The more human an AI companion feels, the easier it is to let your guard down. But the more a device listens, watches, and remembers, the more its privacy policy deserves a read before you pay. After the 2026 overhaul of the US COPPA rule, a few words decide exactly where your conversations end up.
AI training, improving the product: the fine print that may feed your chats to a model
The FTC's amended COPPA reached mandatory compliance on April 22, 2026, and its toughest line is this: using a child's data to train or improve AI requires separate, verifiable parental consent, not a bundled checkbox buried in general terms. So when a policy says it may use your interaction data to train models and improve the service, that is a red flag, unless it clearly states it obtained your standalone permission. Without that, the wording defaults to collecting the conversation.
Biometric, voiceprint or facial: now explicitly personal information
This round expands personal information to cover voiceprints, facial geometry, and fingerprints. Once a companion device turns on its mic or camera, those biometrics need separate consent. Indefinite retention is banned outright, and makers must publish a written data-retention and deletion policy. The FTC already has precedent: a toy robot that quietly tracked children's location and home maps was settled by regulators, so if a policy mentions location or precise geolocation left on by default, turn it off. Where you can delete history, do it on a schedule.
One-line advice: before checkout, cross out AI training, biometric, and indefinite retention in the policy, disable what you can, and wipe stored history regularly. A vendor that only claims COPPA compliance yet cannot show a written retention policy is itself a warning sign.
© SWPO. All rights reserved.