appropriate design codes add a 'best interests of the child' standard: Maryland's took effect October 1, 2024 with DPIAs due April 1, 2026, Nebraska's takes effect January 1, 2026, and Vermont's January 1, 2027, while California's remains enjoined in NetChoice v. Bonta. The Kids Online Safety Act passed the Senate 91-3 in July 2024, was reintroduced as S.1748 on May 14, 2025, and would impose a duty of care on platforms — but it is not yet law. Education advertisers must age-gate, secure parental consent, limit retention, and avoid targeting minors without the required controls.
Why Edtech Ads on Reddit Trigger the Children's-Privacy Stack
Reddit is an attractive channel for education and edtech brands: its communities are organized around subjects, exam prep, language learning, and careers, and the audience is engaged and high-intent. But the platform admits users at thirteen, and that single fact pulls education advertisers into the most heavily regulated corner of US advertising law — the children's-privacy stack. A campaign that reaches a thirteen-to-seventeen audience, or that could collect data from a younger user, sits under the amended COPPA Rule, a growing set of state age-appropriate design codes, and the gravitational pull of a pending Kids Online Safety Act.
The risk is easy to miss because the obligations are diffuse. COPPA governs data collection from under-13 users; the state design codes impose a 'best interests of the child' standard on services likely to be accessed by anyone under 18; and KOSA — though not yet law — is reshaping how platforms design the environment ads appear in. Education brands that treat Reddit as a general-audience channel, without accounting for the minors in that audience, build campaigns that the 2026 compliance landscape does not permit.
"The updated COPPA rule strengthens key protections for kids' privacy online. By requiring parents to opt in to targeted advertising practices, this final rule prohibits platforms and service providers from sharing and monetizing children's data without active permission.
— Lina M. Khan, Chair, U.S. Federal Trade Commission, January 16, 2025"
This guide covers COPPA and the 2025 amended rule, KOSA's status and duty of care, the state children's design codes, Reddit's age rules and advertising restrictions, the compliance gaps education brands hit, and a checklist. For the US baseline see the United States advertising compliance guide and for related rules see the children's content compliance guide.
The Three-Layer Structure
The stack has three layers that operate independently. COPPA is the federal data-collection layer for under-13 users, recently strengthened. The state design codes are the under-18 design-and-assessment layer, in effect in some states and enjoined in others. KOSA is the pending platform-duty layer that is not yet law but is setting the direction. An education advertiser must understand which layers apply to its campaign and build to the strictest applicable standard, because satisfying one layer does not satisfy the others.
COPPA and the 2025 Amended Rule: Opt-In Consent for Targeted Ads
COPPA (16 CFR Part 312) requires operators of services directed to children, or with actual knowledge they collect data from children under 13, to obtain verifiable parental consent before collecting, using, or disclosing that information. The FTC's amended rule sharpened the obligations.
What the Amended Rule Changed
| Change | Requirement |
|---|---|
| Targeted-advertising consent | Separate verifiable parental consent required before disclosing a child's data to third parties for targeted advertising |
| Data retention | Retain only as long as reasonably necessary; no indefinite retention; written, published retention policy required |
| Expanded personal information | Now includes biometric identifiers and government-issued identifiers |
| Other | "Mixed audience" definition; mobile numbers as contact info; "text plus" consent; written security program; Safe Harbor member-list disclosure |
The Compliance Timeline
The FTC approved the amended rule on January 16, 2025; it took effect June 23, 2025; and the compliance date for most provisions is April 22, 2026. The targeted-advertising consent change is the most consequential for advertisers: a parent's consent to a child using a service no longer covers sharing that child's data with ad networks — a separate affirmative opt-in is required. For automated review of data and consent flows use the AI Compliance Audit.
KOSA's Status and the Duty of Care That Is Not Yet Law
The Kids Online Safety Act is the most-discussed children's-safety bill in Congress, but it is essential to be precise: it is not law. Education advertisers should treat it as a framework setting direction, not a current obligation.
The Legislative Status
- 2024 Senate passage: Combined with a COPPA update as the Kids Online Safety and Privacy Act (S.2073), it passed the Senate 91-3 on July 30, 2024, but did not pass the House and died at the end of the 118th Congress.
- 2025 reintroduction: Reintroduced as S.1748 by Senator Marsha Blackburn, introduced May 14, 2025 with 75 cosponsors; as of this writing it remains in committee and is not enacted.
- Duty of care: Would require covered platforms to exercise reasonable care in the design of features to prevent and mitigate reasonably foreseeable harms to minors, including eating disorders, substance-use disorders, suicidal behaviors, compulsive usage, severe harassment, and sexual exploitation.
What It Means for Advertisers
KOSA's duty of care attaches to platform design features — recommendation systems, defaults, engagement mechanics — not directly to an advertiser's campaign. But if enacted, it would change the targeting and delivery options available for reaching younger audiences and intensify the regulatory focus on minors. The prudent response is to align minor-facing advertising with KOSA's protective direction now, rather than waiting for enactment. To track its status see the Policy Change Tracker.
State Children's Design Codes: California, Maryland, and Beyond
State age-appropriate design codes impose a 'best interests of the child' standard on services likely to be accessed by minors under 18, and they require proactive data protection impact assessments rather than only consent. Their status varies by state.
