OpenX today published a blog post arguing that restricted access to compliant inventory, more than regulation itself, explains why most brands advertising to children avoid programmatic buying. The ad exchange also described how its Child-Safe Marketplace, a curated route to connected TV supply, is vetted, restricted and audited by an outside body.

In Short

OpenX, a company that sells online ad space, wrote today that most brands selling to children skip automated ad buying because safe, rule-following places to buy have been hard to find. That matters to brands, publishers and anyone whose work touches children's screen time, since the rules on who counts as a child and what data may be used differ from state to state and keep changing. OpenX now points to an invitation-only marketplace for streaming-TV inventory aimed at children, where every seller and buyer is approved, targeted advertising is switched off and an outside group checks the setup.

The argument: access first, regulation second

The post, published today and credited to Julie Rooney in OpenX's Brands & Agencies category, begins with buying habits rather than law. Kids and family advertisers plan around peak moments, according to OpenX, yet the complaint the company keeps hearing from buyers is not seasonal. It concerns how the inventory is bought at all, in any month of the year.

Most brands advertising to children, OpenX says, do not buy programmatically. They contract directly with publishers, or run campaigns on YouTube and let the platform's labeling do the compliance work. Others do buy programmatically, but with trust resting on "a publisher's self-declared kids-safe flag" and on every downstream partner honoring it. The company does not blame those buyers. "Programmatic pipes for this inventory mostly don't exist, or don't hold up," according to OpenX.

Ask a buyer why child-directed programmatic inventory is avoided, the post continues, and regulation is rarely the first answer. Access is. Publishers with kids' content default to direct deals or platform buys, partly because programmatic infrastructure has not kept pace with how quickly the rules shift.

The post offers no survey, market-share figure or spend estimate to support any of this. The description of buyer behavior is OpenX's own characterization, based on what it says it hears from the buyers it works with.

Thresholds that do not agree

The legal backdrop, in OpenX's account, is a stack of overlapping regimes. The Children's Online Privacy Protection Act (COPPA) is one layer. A growing list of state laws adds restrictions and thresholds of its own, and the states do not agree on who counts as a child: some cap the definition at 12, according to OpenX, while others extend protections to 15, 16 or 17.

Recent legislation shows the spread. California's law on addictive feeds, signed on September 10, 2026, applies to users under 16. In Europe, Article 28 of the Digital Services Act already bars profiling-based advertising to recipients a platform knows with reasonable certainty to be minors, and the European Commission adopted a separate proposal on September 17, 2026, the EU KIDS Act, which sets a six-month deadline to disable existing under-15 accounts. That Brussels measure shares only a name with the US bill discussed below.

These laws generally permit advertising to children and teenagers, OpenX notes, but only inside set parameters. Advertising has to be purely contextual and cannot draw on personal data from kids or teens for targeted advertising. Responsibility for staying within those limits typically falls on the brand, and doing so at bid-request speed is, in the company's words, a taller order than most buyers want to contend with. Building a bidstream that holds up under scrutiny with real proof points, rather than a black box or a "trust me bro" mentality, "is real infrastructure work," according to OpenX, which adds that most of the industry has not done it.

The calendar keeps moving as well. The Federal Trade Commission's amended COPPA rule had a compliance deadline of April 22, 2026, according to OpenX. The commission published the amendments on April 22, 2025, with effect from June 23, 2025, adding a separate consent requirement for sharing children's data with third parties and a broader definition of child-directed services. On the day the deadline fell, YouTube published a formal audience-setting FAQ for creators. Earlier, on February 25, 2026, the FTC had issued a policy statement that gives age-verification technology a conditional enforcement shield.

Federal legislation adds a further layer, and here the sources diverge. OpenX says the KIDS Act, which would extend protections past age 13 to include minors under 18 and put real limits on targeted advertising to minors, cleared the House this summer with rare bipartisan support. The only record located while preparing this article is a March 6, 2026 release from Representative Erin Houchin's office, which states that the House Energy and Commerce Committee passed H.R. 7757, the Kids Internet and Digital Safety (KIDS) Act, the previous day. A House floor vote could not be confirmed from the sources checked, and PPC Land coverage reviewed for this article does not record one. Age verification acts and age appropriate design codes, OpenX adds, continue to pass across the US and beyond. Managing that level of ongoing risk "requires significant, continuous work," according to the post, and so buyers pick the option that feels safest, which is usually the one that avoids programmatic entirely.

