Phil Nicolosi Law

Phillip A. Nicolosi, J.D.

“The Authority on Internet Law”

Call (815) 314-0022

COPPA

Keeping Up With COPPA Rules In 2017

By

COPPA Rules Compliance

Websites that are targeted towards children under the age of 13 or that knowingly collect information from children under the age of 13 must comply with the Federal Trade Commission (FTC) COPPA rules (technically, the “COPPA Rule”). I have posted a few prior articles explaining the basics behind COPPA compliance and the 2013 COPPA changes that affected the data collection practices of many website operators .  

As a refresher, here are several steps website operators should follow to ensure they are following the basic COPPA rules established in the beginning.

1. Post a complete and easy-to-understand privacy policy that is conspicuously located and must be distinguishable from other links (ex: a “fine print” type link attached at the bottom of a website that the user may or may not stumble upon will not be in compliance with the guidelines). It is imperative the privacy policy in detail describes all methods of data collection by the website’s host AND any other entities collecting data from the site. All those involved in collecting data through the website need to be listed by name and at least one needs to provide contact information as well. How information from children is collected, what kinds of information is collected, how it is utilized, to whom it is disclosed, and how third parties use the data must be disclosed. Parental rights must be listed and an acknowledgement to parents that only information that is (reasonably) necessary is being collected, that they can view all information collected and can have it deleted or allow for no further information gathered, can block third parties from the information while still allowing for the main operator of the site to use it, and the methods for exercising these rights.

2. Provide a “direct notice” to parents before collecting information from kids and if any changes to previous practices are made they need to be updated through “direct notice”. The notice needs to be clear and without unrelated information. In addition, it needs to include that the parent’s contact information was gathered for receiving their consent and is required for any collection, use, and disclosure of information you wish to obtain from their child.

3. Obtain parental consent before you collect personally identifiable information (PII) from children under 13. The direct notice sent to parents needs to list how parents can give their consent which can be given by way of a signed consent form sent in physically or through electronic scan, calling a staff member via phone or video, providing a government issued ID (identification records must be deleted once verification has been completed), or notification of each transaction by way of credit card, debit car, or other online payment system. Parents need to be aware if they do not consent in a “reasonable” amount of time their info will be deleted. If information is only being collected internally and is not disclosed elsewhere, an email followed with a confirmation notice will suffice, but parents or guardians must be notified they can retract their consent at any time. Make sure parents are also aware they can block third party access to any information. There are exceptions to the general rule requiring parental consent before collecting personal information from children, but notice requirements may still exist despite any applicable exceptions.

4. Recognize a parent’s rights to the information being gathered of their child. If parents ask, you need to be able to provide them with a list of all information gathered, a way to revoke consent and to stop any further use or collection of their child’s data, and a way to delete all their child’s information. Make sure all communication and information shared with parents is clear and concise to minimize any chance of confusion.

5. Use reasonable data security protection measures to uphold confidentiality and the security of the child’s information. To do this, minimize information gathered and have a protocol for the release of information to service providers and other third parties. Make sure these parties hold themselves to similar standards as your own. Ensure these parties only hold on to the information for periods of time necessary for their tasks and that they use it only for the objective it was collected. Finally, once all information has served its purpose, it must be quickly and safely disposed of by the website operators

Updated COPPA Personally Identifiable Information (PII)

What has changed since the COPPA rules were enacted? Well, technology has come a long way, of course, especially in terms of data collection. Thus, effective July 1, 2013, the FTC updated the COPPA Rules to ensure PII was up to speed with current technology. Among key additions back then were “persistent identifiers” (cookies, IP addresses, etc) that track users for extended durations of time and and over different sites and geolocation information.

Here is an updated checklist of the PII that must be disclosed under COPPA rules for 2017:

-First and last name
;

-Physical address, including street name, city or town;

-Online contact information;

–Screen or user name that functions as online contact information (under the amended COPPA rules, a screen or user name is personal information where it functions in the same manner as online contact information, which includes not only an email address, but any other “substantially similar identifier that permits direct contact with a person online.”);

-Telephone number;

-Social security number;

–Persistent identifier that can be used to recognize a user over time and across different websites, devices or online services;

-Photograph, video, or audio file where such file contains a child’s image or voice;

-Geolocation information sufficient to identify street name and name of a city or town; or

-Information concerning the child or the parents of that child that website operators collect online from the child and combines with an identifier described above.

2017 Updated FTC COPPA Guidance 

The FTC has recently updated its COPPA Compliance Plan in June to provide guidance to businesses in an effort to reflect changes in technology. First, the definition of “websites or online services” was expanded to include connected toys and “other Internet of Things” devices. This now includes toys and devices that collect PII from children, such as voice recordings or geolocation data. Updated guidance may have come in response to the letter sent to the FTC in May by Senator Mark Warner of Virginia urging increased protections under COPPA. Senator Warner’s letter was sent after several recent high-profile instances of children’s personal data being hacked through the proliferation of apps and Internet-connected smart toys. 

