FTC Amends COPPA Rule and Previews Future Enforcement Policies | White & Case LLP International Law Firm, Global Law Practice
FTC Amends COPPA Rule and Previews Future Enforcement Policies

FTC Amends COPPA Rule and Previews Future Enforcement Policies

White & Case Technology Newsflash

On December 19, 2012, the Federal Trade Commission ("FTC") adopted the first amendments to the Rule promulgated under the Children's Online Privacy Protection Act (hereinafter, "COPPA" for the Act, and "COPPA Rule" for the Rule) since the COPPA Rule's issuance in 1999.[1] COPPA seeks to protect children under the age of thirteen in their use of the Internet by regulating how websites collect, use, and disclose children's personal information. Under the COPPA Rule, before a website "operator"[2] may collect a child's personal information, it must notify the child's parent of its data collection practices and obtain parental consent to collect the information.[3] The COPPA Rule has always applied to operators of websites directed to children and to "general audience" websites if the operator has actual knowledge that the website is collecting children's personal information.[4]

The COPPA Rule had become outdated given the rapid development of technology and was failing to address certain ways in which personal information is collected online. In announcing the amendments, FTC Chairman Jon Leibowitz recognized this fact and explained that the COPPA Rule will now reach a wider swath of media and technology companies and will govern the collection of more types of information, including photo, video, and audio files, geolocation information, and persistent identifiers (such as IP addresses or mobile device serial numbers).[5]

 

Amended definitions extend COPPA Rule to more industry participants

The amended COPPA Rule clarifies that plug-in service providers, add-on content providers, and mobile application developers are charged with COPPA compliance if they have "actual knowledge" that they are collecting information via a child-directed site. Specifically, if a third party service or content provider that collects personal information via another site has actual knowledge that the primary site is directed to children, then the third party itself is deemed an "online service directed to children" and is thus subject to the COPPA Rule.[6] According to the FTC, whether a third party online service is found to have actual knowledge will be based upon a case-by-case analysis of the facts,[7] but actual knowledge would certainly be established when: (a) the third party online service communicates directly with the child-directed site, or (b) a representative of the third party online service "recognizes the child-directed nature of the content".[8]

Conversely, the amended COPPA Rule definitions clarify that a child-directed website operator is liable for third party service or content providers' collection of children's personal information through its website, even if the primary site does not itself collect such information.[9] The FTC made this clarification in order to "close[] a loophole" that previously allowed child-directed sites to outsource personal information collection to third parties and thereby avoid parental notice-and-consent obligations.[10] Therefore, if a child-directed site's third party online service provider lacks "actual knowledge" as to the site's child-directed content (such that the third party online service is exempt from the COPPA Rule obligations), the child-directed site itself will still be responsible for the third party service provider's collection of children's personal information on the site's behalf.[11]

 

Amended definitions align with the FTC's recent enforcement practices

The FTC still has discretion to classify sites as either child-directed or directed to a "general audience", based on the FTC's review of sites' content and audience composition.[12] The amended COPPA Rule, however, clarifies that a site or service "that does not target children as its primary audience" will not be deemed a child-directed site as long as the site includes a mechanism to age-screen users before collecting any personal information.[13]

This amended definition comports with the FTC's recent enforcement action against Artist Arena, LLC ("Artist Arena"), an operator of fan websites for pop stars including Justin Bieber, Selena Gomez, and Rihanna.[14] According to the FTC's Complaint, Artist Arena's fan sites violated the COPPA Rule when they registered approximately 25,000 children users, storing email addresses, names, birth dates,[15] (and in approximately 5,000 cases, credit card information)[16] without first notifying parents and obtaining consent to do so. The FTC further alleged that Artist Arena's fan sites stored basic personal information collected from nearly 75,000 children who began but never finished the site registration process.[17] Artist Arena paid a $1 million civil fine to settle the case on October 3, 2012.[18]

The FTC prosecuted Artist Arena as a "general audience" website operator that had actual knowledge that it was collecting children's personal information ("actual knowledge" was established because each site asked users to enter a birth date upon entering the site).[19] Under the COPPA Rule, general audience sites need only conduct parental notice-and-consent measures after they become aware that a particular user is younger than thirteen years old.[20] Comparatively, a child-directed site must treat all users as children and thus must obtain parental notice-and-consent before collecting any personal information from any site visitor.[21] The FTC determined that Artist Arena operated a general audience site (despite the fact that pop star fan sites are used heavily by children) because the FTC prefers encouraging age-screening rather than requiring mixed-audience sites to obtain parental consent prior to collecting the personal information of every user.[22]

