What do businesses need to do to comply with the Children’s Online Privacy Protection Act (COPPA) in the US? Here is how to ensure that your business is COPPA compliant, and what happens when you don’t!
In a significant blow to two tech giants, Microsoft and Amazon, within a span of a week, both companies have faced legal action and hefty fines for violating the Children’s Online Privacy Protection Act (COPPA) in separate incidents.
Children’s Online Privacy Protection Act (COPPA) and big-ticket fines
The U.S. Federal Trade Commission imposed a fine of $20 million on Microsoft for purported violations of the Children’s Online Privacy Protection Act concerning its Xbox gaming system. The announcement was made on July 5, 2023.
The FTC investigation revealed that children under the age of 13 who signed up for Microsoft’s Xbox gaming service were asked to provide personal information, including their name, email address, phone number, and date of birth.
Moreover, until 2019, the sign-up screen featured a pre-filled check box that allowed Microsoft to share user information with advertisers without explicit consent.
Microsoft’s data collection practices further raised concerns as they retained the collected information even if a parent abandoned the sign-up process. Such actions violated COPPA regulations, which require obtaining parental consent before gathering personal data from children.
As part of the settlement, Microsoft has agreed to rectify its practices and enhance its compliance with COPPA guidelines. The company will be subject to ongoing monitoring by the FTC to ensure the implementation of necessary changes and to safeguard the privacy of young users.
Days before that, it was Amazon’t turn. On May 31, 2023, the FTC and the Department of Justice (DOJ) accused Amazon of deceptive practices related to its handling of children’s data through its popular AI-powered voice assistant, Alexa.
The FTC alleged that Amazon had misled parents and users about its data deletion practices, retained children’s recordings indefinitely, and used sensitive voice and geolocation data for its own purposes, all in violation of the COPPA Rule.
As a result of the accusations, Amazon has been fined a staggering $25 million by the FTC. The company is also required to revamp its data deletion practices and implement stringent privacy safeguards for Alexa.
The FTC’s Samuel Levine, director of the Bureau of Consumer Protection, stated that Amazon’s actions prioritized profits over privacy and blatantly disregarded the rights of parents and children protected by COPPA.
Under the terms of the order, Amazon must delete inactive child accounts, specific voice recordings, and geolocation information. Furthermore, the company is prohibited from utilizing such data for its algorithms, ensuring greater protection for children’s privacy moving forward.
Non-US businesses and Children’s Online Privacy Protection Act (COPPA) compliance
In December 2014, the FTC issued a letter to BabyBus, a mobile app developer based in China, cautioning them about potential violations of the Children’s Online Privacy Protection Act (COPPA) Rule.
The FTC staff raised concerns that some of BabyBus’ apps, which are targeted towards young children and employ cartoon characters to teach various educational topics, may not comply with COPPA regulations.
Non-US companies can fall under the scope of COPPA if they collect personal information from children residing in the United States. COPPA applies to any online service or website that is directed to children under the age of 13 or has actual knowledge that it is collecting personal information from children under 13.
“Foreign-based websites and online services must comply with COPPA if they are directed to children in the United States, or if they knowingly collect personal information from children in the U.S.,” said the FTC’s FAQ page on COPPA.
“The law’s definition of “operator” includes foreign-based websites and online services that are involved in commerce in the United States or its territories. As a related matter, U.S.-based sites and services that collect information from foreign children also are subject to COPPA.”
Therefore, if a non-US company operates a website or online service that is targeted at children in the United States or knowingly collects personal information from children under 13 who are located in the United States, that company is subject to COPPA requirements and must comply with the law.
Compliance may involve obtaining verifiable parental consent before collecting personal information from children, providing notice to parents about data practices, implementing appropriate data security measures, and maintaining proper records.
Children’s Online Privacy Protection Act (COPPA) compliance: Get the basics right
To ensure compliance with the Children’s Online Privacy Protection Rule (COPPA), companies can take several measures. While there are several ways to achieve compliance, here are the nine basis steps companies can consider:
Gain a thorough understanding of the requirements outlined in the Children’s Online Privacy Protection Rule (COPPA) to ensure compliance.