What the marketplace contains

As OpenX describes it, the Child-Safe Marketplace is a curated programmatic path to child-directed CTV inventory. Every publisher and buyer is individually vetted, deals run as private marketplace deals, targeted advertising is blocked by design, and the framework is audited by PRIVO, which OpenX calls an FTC-approved COPPA Safe Harbor. The post sets out three elements.

The first is sell-side and buy-side vetting: publishers and buyers are individually approved and connected through invitation-only deals. The second is data minimization. Personal data use is restricted, targeted advertising is prohibited by default and by design, and "real technical blocks" are in place to enforce the policies. The third is external oversight, in the form of the PRIVO audit. Getting a compliant path into programmatic child-directed inventory, the post argues, "took real engineering work, not a policy memo bolted onto existing pipes."

The safeguards, according to OpenX, do more than reassure buyers that the inventory meets compliance requirements. They supply a specific, verifiable answer to the question of how anyone knows the inventory is high quality, compliant and appropriate for kids, instead of relying on a publisher's or platform's word alone. OpenX also ties the design to publisher economics: with the right controls built into the supply path and maintained over time, publishers can continue funding child-directed content in a way parents can feel comfortable with.

How the pieces map to the plumbing

Invitation-only deals have become a common structure in connected TV. Viant extended its Direct Access route to private marketplace and programmatic guaranteed deals on September 24, 2026, and in OpenRTB a deal identifier travels in a private marketplace object attached to each impression, together with a floor price and an auction-type field that can declare the floor to be the agreed price rather than a reserve. The same coverage cites a January 2026 survey of more than 200 decision-makers in which 76% rated curated, private marketplace or deal ID supply as important for the year.

The vetting and the technical blocks both operate on the flow of bid requests that offers each impression to every invited buyer, whether or not anyone buys. A single request can carry a page URL, an app store bundle, an IP address, a device model, a mobile advertising identifier, precise coordinates, cookie identifiers, audience segments and regulatory flags, and each field poses its own minimization question. The post does not say which fields OpenX strips or truncates.

For context, within the kidtech category the standard signal is a coppa flag in the Regs object of the OpenRTB request, set to 1 by the publisher or the supply-side platform when inventory is child-directed or the user is known to be under 13. That is the self-declared kind of signal OpenX describes as lacking independent verification when it stands alone. Google's equivalent ad request parameters, TFCD and TFUA, were replaced on May 18, 2026 by a single TFAT parameter that adds a distinct teen tier.

What PRIVO's status means

According to the FTC, COPPA's safe harbor provision lets industry groups request approval of self-regulatory guidelines, and operators in an approved program are first subject to the program's disciplinary procedures in lieu of FTC enforcement. The FTC's announcement says PRIVO was approved under that provision after a comment period that closed on May 7, 2004, and the commission's approval letter calls it the fourth safe harbor program. The amended COPPA rule later added obligations for the programs themselves: six months from publication to comply with new disclosure requirements and 90 days to meet certain reporting obligations.

What the post leaves out

The post names no participating publishers or buyers. It gives no launch date, no count of approved partners, no geographic scope, no list of connected demand-side or supply-side platforms, no pricing and no performance results. It does not say whether PRIVO's findings are published, how often reviews take place, or what triggers removal of a participant. It ends with an invitation to contact OpenX's team.

Six questions on the buyer's side

OpenX frames the buying decision around six questions, each of which doubles as a description of what the company says a transparent partner can answer.

The first concerns verification: whether a process goes beyond publisher self-attestation to independent review against clearly defined criteria, including who evaluates the inventory, how it is assessed and how often it is reviewed. The second asks which identifiers and data elements are permitted, restricted or removed, and how those controls are enforced across the request and response. A transparent partner, the post says, can explain how the bidstream is configured for child-directed media and describe a clear audit plan.

The third question turns to the supply chain. Every participant, from publisher and supply-side platform to the demand-side platform, agency or brand, has a role, and OpenX points to clear contractual responsibilities, monitoring and escalation procedures if an issue arises further down the chain. The fourth asks whether the underlying controls can absorb new age thresholds and requirements without rebuilding the entire media path, a question that follows directly from the 12-to-17 spread.

The fifth returns to safeguards and asks for specifics: which practices are technically blocked, how inventory and participants are reviewed, and what ongoing oversight supports those controls. The sixth concerns reporting. For sensitive campaigns, specialized reporting "can remove black boxes and offer real assurance," according to OpenX, and responsible partners are expected to prove that their infrastructure is working as intended.

