Children’s Online Privacy Protection Rule: Strengthening Kids Privacy

Highlights of the Children’s Online Privacy Protection Rule:

• Who is covered--what is directed to children and personal information
• Parental consent—how to get it
• Exceptions
• Important FAQs under the Rule

• Children’s Online Privacy Protection Rule Updates: Overview
  • COPPA Background:
    • Children’s Online Privacy Protection Act, enacted by Congress in 1998, to limit the collection of personal information from children 12 and under without parental consent.
    • Congress directed the Federal Trade Commission (FTC), the nation’s consumer protection agency, to issue and enforce regulations concerning children’s online privacy
    • The FTC issued the Children’s Online Privacy Protection Rule, effective April 21, 2000. In a nutshell, requires that operators of online sites or services directed to children, or operators that have actual knowledge of child users on their sites or services, notify parents and obtain their consent before they collect, use, or disclose personal information from children under 13. Operators covered by the Rule also have to post a privacy policy that is clear, understandable, and complete.
  • COPPA Amendments:
    • The FTC issued an amended COPPA Rule on December 12, 2012.
    • Amendments to the COPPA Rule went into effect on July 1, 2013 and put in place additional children’s privacy protections to address new technological challenges. Specifically, Amended COPPA Rule imposes significant compliance obligations on websites and online services (including mobile applications) that collect personal information (including by passively tracking personal information through persistent identifiers and not just active collection) from children under 13. The Amended COPPA Rule also extends to plug-ins and online advertising services with “actual knowledge” that they are collecting personal information from children under 13.

• Recent FTC Updates (via FTC’s Compliance with COPPA Frequently Asked Questions):
  • COPPA and Schools (April)-describe
  • Verifiable Parental Consent/ (July)-describe
• Compliance and Best Practices
  • Determine if COPPA applies to you-discuss how this is determined.
  • If COPPA-covered entity, implement and maintain processes and procedures for compliance with the Amended COPPA Rule-mention penalties
  • Compliance and best practices
    • Prepare and post a COPPA- compliant privacy policy that accurately reflects your information collection, use, and disclosure practices. Review the policy on a regular basis and update it as your practices change. The FTC has brought plenty of actions alleging violations of Section 5 of the FTC Act against companies whose privacy policies did not match their actual practices.
    • Prepare and implement COPPA- compliant parental notice forms and procedures. Provide direct notice to parents before collecting Personal Information from their children and obtain parents’ verifiable consent before collecting, using or disclosing information from their children. Remember that parents have ongoing rights to review and delete their children’s information.
    • Establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children. Minimize what you collect in the first place.
    • Know your service providers. Take reasonable steps to release personal information only to service providers and third parties capable of maintaining its confidentiality, security, and integrity and get those assurances in writing.
    • Educate your personnel. Develop and implement a training program on COPPA-requirements for your personnel and train personnel on a regular basis.
    • Comply via an FTC-approved Safe Harbor Program. Consider participating in one of the six (6) FTC-approved COPPA safe harbor programs, participation will, in most circumstances, be subject to the review and disciplinary procedures provided in the safe harbor’s guidelines in lieu of formal FTC investigation and law enforcement.

• The revised COPPA Rule brings “third parties” in the online advertising ecosystem within the reach of COPPA for the first time.
• The Rule, commentary, and FAQs make clear that behavioral advertising on child-directed sites is a key concern of the FTC.
• Third parties that are potentially affected by the COPPA Rule have several options for compliance, including not servicing child-directed sites, modifying their services, or providing notice/consent.
• However, the Rule and guidance leave some other areas unclear, and caution is warranted.