The amended definition of "Website or online service directed to children" substantiates the categorization policy followed by the FTC in its Artist Arena prosecution. Under the amended COPPA Rule, sites that would otherwise qualify as child-directed sites but do not (in the FTC's opinion) "primarily" target children may use age-screens and follow the parental notice-and-consent requirements only when collecting the personal information of those users who self-identify as younger than thirteen years old.[23]

As the FTC encourages wider use of age-screening, companies that target mixed audiences should tailor parental notice-and-consent practices to ensure that their own data collection is COPPA compliant. Additionally, if designing workflows into sites or applications that ask for a user's age, companies should ensure that action consistent with the amended COPPA Rule is taken after collecting such age related information with respect to the collected personal information. All Internet content providers, including those providing add-ons, plug-ins, and mobile applications, should keep abreast of the FTC's enforcement practices in light of these amendments, as a broader base of companies are now subject to regulation.

The COPPA Rule amendments go into effect on July 1, 2013.

 

[1] - 16 C.F.R. pt. 312 et seq. (1999), issued pursuant to 15 U.S.C. § 6502(b)(1) (1998).
[2] - Defined in 16 C.F.R. pt 312.2.
[3] - 16 C.F.R. pt. 312.4, 312.5.
[4] - 16 C.F.R. pt. 312.3.
[5] - Jon Leibowitz, Chairman, FTC, Statement on the Updated FTC COPPA Rule 4-5 (Dec. 19, 2012), available at ftc.gov/speeches/leibowitz/121219coppastmt.pdf; see also Notice of Final Amendment to Children's Online Privacy Protection Rule 3-4, 15, 151-67, available at ftc.gov/os/2012/12/121219copparulefrn.pdf (hereinafter "Notice") (summarizing the FTC's basis for amending the COPPA Rule definitions and including text of the amended COPPA Rule).
[6] - 16 C.F.R. pt 312.2 (as amended) (see Notice, at 153-54 for the amended definition of "Operator", at 156 for the amended definition of "Website or online service directed to children", and at 15-27 for an explanation of the FTC's basis for the amendments).
[7] - Notice at 24-27 (explaining the basis for the amendment and the FTC's intentions for enforcement thereof).
[8] - Id. at 27.
[9] - 16 C.F.R. pt 312.2 (as amended) (see Notice, at 153-54 for the amended definition of "Operator", at 156 for the amended definition of "Website or online service directed to children", and at 15-27 for an explanation of the FTC's basis for the amendments).
[10] - Press Release, FTC, FTC Strengthens Kids' Privacy, Gives Parents Greater Control over their Information by Amending Children's Online Privacy Protection Rule (Dec. 19, 2012), available at ftc.gov/opa/2012/12/coppa.shtm.
[11] - Id.
[12] - 16 C.F.R. pt 312.2 (as amended) (see Notice, at 156 for the amended definition of "Website or online service directed to children", and at 15-27 for an explanation of the FTC's planned enforcement thereof).
[13] - Id.
[14] - Complaint at 10-11, U.S. v. Artist Arena, LLC, No. 12 Civ. 7386 (S.D.N.Y. Oct. 3, 2012) (hereinafter "Complaint").
[15] - Id. at 5-10.
[16] - Id. at 6-8.
[17] - Id. at 4-11.
[18] - U.S. v. Artist Arena, LLC, No. 12 Civ. 7386, 5 (S.D.N.Y. Oct. 3, 2012) (consent decree and order for civil penalties, injunction, and other relief).
[19] - Complaint at 12.
[20] - 16 C.F.R. pt 312.3.
[21] - Edith Ramirez, Commissioner, FTC, Keynote Address at CARU Annual Conference 5-6 (Oct. 3, 2012), available at ftc.gov/speeches/ramirez/121003caru.pdf (describing FTC's history of interpreting and applying the COPPA Rule definitions as described in the above text).
[22] - Id. at 10-12 (describing FTC's enforcement policy in the context of the Artist Arena prosecution).
23 - While the amended definition provides the age-screening safeguard for sites whose "primary audience" is not children, the FTC also added language allowing it to make categorization determinations based upon the "presence of child celebrities or celebrities who appeal to children" in website content. 16 C.F.R. pt 312.2 (as amended) (see Notice at 156); see also Notice at 47-54 (explaining the basis for the amendment and the FTC's intentions for enforcement thereof).

 

This publication is provided for your convenience and does not constitute legal advice. This publication is protected by copyright.
© 2013 White & Case LLP