The State-by-State Position
| State | Status | Notes |
|---|---|---|
| California (AB 2273) | Enjoined — not in effect | NetChoice v. Bonta; 9th Cir. partially affirmed injunction Aug 16, 2024; further injunction March 2025 |
| Maryland (Kids Code) | In effect October 1, 2024 | DPIAs due April 1, 2026; penalties $2,500 negligent / $7,500 intentional per affected child |
| Nebraska | Effective January 1, 2026 | AG civil penalties begin July 1, 2026 |
| Vermont | Effective January 1, 2027 | Signed June 12, 2025 |
The codes apply to a broad under-18 population and can reach the advertiser's own properties — landing pages, sign-up flows, apps — to which a Reddit ad drives traffic. Because they impose proactive assessment duties, consent alone does not satisfy them: the advertiser must assess and mitigate the risks its data practices create for minors. California's enjoined status shows the landscape is unsettled, but Maryland is in effect and others are taking effect. For multi-jurisdiction stress-testing use the Legal Compliance Scan.
Reddit's Age Rules and Advertising Restrictions
Reddit's platform rules set the boundaries education advertisers operate within, but they are a floor, not a complete compliance solution.
The Reddit Rules
- Minimum age 13: No one under thirteen may use the services; the audience starts at thirteen and includes a thirteen-to-seventeen minor cohort.
- Mature content gated at 18: A user must be at least eighteen to view mature content.
- Category restrictions: Alcohol ads must target above the legal drinking age with manual approval; gambling ads require manual approval and must ensure minors are not the target.
- Targeting guidelines: Reddit maintains a dedicated targeting-guidelines resource that should be reviewed directly to confirm what age-based targeting is permitted, as options can change.
Why the Platform Rules Are Only a Floor
Reddit establishes a minimum age and restricts sensitive categories, but it does not relieve the advertiser of its COPPA, design-code, and consumer-protection obligations. An ad reaching the thirteen-to-seventeen cohort still requires the advertiser to age-gate its own data collection, secure parental consent where required, and meet design-code obligations on its own properties. Platform permission to run an ad is not legal permission to collect and use minors' data through the funnel. To check campaign language for risk use the Keyword Risk Checker.
The Compliance Gaps Education Brands Hit on Reddit
The gaps follow from treating Reddit as a general-audience channel.
The Recurring Gaps
- Targeting teens without age-gating: Running broad campaigns that reach the thirteen-to-seventeen cohort, and collecting data through funnels that could reach under-13 users, without age screens.
- Data collection without parental consent: Pixels, SDKs, and sign-up flows collecting minors' data without verifiable parental consent — and, under the amended rule, sharing with ad networks without separate opt-in.
- Indefinite retention: Holding student and minor data indefinitely for future marketing, which the amended rule now bars.
- Ignoring design-code duties: Failing to conduct the data protection impact assessments and 'best interests' design that Maryland and other codes require on the advertiser's own properties.
- Biometric and identifier blind spots: Treating age-verification or proctoring data as outside COPPA when the amended rule now includes biometric and government-issued identifiers.
The structural error is assuming the platform's age minimum resolves the children's-privacy question. It does not. To stress-test a campaign use the Legal Compliance Scan and for automated data-flow review use the AI Compliance Audit.
Reddit Education Ad Compliance Checklist
- [ ] Campaign audience defined deliberately (adults, 13–17, or both); age-gating implemented on the advertiser's own data-collection points.
- [ ] Verifiable parental consent obtained before any collection that could reach under-13 users.
- [ ] Separate verifiable parental consent obtained before sharing minors' data with ad networks (amended COPPA Rule, compliance April 22, 2026).
- [ ] Data collection minimized; children's data retained only as long as necessary; written retention policy published.
- [ ] Biometric and government-issued identifiers treated as COPPA personal information.
- [ ] Data protection impact assessment completed where a state design code applies (Maryland in effect; DPIAs due April 1, 2026).
- [ ] Minor-facing properties designed to the "best interests of the child" standard across applicable states.
- [ ] Reddit category and targeting rules reviewed; sensitive-category ads not targeted at minors.
- [ ] KOSA progress and design-code developments monitored; minor-facing advertising aligned to the protective direction.
- [ ] Age-gating, consent, retention, and assessment decisions documented for demonstrable compliance.
Don't miss the next policy change.
Create a free account — track every policy change across 8 platforms, get instant alerts, and access every free compliance tool. Or try our Keyword Risk Checker first.
Report Keywords — Run AI Compliance Audit
Related Posts
Ofcom Online Safety Act Enforcement May 2026: 4chan £520K, AVS Group £1M & The Age Assurance Wave Hitting Advertisers
Ofcom's enforcement docket built up through Q1 2026 with the £1M AVS Group fine and the £520K 4chan penalty. The age-assurance wave is now reshaping advertiser-facing surfaces — here is what changes for ad buying through May 2026.
EU DSA Second Wave Enforcement April 2026 — New VLOP Designations, Expanded Advertising Transparency Obligations & 6 Percent Turnover Fines
The EU activated its DSA second enforcement wave in April 2026, designating additional platforms as VLOPs and extending advertising transparency obligations. The €120M X fine set the penalty ceiling at 6 percent of global turnover — advertisers on newly designated platforms face new creative, targeting, and reporting constraints.
Reddit Ads Brand Safety 2026 — Subreddit Targeting, NSFW Controls & Community Compliance
Reddit's 2026 ad framework reshapes brand safety with tighter subreddit eligibility, NSFW inventory controls, and community-aware creative standards. Here's the advertiser compliance guide.