A Comprehensive Guide to COPPA
Introduction
In today’s digital age, children’s online privacy has become a critical concern for parents, educators, and policymakers. With the increased use of the internet and mobile applications among the younger generation, it is crucial to ensure that their personal information is protected. The Children’s Online Privacy Protection Act (COPPA) provides a comprehensive set of rules and regulations to safeguard the privacy of children under the age of 13.
In this article, we will explore what COPPA compliance is, its requirements, the steps involved in obtaining and maintaining certification, and the consequences of non-compliance. Lastly, we will present a real-world case study that showcases the severe repercussions of violating COPPA regulations.
What is COPPA
COPPA is a U.S. federal law enacted in 1998 that governs the collection, use, and disclosure of personal information of any individual under the age of 13. The primary purpose of COPPA is to protect children’s privacy by giving parents comprehensive control over what information is collected from their children online and how that information is used.
According to the Federal Trade Commission (FTC), personal information includes first and last name, physical address, online contact details, username, phone number, Social Security number, persistent identifiers across services, photo/video/audio files with child's image/voice, geolocation data revealing location, and any information combined with these identifiers.
COPPA applies to any website, mobile application, or online service that collects personal information from children under 13. This includes operators of services that are likely to be accessed by children, as well as third-party entities that collect personal information through these platforms.
COPPA Requirements
COPPA imposes several key requirements on websites and online services to protect children’s online privacy:
Providing Clear and Comprehensive Privacy Notices
Organizations must provide clear and comprehensive online privacy policies that explain their information collection, use, and disclosure practices. These notices must be readily available and easily understandable. Additionally, organizations must provide direct notice to parents about these policies.
Obtaining Verifiable Parental Consent
Before collecting, using, or disclosing personal information from children, organizations must obtain verifiable parental consent. This must be obtained through reasonable means such as providing a consent form for parents to sign or using other approved electronic methods.
Parental Control and Privacy Protection
Organizations must grant parents access to review their child’s personal information as well as the ability to request deletion of the data. Furthermore, parents should always have the option to prevent further online collection or use of their child’s details.
Procedures to Protect Children’s Information
Organizations must establish and maintain procedures to protect the confidentiality, security, and integrity of children’s personal information. This includes implementing data collection and use limitations, and adhering to data retention and deletion requirements.
Restrictions on Online Marketing and Behavioral Advertising
COPPA prohibits organizations from conditioning a child’s participation in online activities on the disclosure of more personal information than is reasonably necessary. Moreover, organizations are restricted from using children’s personal information for targeted marketing purposes without verifiable parental consent.
Types of Verifiable Parental Consent
One of the key requirements of COPPA involves obtaining verifiable parental consent before collecting, using, or disclosing personal information from children under 13 years old. Although COPPA does not require one specific method of obtaining consent, the FTC has several methods that meet common standards:
Consent Form: The most straightforward approach is providing a printable consent form that can be signed by the parent and returned via mail, fax, or electronic scan. The form must state the operator's information practices and allow the parent to give or deny consent.
Payment Methods: Have a parent use a credit card, debit card, or other online payment system that provides notifications of every transaction.
Video/Voice Consent: Parents can communicate consent through a video conference or staffed telephone line. This method requires trained personnel to operate the video/voice systems and maintain records of the consent.
Government-Issued Identification: Ask a parent to provide a form of government-issued identification to verify identity and consent. Make sure to delete the identification after verification.
Knowledge-Based Authentication: Present a series of knowledge-based questions that would be difficult for someone other than the parent to answer about their child.
Photo ID and Facial Recognition: Ask parents to upload a photo of a government-issued identity as well as a photo of themselves and use facial recognition software to verify their identity.
Email Plus: Obtaining consent via email is permitted, but operators must take additional confirmatory steps, such as following up with a confirmation email or sending a letter to the parent after initially receiving consent. This requires the parent to be notified of their right to revoke consent at any time.
Regardless of the method chosen, organizations must be able to demonstrate a reasonable process for obtaining verifiable parental consent before data collection. By thoughtfully implementing FTC-approved consent methods, organizations can fulfill this requirement.
Achieving COPPA Compliance
To ensure compliance with COPPA, website, and online service operators should follow these steps:
1. Determine if COPPA Applies to Your Business: Evaluate whether your organization’s services are directed to children under 13 or has knowledge of collecting personal information from children under 13. If so, COPPA requirements apply to your organization and you must stop collecting the information until COPPA compliance is achieved.
