Skip to main content
Home/Blog/Education Brand Ads on Reddit 2026: KOSA and State Children's Codes
Back to Intelligence Hub
educationUnited StatesRisk Level: high

Education Brand Ads on Reddit 2026: KOSA and State Children's Codes

Reddit admits users at 13, which pulls education advertisers into a children's-privacy stack: the 2025 amended COPPA rule, state design codes, and a KOSA duty of care that is close but not yet law.

May 29, 202614 min readAuditSocials Research
TweetShare
Quick Answer

Education and edtech brands advertising on Reddit reach an audience that starts at 13 — Reddit's minimum user age — which places them squarely inside the children's-privacy compliance stack. The FTC's amended COPPA Rule, approved January 16, 2025, effective June 23, 2025, with a compliance date of April 22, 2026, now requires separate verifiable parental consent before a child's personal information is disclosed to third parties for targeted advertising, limits data retention, and expands personal information to include biometric and government-issued identifiers. State age-appropriate design codes add a 'best interests of the child' standard: Maryland's took effect October 1, 2024 with DPIAs due April 1, 2026, Nebraska's takes effect January 1, 2026, and Vermont's January 1, 2027, while California's remains enjoined in NetChoice v. Bonta. The Kids Online Safety Act passed the Senate 91-3 in July 2024, was reintroduced as S.1748 on May 14, 2025, and would impose a duty of care on platforms — but it is not yet law. Education advertisers must age-gate, secure parental consent, limit retention, and avoid targeting minors without the required controls.

Education Brand Ads on Reddit 2026: KOSA and State Children's Codes

Why Edtech Ads on Reddit Trigger the Children's-Privacy Stack

Reddit is an attractive channel for education and edtech brands: its communities are organized around subjects, exam prep, language learning, and careers, and the audience is engaged and high-intent. But the platform admits users at thirteen, and that single fact pulls education advertisers into the most heavily regulated corner of US advertising law — the children's-privacy stack. A campaign that reaches a thirteen-to-seventeen audience, or that could collect data from a younger user, sits under the amended COPPA Rule, a growing set of state age-appropriate design codes, and the gravitational pull of a pending Kids Online Safety Act.

The risk is easy to miss because the obligations are diffuse. COPPA governs data collection from under-13 users; the state design codes impose a 'best interests of the child' standard on services likely to be accessed by anyone under 18; and KOSA — though not yet law — is reshaping how platforms design the environment ads appear in. Education brands that treat Reddit as a general-audience channel, without accounting for the minors in that audience, build campaigns that the 2026 compliance landscape does not permit.

The FTC framed the updated COPPA rule as strengthening protections for children's privacy by requiring parents to opt in before platforms and service providers can share or monetize children's data — a paraphrase of the agency's stated rationale rather than a verbatim, individually attributed quotation.

This guide covers COPPA and the 2025 amended rule, KOSA's status and duty of care, the state children's design codes, Reddit's age rules and advertising restrictions, the compliance gaps education brands hit, and a checklist. For the US baseline see the United States advertising compliance guide and for related rules see the children's content compliance guide.

The Three-Layer Structure

The stack has three layers that operate independently. COPPA is the federal data-collection layer for under-13 users, recently strengthened. The state design codes are the under-18 design-and-assessment layer, in effect in some states and enjoined in others. KOSA is the pending platform-duty layer that is not yet law but is setting the direction. An education advertiser must understand which layers apply to its campaign and build to the strictest applicable standard, because satisfying one layer does not satisfy the others.

COPPA and the 2025 Amended Rule: Opt-In Consent for Targeted Ads

COPPA (16 CFR Part 312) requires operators of services directed to children, or with actual knowledge they collect data from children under 13, to obtain verifiable parental consent before collecting, using, or disclosing that information. The FTC's amended rule sharpened the obligations.

What the Amended Rule Changed

ChangeRequirement
Targeted-advertising consentSeparate verifiable parental consent required before disclosing a child's data to third parties for targeted advertising
Data retentionRetain only as long as reasonably necessary; no indefinite retention; written, published retention policy required
Expanded personal informationNow includes biometric identifiers and government-issued identifiers
Other"Mixed audience" definition; mobile numbers as contact info; "text plus" consent; written security program; Safe Harbor member-list disclosure

The Compliance Timeline

The FTC approved the amended rule on January 16, 2025; it took effect June 23, 2025; and the compliance date for most provisions is April 22, 2026. The targeted-advertising consent change is the most consequential for advertisers: a parent's consent to a child using a service no longer covers sharing that child's data with ad networks — a separate affirmative opt-in is required. For automated review of data and consent flows use the AI Compliance Audit.

