Snapchat AR Try-On Ads 2026: Beauty Brands and the COPPA Crossover

Where Beauty AR Collides with COPPA

Beauty brands have invested heavily in Snapchat AR Try-On through 2020-2026 because the format produces measurable conversion uplift, supports product discovery for shade-dependent categories, and aligns with Snap's audience demographic position. The investment produces a compliance crossover that beauty brands frequently underestimate — the format processes face data, the platform's audience skews young, and the underlying campaign mechanics produce COPPA, state biometric, and EU GDPR exposure that requires structured compliance posture beyond what the platform's own framework provides.

The crossover is consequential because each of the underlying frameworks operates with significant enforcement infrastructure. COPPA produces FTC and state AG enforcement against advertisers that meet the directed-to-children or actual-knowledge tests. State biometric privacy laws (BIPA most prominently) produce class action litigation with statutory damages frameworks. EU GDPR produces fines up to 4% of global turnover for biometric processing failures. The cumulative regulatory exposure is material for beauty brands at scale, and the structured compliance posture is non-optional rather than discretionary.

Under COPPA, operators can carry compliance obligations whether the service is directed to children under 13 or the operator has actual knowledge of collecting their data, and practitioners read the actual-knowledge analysis to extend to constructive knowledge from campaign signals.
— Practitioner reading of the COPPA actual-knowledge standard, not a verbatim FTC quote

This guide covers how Snapchat AR Try-On actually processes face data, the COPPA framework applied to AR beauty, state biometric laws and AR face processing, age-gating mechanics and their limits, and the structured beauty brand compliance workflow. For broader kids-and-teens framework see the Healthcare Compliance guide and the Policy Change Tracker.

Why the Crossover Matters Now

The crossover has become acute through 2024-2026 because three regulatory currents have intensified simultaneously. The FTC's biometric data enforcement focus, formalised in the 2023 Policy Statement on Biometric Information and operationalised through 2024-2026 enforcement, treats face processing as a priority concern regardless of processing location. State biometric privacy laws have proliferated beyond BIPA's Illinois baseline into Texas CUBI, Washington H.B. 1493, and sensitive-category provisions within the newer comprehensive state privacy laws in Colorado, Virginia, Connecticut, Utah, Oregon, Tennessee, and others. EU GDPR Article 9 special category data enforcement has tightened around biometric processing through the European Data Protection Board's 2024 guidance on AI and biometric identification. The three currents combine to produce a compliance landscape in which beauty brand AR Try-On campaigns face structured exposure across multiple frameworks with cumulative enforcement risk.

The Practitioner's Framing

The practitioner's framing of beauty AR Try-On compliance should treat each campaign as operating within a defined risk envelope rather than within an undifferentiated compliance baseline. The envelope is defined by the campaign's targeting parameters, the creative's audience appeal signals, the AR processing characteristics, the consent infrastructure quality, the retention and destruction posture, the disclosure adequacy, and the documentation completeness. Each dimension contributes to the overall risk envelope, and the compliance practice should address each dimension explicitly rather than relying on a single global posture. The dimensions interact in ways that are not always intuitive — a creative that produces directed-to-children signals can elevate the COPPA risk for a campaign with otherwise conservative targeting, and a consent infrastructure gap can elevate the BIPA risk even when the platform's own posture is compliant. The compliance practice must address the dimensions in combination rather than in isolation.

How Snapchat AR Try-On Actually Processes

Snapchat AR Try-On processing runs through Snap's Lens infrastructure with specific mechanics that produce the format's compliance profile. The processing has on-device and platform-side components.

Processing Components

Compliance Profile

• On-device processing reduces some data transmission risk but does not eliminate biometric processing legal characterization.
• Engagement telemetry reaches platform infrastructure and connects to broader Snap data systems.
• Modified content sharing creates additional data flow when users share AR-modified content.
• Conservative legal interpretation treats AR face processing as biometric for state law purposes regardless of processing location.

