With the revision of the “The Children’s Online Privacy Act” it might be time for businesses to assess whether they are COPPA complaint. Below are some things that all businesses whether they are new or have been around for a long time should consider.
COPPA applies to any commercial website or online service (including mobile apps and social networking sites) targeting kids under 13 that collects, uses, or discloses personal information from children. The law also applies to general audience websites or online services that are knowingly collecting, using or disclosing personal information from children under 13. Personal information is defined as a screen name, or a “persistent identifier” such as IP address, or traditional information including phone number, social security number, photographs, video, and more.
If your app or website fits the criteria above, you are required under COPPA to post privacy policies, provide notice to parents, and obtain verifiable parental consent before collecting personal information from children. There are several ways to do this. You can get parental consent by offering a mail-in consent form, a toll-free number or video conference for parents to contact your business.
If a purchase is made by a parent on the site, use of a credit card that provides notice of the sale to the account holder may suffice. The guidelines state, however, that use of a parent’s app store account password is not sufficient to comply with the parental consent requirement. Some exceptions to the prior parental consent rule may apply. To be safe, double check with the FTC website.
If you answered yes to any of the above and aren’t compliant the FTC may file a complaint against your business. You can be held liable for up to $16,000 for each child your business unlawfully collects information about. States may also bring COPPA enforcement actions against businesses, such as issuing a court order for your company to comply with COPPA.
How can you tell if the child lies about his/her age on a general audience website? The website owner isn’t required to investigate the age of visitors to their site. However, if you have knowledge that a child is using your site (for example, a parent contacts you), then you could be responsible for gathering information from a child.
In addition to the guidelines and frequently asked questions, you can visit the “COPPA Hotline” COPPAHotLine@ftc.gov where you can get more information.
The revised COPPA rule culminates more than two years of review by the agency to modernize the rule.