KOSA's Status and the Duty of Care That Is Not Yet Law

The Kids Online Safety Act is the most-discussed children's-safety bill in Congress, but it is essential to be precise: it is not law. Education advertisers should treat it as a framework setting direction, not a current obligation.

The Legislative Status

  • 2024 Senate passage: Combined with a COPPA update as the Kids Online Safety and Privacy Act (S.2073), it passed the Senate 91-3 on July 30, 2024, but did not pass the House and died at the end of the 118th Congress.
  • 2025 reintroduction: Reintroduced as S.1748 by Senator Marsha Blackburn, introduced May 14, 2025 with 75 cosponsors; as of this writing it remains in committee and is not enacted.
  • Duty of care: Would require covered platforms to exercise reasonable care in the design of features to prevent and mitigate reasonably foreseeable harms to minors, including eating disorders, substance-use disorders, suicidal behaviors, compulsive usage, severe harassment, and sexual exploitation.

What It Means for Advertisers

KOSA's duty of care attaches to platform design features — recommendation systems, defaults, engagement mechanics — not directly to an advertiser's campaign. But if enacted, it would change the targeting and delivery options available for reaching younger audiences and intensify the regulatory focus on minors. The prudent response is to align minor-facing advertising with KOSA's protective direction now, rather than waiting for enactment. To track its status see the Policy Change Tracker.

State Children's Design Codes: California, Maryland, and Beyond

State age-appropriate design codes impose a 'best interests of the child' standard on services likely to be accessed by minors under 18, and they require proactive data protection impact assessments rather than only consent. Their status varies by state.

The State-by-State Position

StateStatusNotes
California (AB 2273)Enjoined — not in effectNetChoice v. Bonta; 9th Cir. partially affirmed injunction Aug 16, 2024; further injunction March 2025
Maryland (Kids Code)In effect October 1, 2024DPIAs due April 1, 2026; penalties $2,500 negligent / $7,500 intentional per affected child
NebraskaEffective January 1, 2026AG civil penalties begin July 1, 2026
VermontEffective January 1, 2027Signed June 12, 2025

The codes apply to a broad under-18 population and can reach the advertiser's own properties — landing pages, sign-up flows, apps — to which a Reddit ad drives traffic. Because they impose proactive assessment duties, consent alone does not satisfy them: the advertiser must assess and mitigate the risks its data practices create for minors. California's enjoined status shows the landscape is unsettled, but Maryland is in effect and others are taking effect. For multi-jurisdiction stress-testing use the Legal Compliance Scan.

Reddit's Age Rules and Advertising Restrictions

Reddit's platform rules set the boundaries education advertisers operate within, but they are a floor, not a complete compliance solution.

The Reddit Rules

  • Minimum age 13: No one under thirteen may use the services; the audience starts at thirteen and includes a thirteen-to-seventeen minor cohort.
  • Mature content gated at 18: A user must be at least eighteen to view mature content.
  • Category restrictions: Alcohol ads must target above the legal drinking age with manual approval; gambling ads require manual approval and must ensure minors are not the target.
  • Targeting guidelines: Reddit maintains a dedicated targeting-guidelines resource that should be reviewed directly to confirm what age-based targeting is permitted, as options can change.

Why the Platform Rules Are Only a Floor

Reddit establishes a minimum age and restricts sensitive categories, but it does not relieve the advertiser of its COPPA, design-code, and consumer-protection obligations. An ad reaching the thirteen-to-seventeen cohort still requires the advertiser to age-gate its own data collection, secure parental consent where required, and meet design-code obligations on its own properties. Platform permission to run an ad is not legal permission to collect and use minors' data through the funnel. To check campaign language for risk use the Keyword Risk Checker.

The Compliance Gaps Education Brands Hit on Reddit

The gaps follow from treating Reddit as a general-audience channel.

