The core claim in Allison Schiff’s July 20, 2026 AdExchanger column is a warning shot for anyone monetizing consumer data: the industry’s decades-long workaround for children’s privacy — simply not asking too many questions — is running out of runway. Under the Children’s Online Privacy Protection Act, liability has traditionally attached only when an operator had “actual knowledge” it was collecting data from kids under 13. That standard let ad tech vendors, publishers and platforms build businesses on a kind of engineered ignorance, avoiding age signals rather than confronting them.
What Schiff is describing is the collapse of that comfort zone, not because the statutory text has changed, but because regulators, plaintiffs’ lawyers and state legislatures have gotten much better at inferring knowledge from circumstantial evidence — audience composition, content targeting, internal analytics — rather than requiring a smoking-gun admission. For data brokers, ad exchanges and adtech vendors that built compliance programs around never formally confirming a user’s age, that shift matters enormously. Willful blindness is increasingly being treated as functionally equivalent to actual knowledge, which strips away the legal cover that let companies avoid building real age-assurance infrastructure.
Ignorance was never really a compliance program; it was a bet that no one would look too closely, and that bet is getting harder to place.
The practical consequence is that data companies serving anything resembling child-adjacent audiences — gaming, ed-tech, social, streaming — now have an incentive to conduct honest internal audits rather than avoid them, since a defensible compliance record beats plausible deniability once regulators start reconstructing what a company “should have known.” Expect renewed pressure on age-verification vendors, tighter first-party data segmentation, and more conservative targeting defaults from platforms unwilling to bet their COPPA exposure on a jury’s read of what counts as knowledge.
For years, plausible deniability was the online ad industry’s de facto workaround for dealing with children’s privacy. The concept of “actual knowledge” under the Children’s Online Privacy Protection Act quietly set the bar. As long as an operator wasn’t provably aware that it was collecting personal information from children under 13, it could keep treating […]