The post closes on a statement of intent. Kids deserve heightened privacy protections, OpenX writes, "which is exactly why regulators watch this space so closely," but they also deserve access to quality content, and a programmatic path built for them is, in the company's view, worth the effort.

How the segment has been handled so far

The record on self-declared labels is not clean. Disney agreed in September 2025 to pay $10 million after the FTC found it had failed to designate child-directed YouTube videos as Made for Kids, a case that turned on channel-level classification masking individual videos aimed at children. A CIMM report argued that poor children's data wastes $590,000 of every $1 million campaign and proposed a taskforce, citing the absence of any US trade body dedicated to children's media.

Elsewhere, closed arrangements dominate. SuperAwesome became Roblox's sole under-13 advertising partner in June 2026, using contextual targeting through a third-party vendor rather than an open marketplace. Buyers in the family segment have, in the main, adapted through contextual targeting and specialist compliance vendors operating inside platforms that still carry advertising. And in a court ruling covered by PPC Land on the Justice Department's bid to lift TikTok's 2019 child privacy order, the court found that tools for achieving compliance are not proof that compliance is achieved. The practical question that coverage raised, who verifies what a platform says about its under-13 audience, is the one the OpenX post tries to answer with an outside audit.

OpenX has been building out connected TV products in parallel. With TVision, it released OpenX Attention Targeting on March 11, 2026, a pre-bid attention product available through OpenXSelect that reaches, according to OpenX, more than 231 million monthly unique users through its identity graph.

Why the post matters to marketers

Three points stand out. The first is the shift in what counts as evidence. A publisher's flag or a platform's label is a claim; an independent audit, documented bidstream configuration and compliance reporting are artifacts that can be inspected. The six questions show what one vendor expects scrutiny to look like, though they are not an industry standard.

The second is definitional drift. With protected-minor thresholds running from 12 to 17 across US states, 15 in the EU proposal and 16 in California's feed law, any structure encoding a single age line faces periodic rebuilding, which is the risk OpenX's fourth question targets. Google's replacement of two flags with one carrying a teen tier in May 2026 points the same way.

The third is what remains unknown. The post provides no volume data on child-directed CTV supply moving through programmatic channels, so the size of the gap between direct and programmatic buying cannot be judged from it. Its claims about audits and technical blocks are OpenX's own statements, published as marketing content and unaccompanied by the audit documentation itself.

Timeline

  • May 7, 2004: comment period closes on PRIVO's application for COPPA safe harbor status, which the FTC later approves as its fourth such program
  • April 22, 2025: FTC publishes the amended COPPA rule in the Federal Register
  • June 23, 2025: amended COPPA rule takes effect
  • September 2, 2025: FTC reaches a $10 million settlement with Disney over YouTube videos not designated as Made for Kids
  • February 25, 2026: FTC issues a policy statement giving age-verification technology a conditional COPPA enforcement shield
  • March 5, 2026: House Energy and Commerce Committee passes H.R. 7757, the KIDS Act, according to Representative Erin Houchin's office
  • March 11, 2026: OpenX and TVision release OpenX Attention Targeting for CTV
  • April 22, 2026: compliance deadline for the amended COPPA rule; YouTube publishes an audience-setting FAQ
  • May 18, 2026: Google replaces TFCD and TFUA with the TFAT parameter, adding a teen tier
  • September 10, 2026: California law on addictive feeds for users under 16 is signed
  • September 17, 2026: European Commission adopts its EU KIDS Act proposal
  • September 24, 2026: Viant extends Direct Access to private marketplace and programmatic guaranteed deals
  • Today: OpenX publishes its post on child-directed advertising and the Child-Safe Marketplace

Summary

Who: OpenX, an independent ad exchange, in a blog post credited to Julie Rooney, with PRIVO named as the FTC-approved COPPA Safe Harbor that audits its framework.

What: An argument that limited access to compliant inventory, not regulation alone, keeps most child-directed advertising out of programmatic buying, together with a description of the OpenX Child-Safe Marketplace for child-directed CTV inventory: individually vetted publishers and buyers, invitation-only deals, blocked targeted advertising and an external audit.

When: Published today. The amended COPPA rule's compliance deadline was April 22, 2026.

Where: The post concerns mainly the US, where COPPA, state laws and pending federal bills apply, with references to age verification and design code laws elsewhere.

Why: Buyers, in OpenX's account, choose direct deals and platform buys because programmatic pipes for child-directed inventory are scarce and compliance rules, including the age at which a person counts as a child, keep changing. OpenX presents a vetted, audited, invitation-only route as an alternative.