The Recurring Gaps

  • Targeting teens without age-gating: Running broad campaigns that reach the thirteen-to-seventeen cohort, and collecting data through funnels that could reach under-13 users, without age screens.
  • Data collection without parental consent: Pixels, SDKs, and sign-up flows collecting minors' data without verifiable parental consent — and, under the amended rule, sharing with ad networks without separate opt-in.
  • Indefinite retention: Holding student and minor data indefinitely for future marketing, which the amended rule now bars.
  • Ignoring design-code duties: Failing to conduct the data protection impact assessments and 'best interests' design that Maryland and other codes require on the advertiser's own properties.
  • Biometric and identifier blind spots: Treating age-verification or proctoring data as outside COPPA when the amended rule now includes biometric and government-issued identifiers.

The structural error is assuming the platform's age minimum resolves the children's-privacy question. It does not. To stress-test a campaign use the Legal Compliance Scan and for automated data-flow review use the AI Compliance Audit.

Reddit Education Ad Compliance Checklist

  • [ ] Campaign audience defined deliberately (adults, 13–17, or both); age-gating implemented on the advertiser's own data-collection points.
  • [ ] Verifiable parental consent obtained before any collection that could reach under-13 users.
  • [ ] Separate verifiable parental consent obtained before sharing minors' data with ad networks (amended COPPA Rule, compliance April 22, 2026).
  • [ ] Data collection minimized; children's data retained only as long as necessary; written retention policy published.
  • [ ] Biometric and government-issued identifiers treated as COPPA personal information.
  • [ ] Data protection impact assessment completed where a state design code applies (Maryland in effect; DPIAs due April 1, 2026).
  • [ ] Minor-facing properties designed to the "best interests of the child" standard across applicable states.
  • [ ] Reddit category and targeting rules reviewed; sensitive-category ads not targeted at minors.
  • [ ] KOSA progress and design-code developments monitored; minor-facing advertising aligned to the protective direction.
  • [ ] Age-gating, consent, retention, and assessment decisions documented for demonstrable compliance.