2. Develop and Implement Policies: Develop privacy policies to include information about data collection, use, and disclosure practices related to children's personal information.
3. Implement Age Screening Mechanisms: Implement mechanisms to identify users who are under the age of 13. This may include age gates or age screening questions.
4. Obtain Verifiable Parental Consent: Establish processes and procedures for obtaining verifiable parental consent before collecting information from children under 13. Make sure to maintain proper records of consent.
5. Establish Data Protection Practices: Implement procedures to protect the confidentiality, security, and integrity of children’s personal information. This includes encryption, access controls, data retention/deletion policies, and regular security audits.
6. Train Employees: Provide comprehensive training to all personnel on COPPA compliance requirements and the organization’s policies and procedures.
7. Continuous Monitoring and Updates: Continuously monitor and review your COPPA compliance efforts to ensure they remain effective over time.
Best Practices and Additional Resources
To ensure robust COPPA compliance and protect children’s online privacy, organizations can consider the following best practices and resources:
Industry Best Practices for Children’s Online Privacy: Consult industry guidelines and best practices for children’s online privacy such as those provided by the Children’s Advertising Review Unit (CARU) or the International Association of Privacy Professionals (IAPP).
COPPA Guidelines from the Federal Trade Commission (FTC): The FTC provides comprehensive guidance and resources on COPPA compliance including FAQs, instructional videos, and compliance guides for organizations.
Consulting COPPA Compliance Experts: Consider seeking advice from COPPA compliance experts to ensure the organization’s policies and practices align with the latest regulations and industry standards.
Consequences of Non-Compliance
Failure to comply with COPPA can result in significant consequences including:
Civil Penalties and Fines: FTC, which enforces COPPA, can impose civil penalties of up to $51,744 per violation. These fines can quickly add up in cases of widespread violations.
Potential Lawsuits and Legal Actions: Non-compliance with COPPA can also lead to lawsuits and legal actions from parents, consumer protection groups, or state attorneys general which can result in further financial penalties and legal costs.
Reputational Damage and Loss of Trust: A COPPA violation can severely damage a company's reputation, with negative publicity as being unethical in handling children's data. Consumers, especially parents, may lose trust in the company, leading to a competitive disadvantage in the market.
Case Study: TikTok’s COPPA Violation
In February 2019, the FTC announced a $5.7 million settlement with TikTok, one of the world’s most popular social media platforms, for violating COPPA. According to the FTC’s complaint, the application collected personal information including names, email addresses, pictures, videos, and location data from users without obtaining verifiable parental consent as required by COPPA.
The FTC alleged that TikTok violated COPPA by:
Failing to provide direct notice to parents about its data collection practices.
Failing to obtain verifiable parental consent before collecting information from children under 13.
Allowing children under 13 to create user accounts and upload videos without obtaining parental consent.
As part of the settlement, TikTok was also required to implement a comprehensive data protection program by removing all information from users under 13 without parental consent and establishing a comprehensive COPPA compliance program including regular audits and privacy training for employees.
The TikTok case serves as a reminder of the severe consequences that companies can face for violating COPPA. In addition to substantial financial penalties, TikTok also faced significant reputational damage and loss of user trust. By prioritizing children’s online privacy, companies can avoid these consequences.
Conclusion
In conclusion, protecting children's online privacy is not only a legal obligation but also an ethical responsibility for websites and online service operators. By understanding COPPA requirements, organizations can avoid costly penalties, legal actions, and reputational damage. More importantly, they can demonstrate their commitment to ethical business practices and contribute to a safer online environment for the youngest and most vulnerable users.
References
https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions
https://www.ftc.gov/business-guidance/resources/childrens-online-privacy-protection-rule-six-step-compliance-plan-your-business
https://www.ftc.gov/business-guidance/resources/childrens-online-privacy-protection-rule-six-step-compliance-plan-your-business#step4
https://www.theverge.com/2019/2/27/18243312/tiktok-ftc-fine-musically-children-coppa-age-gate
https://bbbprograms.org/programs/all-programs/children's-advertising-review-unit
https://iapp.org/resources/article/childrens-online-privacy-protection-act-of-2000-the/
https://www.ftc.gov/news-events/news/press-releases/2019/02/video-social-networking-app-musically-agrees-settle-ftc-allegations-it-violated-childrens-privacy