Biometric Characterisation Under State Law

The legal characterisation of AR face processing as biometric data is the threshold question that determines which state and federal frameworks apply to the campaign. The characterisation is contested across jurisdictions, but the conservative compliance posture treats AR face processing as biometric for state law purposes regardless of processing location. The Illinois BIPA definition of biometric identifier includes a scan of face geometry, and Illinois courts have interpreted the definition to include face geometry created through AR processing where the geometry is capable of identifying the individual. The Texas CUBI definition is similar in scope. The Washington H.B. 1493 definition is narrower in some respects but is generally interpreted to include face geometry processing. The newer comprehensive state privacy laws (CPA, CDPA, CTDPA, UCPA, others) define biometric data as a sensitive data category with consent and processing requirements. The cumulative effect is that AR face processing in beauty Try-On campaigns reaching residents of any of these states triggers state law obligations unless the processing falls within a defined exception.

The On-Device vs Platform-Side Distinction

The on-device versus platform-side processing distinction matters for some compliance dimensions but does not eliminate the biometric characterisation. On-device processing through the Snap Lens SDK keeps the raw face data on the user's device rather than transmitting it to platform infrastructure, which reduces some data transmission risk and addresses some retention questions. However, on-device processing does not eliminate the biometric identifier creation, does not exempt the processing from state law consent requirements, and does not affect the FTC's biometric data enforcement posture. The on-device characterisation is useful for the data minimisation argument and for the security posture but is not a compliance shortcut. The platform-side engagement and interaction telemetry reaches Snap's infrastructure regardless of where the face processing occurs, and the telemetry can constitute personal information under various frameworks even when it does not constitute biometric data specifically. The compliance practice should address both the on-device biometric processing and the platform-side telemetry as separate data flows with separate compliance considerations.

For format context see the Snapchat Advertising Guide.

COPPA Framework Applied to AR Beauty

COPPA applies to operators of online services directed to children under 13 or that have actual knowledge of collecting personal information from children under 13. The application to beauty AR campaigns requires deliberate analysis.

COPPA Application Tests

• Directed-to-children test: Multi-factor analysis of subject matter, visual content, music, language, model age, child celebrities.
• Actual-knowledge standard: Includes constructive knowledge from campaign signals indicating under-13 engagement.
• Effective audience analysis: Considers delivered audience composition rather than stated targeting alone.
• Joint responsibility: Advertiser and platform both face obligations under different aspects of the framework.

Compliance Implications for Beauty AR

• Creative review must avoid producing directed-to-children signals.
• Targeting review must exclude signals correlated with under-13 audiences.
• Engagement monitoring must identify under-13 indicators.
• Documentation must support compliance posture in regulator inquiry.
• Verifiable parental consent required if processing children's personal information.

2024-2026 COPPA Rule Developments

The FTC finalised amendments to the COPPA Rule in 2024 that materially affected the actual-knowledge analysis for advertisers. The amendments added biometric identifiers to the categories of personal information covered by COPPA, which directly affects AR Try-On campaigns where face processing can constitute biometric identifier collection. The amendments tightened the verifiable parental consent requirements and clarified that operators cannot rely on age screens alone to disclaim actual knowledge of under-13 users when other campaign signals contradict the age screen. The amendments also expanded the retention and deletion requirements and added specific requirements covering data security, third-party processor diligence, and parental access rights. The compliance impact for beauty brands running AR Try-On campaigns includes elevated obligations on biometric processing, tighter actual-knowledge analysis, and specific procedural requirements that the campaign workflow must accommodate.

State-Level Youth Protection Frameworks

State-level enactments through 2022-2026 extended the youth protection framework beyond the federal COPPA baseline. The California Age-Appropriate Design Code Act (AB 2273) imposes obligations on operators that process data from users under 18, with specific requirements covering default privacy settings, dark pattern prohibitions, age estimation accuracy, data minimisation, and Data Protection Impact Assessments. Similar enactments in other states extended the framework into additional jurisdictions. The state-level frameworks expand the youth protection obligation from the COPPA under-13 baseline into the 13-17 audience segment, which is material for beauty brand AR Try-On campaigns where the 13-17 segment is frequently a significant portion of the platform audience. The compliance practice for beauty brands operating across multiple states should treat the broader youth protection framework as the operational baseline rather than the federal COPPA minimum.

For COPPA framework deep-dive see the Healthcare Compliance guide and the AI Compliance Audit.

State Biometric Laws and AR Face Processing

State biometric privacy laws form a multi-state framework that affects AR face processing in Snapchat Try-On ads. The framework's complexity stems from variation in state-level approaches.