Frequently Asked Questions

Does COPPA apply to education ads on Reddit when Reddit's minimum age is 13?
COPPA applies to education advertising whenever the advertising collects personal information from children under 13, or is directed to children under 13, regardless of a platform's stated minimum age, and Reddit's thirteen-and-up minimum does not by itself remove COPPA exposure for education brands. The Children's Online Privacy Protection Act and its implementing rule, 16 CFR Part 312, require operators of websites or online services directed to children, or with actual knowledge that they collect personal information from children under 13, to obtain verifiable parental consent before collecting, using, or disclosing that information. The thirteen-year-old floor is the dividing line: a user who is exactly thirteen is outside COPPA's under-13 scope, but the practical problem for education advertisers is that the line is porous. Reddit's stated minimum is thirteen, but a platform's minimum age does not guarantee that no under-13 users are present, and an education brand whose content or targeting is directed to children, or that obtains actual knowledge that it is collecting data from under-13 users, falls within COPPA even on a thirteen-and-up platform. The amended COPPA Rule, which the FTC approved on January 16, 2025 with an effective date of June 23, 2025 and a compliance date of April 22, 2026, sharpened the obligations in ways that matter for advertising specifically. The most important change for advertisers is the requirement to obtain separate verifiable parental consent before disclosing a child's personal information to third parties for targeted advertising or other purposes — meaning the consent to collect data for the service is no longer sufficient to also share that data with ad networks; a distinct, affirmative parental opt-in is required for the advertising disclosure. The amended rule also requires operators to limit data retention to only as long as reasonably necessary for a specific purpose, bars indefinite retention, and requires a written, published retention policy. It expands the definition of personal information to include biometric identifiers and government-issued identifiers, which reaches age-verification and proctoring technologies common in edtech. For an education advertiser the practical consequence is that any campaign that could reach under-13 users, or that is directed to children, must be built with COPPA in mind: the advertiser cannot rely on Reddit's minimum age as a safe harbor, must avoid collecting personal information from under-13 users without verifiable parental consent, and must secure separate parental consent before any targeted-advertising data sharing. For the US regulatory baseline see the United States advertising compliance guide and for related children's-content rules see the children's content compliance guide. The defensible posture is to treat any audience that includes minors as triggering heightened obligations and to age-gate and consent-gate accordingly, rather than assuming a platform's age minimum resolves the COPPA question.
What changed in the FTC's 2025 amended COPPA Rule, and what are the compliance dates?
The FTC's amended COPPA Rule, approved January 16, 2025, made several substantive changes to children's-privacy obligations, with an effective date of June 23, 2025 and a compliance date of April 22, 2026 for most provisions, and education advertisers must align their data and advertising practices to the amended standard by the compliance date. The single most consequential change for advertising is the targeted-advertising consent requirement. Under the amended rule, operators must obtain separate verifiable parental consent before disclosing a child's personal information to third parties for purposes such as targeted advertising. This is a structural change because it decouples the consent to operate the service from the consent to monetize the child's data through advertising: a parent who consents to a child using an educational service has not thereby consented to that child's data being shared with advertising networks, and the operator must obtain a distinct, affirmative opt-in for the advertising disclosure. The practical effect is that behavioral or targeted advertising to children becomes far harder to conduct lawfully, because it requires a separate parental consent that many operators will not be able to obtain at scale. The second major change concerns data retention. The amended rule requires operators to retain children's personal information only for as long as reasonably necessary to fulfill the specific purpose for which it was collected, prohibits indefinite retention, and requires operators to establish and publish a written data-retention policy. An education brand that collects student or minor data through a Reddit campaign and retains it indefinitely for future marketing now violates the retention limitation. The third change expands the definition of personal information to include biometric identifiers — those that can be used for automated or semi-automated recognition of an individual — and government-issued identifiers. This reaches age-verification systems, proctoring tools, and any edtech feature that processes biometric data from children, bringing those data types squarely within COPPA's consent and protection requirements. The amended rule also introduced a 'mixed audience' service definition, expanded online contact information to include mobile phone numbers, added a 'text plus' consent method, required a written information-security program, and required Safe Harbor programs to publicly disclose their member lists. For education advertisers the compliance roadmap is clear: by April 22, 2026, ensure that any targeted advertising involving children's data has separate verifiable parental consent, that data retention is limited and governed by a published policy, and that any biometric or government-ID processing is treated as COPPA personal information. For automated review of data and consent flows use the AI Compliance Audit and to track the rule's implementation see the Policy Change Tracker. The amended rule does not change COPPA's under-13 scope, but it materially raises the bar for what operators and advertisers must do when they are within scope, and the April 2026 compliance date is the operative deadline.
Is KOSA law, and what would its duty of care require of platforms and education advertisers?