The full text of the COPPA Rule and study guidance and resources provided by the FTC, such as the COPPA FAQs and compliance publications are the first and best sources of information about the regulation.
Familiarize yourself with key concepts and definitions, and assess your website’s data collection practices to determine if you collect personal information from children under 13.
Once identified, determine your specific compliance obligations, including obtaining verifiable parental consent, providing notice and a comprehensive privacy policy, and implementing reasonable security measures.
Consider participating in FTC-approved Safe Harbor programs if applicable and seek legal advice to ensure accurate interpretation and implementation of COPPA. Stay updated on any changes to the law to maintain ongoing compliance.
Seek legal counsel from privacy and data protection experts with knowledge of COPPA to receive customized guidance.
Start by researching and identifying privacy lawyers or law firms specializing in the field.
Assess their qualifications, experience, and reputation. Schedule initial consultations to discuss your needs, asking relevant questions and evaluating their expertise and compatibility.
Discuss pricing and engagement terms to make an informed decision. Finally, formalize the engagement with a clear agreement.
Conduct a comprehensive audit of your website, online services, and mobile apps to identify areas where you collect personal information from children under 13. Determine if you have mechanisms in place to verify user age.
Review all areas where personal information is collected and assess third-party services integrated into your platforms.
Analyze user account settings, communication channels, and implement age verification mechanisms such as date of birth confirmation, age gates, third-party age verification services, and parental consent mechanisms.
These mechanisms should effectively verify the user’s age and prevent access to children under 13 without parental consent.
Implement measures such as age gates or age verification processes to control access to content or features that may involve collecting personal information from children. Obtain verifiable parental consent before collecting any data.
Set up age gates such as pop-ups or landing pages that require users to confirm their age or provide their date of birth during registration. Implement third-party age verification services that specialize in confirming users’ age through identity verification or database checks.
For obtaining verifiable parental consent, consider online mechanisms like email or online forms, offline methods like mailing consent forms, credit card verification, knowledge-based verification, or a toll-free phone number for parental consent. Ensure the chosen method provides reasonable assurance of parental consent and maintain proper documentation of all consent obtained.
Develop a clear and easily accessible privacy policy that outlines your data collection, use, and disclosure practices, specifically regarding children’s personal information. Display it prominently on your website or online service.
This privacy policy should be in concise and understandable language, detailing specific information on data collection methods, with a clear explanation of the purpose behind collecting children’s personal information.
It should also outline how the data will be used and shared, the process for obtaining parental consent, and the security measures in place to protect the information.
Additionally, the privacy policy should provide options for users and parents to access and control the collected data, offer contact information for privacy inquiries, and indicate how updates to the policy will be communicated.
Establish a method to directly notify parents about your data collection practices and privacy policy. This may involve obtaining verifiable parental consent or sending notifications through email or other appropriate means.
This is imperative if your website or online service is directed toward them or if you have knowledge of such data collection. Utilize mechanisms like email confirmations, signed consent forms, or credit card verification.
There are exceptions to COPPA’s verifiable parental consent requirement, but they are extremely skewed and highly subject to interpretation, mostly in the favour of the consumer.
Implement reasonable security practices to protect the personal information of children, including encryption, restricted data access, and regular security assessments.
Start by employing encryption technologies like SSL/TLS to secure data transmission, preventing unauthorized access.
Limit access to children’s personal information to authorized personnel through user access controls and strong authentication methods. Conduct regular security assessments, such as penetration testing and vulnerability scanning, to identify and address any weaknesses promptly.
Ensure secure storage of children’s personal data by using protected databases or servers with measures like file encryption, firewalls, and data backups. Only collect and retain the minimum necessary personal information, reducing potential risks.
Provide comprehensive training to your staff about COPPA requirements. Emphasize the importance of compliance, privacy practices, data handling, and appropriate procedures when dealing with children’s personal information.
Continuously monitor and review your compliance efforts to ensure ongoing adherence to COPPA. Stay informed about any updates or amendments to the rule and make necessary adjustments to your practices.
COPPA compliance is an ongoing process, and it’s crucial to stay informed about regulatory updates and best practices in protecting children’s privacy online. Seeking legal advice specific to your situation is essential to ensure that your compliance efforts align with the requirements of COPPA.