Key State Laws

Conservative Compliance Posture

• Treat AR face processing as biometric for state law purposes regardless of processing location.
• Consent infrastructure capturing informed consent before AR processing begins.
• Retention and destruction policies specifying handling of AR processing data.
• Security measures appropriate to biometric data sensitivity.
• Documentation supporting defense against claims and regulator inquiry.

BIPA Litigation Record

The BIPA litigation record through 2017-2026 produced several foundational decisions and material settlements that beauty brands should treat as canonical reference. The Rosenbach v. Six Flags decision (Illinois Supreme Court 2019) established that a BIPA violation alone supports a private right of action without proof of actual injury, elevating the litigation risk for any technical BIPA violation. The Cothron v. White Castle decision (Illinois Supreme Court 2023) established that BIPA violations accrue per scan rather than per first-of-kind, materially increasing potential damages exposure for repeated biometric processing. The Patel v. Facebook settlement (2021, $650 million) established at scale that platform-side face geometry processing through AR or photo-tag features can constitute biometric processing under BIPA. Snapchat-specific BIPA settlements resolved through 2022-2024 established that Snap's Lens infrastructure is within BIPA's scope when applied to Illinois residents. The cumulative decisional record means that beauty brand AR Try-On campaigns reaching Illinois residents operate within a litigation framework that treats AR face processing as biometric, accrues damages per scan, and supports private right of action without proof of injury.

EU GDPR Article 9 Treatment

The EU GDPR Article 9 framework treats biometric data used for the purpose of uniquely identifying a natural person as special category data requiring explicit consent or an alternative legal basis from Article 9(2). The European Data Protection Board's 2024 guidance on AI and biometric processing clarified that AR face processing creating face geometry capable of identification falls within Article 9's scope. Consent under GDPR must meet strict standards including freely given, specific, informed, unambiguous, and separately collectable from other consents. The advertiser obligations under GDPR include lawful basis identification, the Data Protection Impact Assessment for high-risk processing, the data subject rights infrastructure, and the cross-border transfer mechanism for any data flow outside the EEA. Beauty brands operating EU-targeted AR Try-On campaigns must coordinate with Snap's GDPR compliance posture but cannot rely solely on the platform's framework.

FTC Biometric Information Policy Statement

The FTC's 2023 Policy Statement on Biometric Information and the subsequent 2024-2026 enforcement docket established that the FTC treats biometric data as a priority concern under Section 5 of the FTC Act. The Policy Statement covers consumer harm from biometric processing, including discrimination risk, security risk, and consumer expectation harm. The enforcement docket produced consent orders against advertisers and platforms for biometric processing failures, with the orders typically requiring affirmative compliance practices, multi-year monitoring, and substantial civil penalties. Beauty brand AR Try-On campaigns should treat the FTC's biometric enforcement posture as material to the compliance practice.

For broader state privacy framework see the US state privacy laws guide and the EU DSA compliance reference.

Age-Gating Mechanics and Their Limits

Snapchat's age-gating system operates through layered mechanisms with documented limitations that beauty brands must close themselves through campaign design.

Platform Mechanisms

• Self-reported age at signup — base layer with known evasion patterns.
• Verification layer for specific sensitive content categories.
• Targeting controls using platform age signals.
• Content suitability controls for placement adjacency.

Known Gaps

Technical Age Verification Patterns

Technical age verification patterns vary across platforms and regulatory frameworks, but the patterns that beauty brands should understand for Snapchat AR Try-On compliance fall into several categories. The self-attestation pattern relies on the user confirming a birth date at signup, with known evasion rates and limited reliability for users near the platform's minimum age. The behavioural-signal pattern uses platform-observed behaviour (engagement patterns, content interaction, network connections) to infer probable age, with accuracy that improves over time but remains imperfect. The facial age estimation pattern uses computer vision to estimate age from face images, with accuracy that has improved through 2024-2026 but produces error rates particularly in the 13-17 range. The document-verification pattern uses government-issued identification to verify age, with high accuracy but significant user friction and privacy considerations. The cross-reference pattern uses third-party identity verification services to validate age claims against external databases. Each pattern produces different accuracy, friction, and privacy trade-offs, and the compliance practice should understand which patterns the platform applies in which contexts and how the patterns interact with the advertiser's own targeting controls.