KOSA — the Kids Online Safety Act — is not law as of this writing; it passed the Senate but has not been enacted, and education advertisers should understand it as a pending framework that is reshaping the platform environment rather than a current legal obligation. The legislative history is specific. In 2024, KOSA was combined with a COPPA update into the Kids Online Safety and Privacy Act, S.2073, which passed the Senate by a vote of 91-3 on July 30, 2024; the bill did not pass the House and died at the end of the 118th Congress. In 2025, KOSA was reintroduced as S.1748 in the 119th Congress by Senator Marsha Blackburn, introduced on May 14, 2025 with 75 cosponsors, and as of this writing it remains in committee — it has not passed both chambers and has not been signed into law. Any statement that KOSA is currently binding is inaccurate; it is a closely watched bill with substantial support, not an enacted statute. The core mechanism KOSA would establish is a duty of care. Under the bill, a covered platform — generally a large social-media or online platform, not an individual advertiser — would be required to exercise reasonable care in the creation and implementation of any design feature to prevent and mitigate enumerated harms to minors that are reasonably foreseeable. The enumerated harms include matters such as eating disorders, substance-use disorders, suicidal behaviors, depressive and anxiety disorders connected to compulsive usage, compulsive usage itself, severe online harassment, and sexual exploitation. The duty of care attaches to the platform's design features — the recommendation systems, default settings, and engagement mechanics — rather than directly to an advertiser's campaign. For education advertisers the significance of KOSA is indirect but real. If enacted, KOSA would push covered platforms to redesign the environment in which ads appear, particularly around how minors are recommended content and how engagement is driven, which would change the targeting and delivery options available to advertisers reaching younger audiences. It would also intensify the broader regulatory focus on minors' online safety, reinforcing the direction already set by the amended COPPA Rule and the state design codes. An education brand should therefore monitor KOSA's progress and design its minor-facing advertising to be defensible under the emerging standard — age-appropriate, non-manipulative, and protective of minors — rather than waiting for enactment to act. The prudent posture is to treat the convergence of the amended COPPA Rule, the state design codes, and the pending KOSA as a single direction of travel toward stricter protection of minors, and to build to that direction now. For related children's-content compliance see the children's content compliance guide and to track KOSA's status see the Policy Change Tracker. The accurate framing for any education marketing team is that KOSA is coming into focus, not yet in force, and the safe response is to align with its protective direction before it becomes a legal requirement.
How do state children's design codes affect education advertising, and which states are in effect?
State children's design codes impose a 'best interests of the child' standard on services likely to be accessed by minors, and several are now in effect or taking effect, which means education advertisers operating in those states face design and data-protection obligations independent of COPPA and KOSA. The codes differ from COPPA in two important ways: they generally apply to minors under 18 rather than only children under 13, and they impose affirmative design duties — assessing and mitigating risks to children through data protection impact assessments — rather than only a consent requirement. The state-by-state position is specific. California's Age-Appropriate Design Code, AB 2273, was enacted in 2022 and was scheduled to take effect July 1, 2024, but it has been enjoined: in NetChoice v. Bonta, the Ninth Circuit on August 16, 2024 partially affirmed a preliminary injunction, finding that the code's data protection impact assessment provisions likely violate the First Amendment, and a further district-court injunction issued in March 2025; the California code is therefore not in effect, and its ultimate fate depends on the ongoing litigation. Maryland's Age-Appropriate Design Code, often called the Maryland Kids Code, was signed May 9, 2024 and took effect October 1, 2024; it covers for-profit entities meeting revenue or data-volume thresholds and applies to services reasonably likely to be accessed by minors, with data protection impact assessments due April 1, 2026 and penalties of $2,500 per affected child for negligent violations and $7,500 for intentional violations. Nebraska's design code was signed May 30, 2025 and takes effect January 1, 2026, with attorney-general civil penalties beginning July 1, 2026. Vermont's design code was signed June 12, 2025 and takes effect January 1, 2027. For education advertisers the consequence is that a campaign reaching minors in Maryland, Nebraska, or other states with active codes must consider the 'best interests of the child' standard and the design-code obligations, which can reach the data practices and design of the advertiser's own properties — landing pages, sign-up flows, and apps — to which the Reddit ad drives traffic. Because the codes apply to a broad under-18 population and impose proactive assessment duties, an education brand cannot satisfy them through consent alone; it must assess and mitigate the risks its data practices create for minors and document that assessment. The litigation status of the California code is a reminder that these laws face constitutional challenge and that the landscape is unsettled, but the Maryland code is in effect and others are taking effect, so the obligations are real for advertisers in those jurisdictions. For multi-jurisdiction stress-testing of a campaign use the Legal Compliance Scan and for the US regulatory baseline see the United States advertising compliance guide. The defensible approach is to treat the design codes as imposing obligations on the advertiser's own minor-facing properties, conduct the required impact assessments where a code applies, and design to the 'best interests of the child' standard across all states because the strictest applicable code effectively governs a multi-state campaign.
What does Reddit's advertising policy allow and restrict for ads that could reach minors?
