# Standards and Regulatory References — COPPA Compliance ## Primary Legislation ### Children's Online Privacy Protection Act (COPPA) — 15 U.S.C. Sections 6501-6506 - **Section 6501**: Definitions including "child" (individual under 13), "operator," "personal information," and "website or online service directed to children." - **Section 6502(a)(1)**: Unlawful for an operator of a website or online service directed to children, or having actual knowledge of collecting from a child under 13, to collect personal information in a manner that violates FTC regulations. - **Section 6502(b)(1)**: FTC regulations must require operators to: (A) provide notice; (B) obtain verifiable parental consent; (C) allow parental review; (D) allow parents to refuse further collection; (E) limit collection to what is necessary. - **Section 6503**: Safe harbor provisions allowing industry self-regulation. - **Section 6504**: State enforcement authority; state attorneys general may bring civil actions. - **Section 6505**: FTC rulemaking authority and enforcement powers. - **Section 6506**: Review of regulations every 5 years. ### COPPA Rule — 16 CFR Part 312 - **Section 312.2**: Definitions. "Personal information" includes: first and last name, home or physical address, online contact information (email), telephone number, Social Security number, persistent identifier, photograph/video/audio containing a child's image or voice, geolocation information, and information combined with any of the above. - **Section 312.3**: Regulation of unfair or deceptive acts and practices in connection with the collection, use, and/or disclosure of personal information from and about children on the internet. - **Section 312.4**: Notice requirements. Online notice (312.4(b)) and direct notice to parents (312.4(c)). - **Section 312.5**: Parental consent requirements. Verifiable parental consent methods (312.5(b)). Exceptions (312.5(c)) including: internal use only, one-time contact, child safety, school exception. - **Section 312.6**: Parental access and deletion rights. - **Section 312.7**: Prohibition on conditioning participation on excess data collection. - **Section 312.8**: Confidentiality, security, and integrity obligations. - **Section 312.10**: Data retention and deletion requirements. - **Section 312.11**: Safe harbor provisions. - **Section 312.12**: Implementation schedule and effective dates. ## FTC Guidance and Interpretations ### FTC COPPA FAQs (Updated July 2020) Key clarifications: - **FAQ A.1**: COPPA applies to operators of commercial websites and online services directed to children under 13 that collect personal information from children, AND general audience sites with actual knowledge of collecting from children under 13. - **FAQ C.1**: "Directed to children" is determined by the totality of circumstances including: subject matter, visual content, animated characters, child-oriented activities and incentives, music, age of models, presence of child celebrities, language, and advertising. - **FAQ D.1**: Persistent identifiers (cookies, IP addresses, device identifiers) are personal information when used to recognise a user over time and across sites, but NOT when used solely for support of internal operations. - **FAQ J.2**: Schools may consent on behalf of parents only for educational purposes; the school exception does not apply to commercial uses of data. - **FAQ M.1**: Mixed-audience sites must either treat all users as children or implement an age screen before collecting personal information. ### FTC 2013 COPPA Rule Amendments (78 Fed. Reg. 3972, January 17, 2013) Major changes: - Expanded definition of "personal information" to include persistent identifiers used for behavioural advertising, geolocation, photos, videos, and audio files. - Added facial recognition as an approved parental consent method. - Clarified that plug-ins and ad networks that collect from child-directed sites are covered as operators. - Expanded "support for internal operations" exception to include activities like contextual advertising, frequency capping, legal compliance, and site security. ### FTC NPRM — Proposed 2024 COPPA Rule Amendments (89 Fed. Reg. 2034, December 2023) Proposed changes: - Separate consent for targeted advertising: operators must obtain separate opt-in parental consent for using children's data for targeted advertising, distinct from consent for the service itself. - Push notification restrictions: consent for the service cannot be conditioned on consent to push notifications. - Enhanced data security: written information security program required. - Biometric identifiers added to "personal information" definition. - Data retention limits codified: retain children's data only as long as reasonably necessary. - Enhanced safe harbor oversight: more detailed annual reporting to FTC. ## FTC Safe Harbor Programs ### CARU (Children's Advertising Review Unit) - Administered by BBB National Programs - Self-Regulatory Program for Children's Advertising and Online Privacy - Focuses on advertising directed to children under 13 - COPPA Safe Harbor approved by FTC since 2001 ### kidSAFE Seal Program - Administered by kidSAFE, LLC - Certifies websites and apps as meeting child safety and privacy standards - Provides COPPA compliance certification - FTC-approved Safe Harbor since 2012 ### ESRB Privacy Certified - Administered by Entertainment Software Rating Board - Focused on video games and interactive entertainment - Provides COPPA compliance certification for gaming platforms - FTC-approved Safe Harbor since 2003 ### PRIVO (Privacy Vaults Online) - Provides identity and consent management technology - Specialises in age verification and parental consent solutions - FTC-approved Safe Harbor ### TrustArc (formerly TRUSTe) - Cross-sector privacy certification program - Includes COPPA/Children's Privacy Program - FTC-approved Safe Harbor ## FTC Enforcement Actions - **Epic Games/Fortnite (FTC, 2022)**: USD 275 million civil penalty. Epic collected personal information from children under 13 without parental notice or consent; enabled voice and text communications with strangers by default; used dark patterns for in-app purchases. Largest COPPA penalty. - **Google/YouTube (FTC and NYAG, 2019)**: USD 170 million settlement. Google collected persistent identifiers (cookies) from viewers of child-directed YouTube channels to serve targeted advertising without verifiable parental consent. - **Musical.ly/TikTok (FTC, 2019)**: USD 5.7 million settlement. Collected names, email addresses, and other personal information from children under 13 despite actual knowledge of child users. - **VTech Electronics (FTC, 2018)**: USD 650,000 settlement. Collected personal information from children including photos, chat logs, and audio without parental consent; suffered data breach exposing 6.4 million children's records. - **Unixiz/Explore Talent (FTC, 2020)**: USD 2 million judgment. Collected personal information from children on talent scouting site without privacy policy, consent, or security. - **Edmodo (FTC, 2023)**: USD 6 million penalty. Used student data for advertising purposes beyond the COPPA school exception scope. - **Fortnite/Epic Games (FTC, 2022 — separate from COPPA penalty)**: USD 245 million refund order for dark patterns tricking players into unwanted purchases, including children. ## State COPPA-Related Laws - **California SOPIPA (2014)**: Prohibits operators of school-directed sites from using student information for non-educational advertising or selling student data. - **New York Education Law 2-d (2014)**: Requires contracts for third-party access to student data; mandates data security plans. - **Illinois SOPPA (2021)**: Extends COPPA-like protections to students; requires parental notification; prohibits targeted advertising using student data.