Audience Composition Monitoring

Audience composition monitoring is the practical mechanism for verifying that the campaign's delivered audience matches the brand's intended targeting. The monitoring should aggregate platform-reported demographics, engagement-pattern signals indicating audience age skew, organic audience feedback indicating youth exposure, and any external signals indicating audience composition issues. The monitoring should produce regular review cadence (typically weekly during active campaigns) and should trigger defined response workflows when the composition diverges from the intended targeting. The response workflows may include creative adjustment, targeting parameter adjustment, or campaign pause depending on the severity of the divergence. The monitoring infrastructure should be documented as part of the compliance practice rather than treated as ad-hoc per campaign.

For compliance practice see the Healthcare Compliance guide and the Keyword Risk Checker.

Beauty Brand Compliance Workflow

The structured compliance workflow operates as a documented end-to-end practice covering six phases. The workflow should be applied consistently across all Snap AR Try-On campaigns.

Workflow Phases

• Campaign concept: Identify applicable frameworks (COPPA, state biometric, GDPR, FTC, Snap policy); document compliance baseline.
• Creative production: Disclosure of AR modification; claim substantiation; age-appeal review; brand safety review.
• Audience definition: Minimum age above platform baseline; exclusion parameters; documentation.
• Technical implementation: Consent capture; retention schedules; destruction mechanics; security measures.
• Monitoring: Audience composition; engagement patterns; compliance signals; response triggers.
• Audit: Post-campaign review; pattern analysis; structural improvements; documentation maintenance.

Workflow Support

• Tooling automating routine compliance checks.
• Documentation capturing compliance posture per campaign.
• Training ensuring consistent application across organization and agency partners.
• Governance tying compliance outcomes to marketing accountability.

Cross-Functional Coordination

The compliance workflow requires cross-functional coordination across the brand's marketing, legal, privacy, and agency partner functions. The coordination should establish defined roles, responsibilities, and decision rights for each workflow phase. The marketing function typically owns the campaign concept and audience definition phases, with input from legal and privacy on the regulatory considerations. The legal function typically owns the regulatory framework identification and the compliance baseline documentation, with input from privacy on the biometric processing specifics. The privacy function typically owns the consent infrastructure, retention mechanics, and data subject rights implementation. The agency partners typically own the creative production execution, with compliance integrated into the production process through brand-supplied guidelines and review checkpoints. The cross-functional coordination should be governed through documented processes rather than relying on ad-hoc collaboration, and the documentation should be maintained as the workflow evolves.

Compliance Telemetry and Reporting

Compliance telemetry and reporting produces the visibility into the compliance posture that the brand's governance function requires. The telemetry should aggregate campaign-level compliance signals (targeting compliance, creative compliance, disclosure adequacy, consent capture, retention compliance) into brand-level reporting that supports governance review. The reporting cadence should align with the brand's broader compliance governance cycle (typically monthly operational review and quarterly executive review). The reporting should identify systemic issues that require structural workflow improvement rather than treating each issue as a one-off. The telemetry infrastructure should be designed to support both ongoing operational monitoring and post-campaign audit, with the audit producing learnings that feed back into the workflow design.

For workflow tooling and aggregate practice see the AI Compliance Audit, the Disclosure Checker, and the Legal Compliance Scan.

Beauty AR Compliance Checklist

• [ ] Applicable frameworks identified — COPPA, state biometric, GDPR, FTC, Snap policy
• [ ] Creative reviewed against directed-to-children signals
• [ ] Disclosure of AR or AI modification in creative
• [ ] Claim substantiation supports AR-rendered effect
• [ ] Audience targeting set at 18+ minimum for beauty AR campaigns
• [ ] Audience exclusion parameters for under-target signals
• [ ] Lookalike and interest-based parameters reviewed for younger-skew
• [ ] Consent infrastructure captures informed consent before AR processing
• [ ] Retention schedule documented with destruction mechanics
• [ ] Security measures appropriate to biometric data
• [ ] Audience composition monitored against intended targeting
• [ ] Engagement patterns monitored for under-target indicators
• [ ] Post-campaign compliance audit completed

For comprehensive beauty brand compliance audit run the AI Compliance Audit and reference the Kids and Teens Compliance guide.

Frequently Asked Questions

For ongoing tracking of biometric privacy law, COPPA, and platform policy updates, see the Policy Change Tracker.