Reddit's advertising and platform policies establish a thirteen-and-up user base with an eighteen-and-up threshold for mature content, and they restrict certain ad categories from targeting minors, which sets the platform-level boundaries education advertisers must operate within while leaving substantial responsibility on the advertiser. Reddit's User Agreement establishes the foundational age rules: no one under thirteen is allowed to use or access the services, and a user must be at least eighteen years old to view mature content. This means Reddit's audience starts at thirteen, includes a thirteen-to-seventeen minor cohort, and gates mature content behind an eighteen-and-up threshold. For an education advertiser the thirteen-and-up base is the central fact: the platform's general audience includes minors, so an education campaign that runs broadly will reach minors unless the advertiser takes steps to limit its audience. Reddit's advertising policies impose category-specific restrictions that demonstrate the platform's approach to minors. Alcohol advertising must target individuals above the legal drinking age and requires manual approval and engagement with a Reddit sales representative. Gambling advertising requires manual approval and certification and must ensure that minors are not the target of the advertisements, with compliance to industry codes of conduct. These category rules show that Reddit places affirmative obligations on advertisers in sensitive categories to avoid targeting minors, and the principle extends to the advertiser's general duty not to direct inappropriate content to younger users. Reddit also maintains a dedicated advertising targeting guidelines resource that governs how audiences may be defined, and an education advertiser should review the current targeting guidelines directly to confirm what age-based targeting is and is not permitted, because the precise targeting options and any minor-protection constraints are set in that resource and can change. The crucial point for education advertisers is that Reddit's platform rules are a floor, not a complete compliance solution. The platform establishes a minimum age and restricts certain categories, but it does not relieve the advertiser of its own COPPA, design-code, and consumer-protection obligations. An education brand that runs an ad reaching the thirteen-to-seventeen cohort must still satisfy the applicable children's-privacy requirements — age-gating where its own data collection would otherwise reach under-13 users, securing parental consent where required, and meeting design-code obligations on its own properties. The platform's permission to run an ad is not the same as legal permission to collect and use minors' data through the resulting funnel. For the US regulatory baseline see the United States advertising compliance guide and to check campaign language for risk use the Keyword Risk Checker. The defensible approach is to use Reddit's targeting and category controls as the first layer and to build the advertiser's own age-gating, consent, and data-minimization controls as the substantive compliance layer on top.
What is the compliant operating model for running education ads on Reddit in 2026?
The compliant operating model for education ads on Reddit in 2026 rests on the recognition that Reddit's thirteen-and-up audience places the advertiser inside the children's-privacy stack, so the advertiser must build age-gating, consent, data-minimization, and design controls that the platform does not provide. The model has six elements. The first element is audience and age-gating discipline. Because Reddit's audience starts at thirteen and includes minors, the advertiser must decide deliberately whether its campaign targets adults, the thirteen-to-seventeen cohort, or both, and must implement age-gating on its own properties so that any data collection does not reach under-13 users without verifiable parental consent. An education brand that drives traffic to a sign-up flow must age-screen at the point of collection. The second element is COPPA consent architecture. For any data practice that could reach under-13 users or that is directed to children, the advertiser must obtain verifiable parental consent before collection, and — critically under the amended rule effective June 23, 2025 with an April 22, 2026 compliance date — must obtain separate verifiable parental consent before disclosing a child's personal information to third parties for targeted advertising. The third element is data minimization and retention governance. The advertiser must limit collection to what is necessary, retain children's data only as long as reasonably necessary, publish a written retention policy, and avoid the indefinite retention the amended rule prohibits. The fourth element is design-code compliance on the advertiser's own properties. Where a state design code applies — Maryland is in effect, Nebraska and Vermont are taking effect — the advertiser must conduct the required data protection impact assessment and design its minor-facing properties to the 'best interests of the child' standard, treating the strictest applicable code as the operating standard for a multi-state campaign. The fifth element is biometric and identifier caution. Because the amended COPPA Rule now treats biometric and government-issued identifiers as personal information, any age-verification, proctoring, or identity feature that processes such data from minors must be governed by the full COPPA framework. The sixth element is monitoring and documentation. The advertiser should track KOSA's progress and the evolving design-code landscape, document its age-gating, consent, retention, and assessment decisions, and be prepared to demonstrate compliance. An education brand that implements all six elements operates a defensible program; a brand that relies on Reddit's age minimum and category rules alone operates on the assumption that the platform's permission equals legal compliance, which the children's-privacy framework does not support. To stress-test a multi-jurisdiction education campaign use the Legal Compliance Scan, for automated review of data and consent flows use the AI Compliance Audit, and to monitor regulatory developments see the Policy Change Tracker. The organizing principle is that the advertiser, not the platform, is the compliance system for minors' data, and the program must be built to the strictest applicable standard across COPPA, the state codes, and the direction KOSA sets.

Don't miss the next policy change.

Create a free account — track every policy change across 8 platforms, get instant alerts, and access every free compliance tool. Or try our Keyword Risk Checker first.

Create Free Account

Report Keywords — Run AI Compliance Audit

#Reddit Ads#Education#EdTech#KOSA#COPPA#Kids & Teens#Age-Appropriate Design#Data Privacy#Minors#Advertisers#Compliance Guide 2026

Share This Report

TweetShare

Related Posts

Related Resources