Second, two new methods for obtaining parental consent prior to collecting PII from children was also announced by the FTC. This updated guidance provides that parental consent may be obtained either by: (a) asking parents a series of knowledge-based authentication questions; or (b) requesting a copy of a parent’s driver’s license and matching that photo to a second photo provided by the parent using facial recognition technology. These new methods are in addition to the already acceptable methods of obtaining parental consent including consent forms, calling a toll-free number that is answered by trained personnel or by video conference. 

COPPA Rules Compliance Trends

In 2017, there are a few primary trends websites that collect information from children should understand to stay COPPA compliant. These website operators should revisit their data collection and security practices in light of these recent trends and evolutions to ensure updated COPPA rules compliance.

1. Data Security is Key. The touchstone of the FTC’s approach to data security is a standard of “reasonableness”: that a company’s data security measures must be reasonable in light of the “sensitivity and volume of consumer information it holds, the size and complexity of its data operations, and the cost of available tools to improve security and reduce vulnerabilities.” (FTC: Beyond Cookies: “Privacy Lessons for Online Advertising”. January 21st, 2015). The FTC’s Fair Information Practices also requires that a mechanism for notification of data breaches is in place. As an example of the importance of this measure, the FTC alleged TRENDnet, which is a company that sells in-home cameras for baby monitoring, left itself vulnerable to hackers resulting in hundreds of homes cameras being live-streamed on the internet.

2. Identify New Data Collection Practices. Since 2013, some methods of collecting data have become much more common. For example, collecting information from children across multiple devices (by using a corresponding app for example) and compiling aggregate use information which is then linked to a single user profile (including a unique device ID) should be disclosed. Similarly, website operators should disclose all subsets of tracking information, not just a single use, and should be precise and complete with information/data use disclosure. The increasingly common practice of “history sniffing”, where use history across the Internet is tracked, serves as an example.

Remember, website operators should always be truthful and honest in notifying parents to how they collect information from their child. If your site does send child information to third parties, make sure that parents know this and that the third parties are trustworthy. Anything less goes against the COPPA rules.

Can You Avoid COPPA When Third-Parties Collect Data?

By

Numerous child privacy groups recently filed an FTC complaint against the Ring Pops candy maker Topps for allegedly violating COPPA. This complaint serves a good reminder to your business to ensure it understands the COPPA laws governing third-party data collection.

According to the complaint, Topps launched a social media campaign for Ring Pops candy gave children the opportunity to submit pictures of themselves used in a music video. Also, candymania.com allegedly gave children the opportunity to upload photos of themselves wearing Ring Pops to Facebook, Twitter and Instagram. These photos apparently contained the children’s screen names.

Topps then used several of the photos of these children, which were clearly under 13, according to the watchdogs. The watchdogs also alleged that Topps disclosed the children’s photos along with contact information in the music video and disclosed their photos and online contact information on the Ring Pop Facebook page. Finally, Topps is also alleged to have used the online contact information to directly contact and market to children.

Allegedly, all of this was a violation of COPPA by Topps since they collected and disclosed personal data from children under 13 without their parents’ permission. (Photos of children are considered personal data under recent COPPA amendments that cannot be collected without prior parental permission.)

The big issue is that the children uploaded their photos and provided their screen names to Facebook, Twitter and Instagram and not directly to Topps.

So, can you get out of COPPA by “outsourcing” the collection of data to social media sites and other third-parties?

Some lawyers have argued that when the FTC revised the COPPA regulations in 2012, it made it crystal clear that companies are strictly liable for data collection by third parties. But, not all lawyers agree that imposing strict liability under COPPA was intended to cover the collection of personal information on a site such as Facebook. In fact, Facebook does attempt to restrict users who are under 13.

Then again, child privacy advocates argue that its easy for a child to create a social media account, generally speaking. The watchdog groups have also argued that anyone can sign up for Twitter and Instagram, and that it’s “common knowledge” that many children have Facebook accounts.

The question, then, is whether COPPA regulations regarding third-party data collection are solely aimed at curbing data gathering by ad networks, via plug-ins, etc.  Or, does COPPA impose strict liability on website operators when children directly upload their information onto social media or other online platforms?

The best way to attempt to answer this question is to look at the FTC’s final rule amendments to COPPA in 2012. Specifically, the amendment that changed the definition of “collects” or “collection” of personal information may provide the most insight. You can review the full version here. To save you that agony, here is the relevant part of that text below:

II. Modifications to the Rule
A. Section 312.2: Definitions
1. Definition of Collects or Collection

a. Collects or Collection, Paragraph (1)

In the 2011 NPRM, the Commission proposed amending paragraph (1) to change the phrase ‘‘requesting that children submit personal information online’’ to ‘‘requesting, prompting, or encouraging a child to submit personal information online.’’ The proposal was to clarify that the Rule covers the online collection of personal information both when an operator requires it to participate in an online activity, and when an operator merely prompts or encourages a child to provide such information. The comments received divided roughly equally between support of and opposition to the proposed change to paragraph (1). Those in favor cited the increased clarity of the revised language as compared to the existing language.

Several commenters opposed the revised language of paragraph (1). For example, the National Cable and Telecommunications Association (‘‘NCTA’’) expressed concern that the revised language suggests that ‘‘COPPA obligations are triggered even without the actual or intended collection of personal information.’’ NCTA asked the Commission to clarify that ‘‘prompting’’ or ‘‘encouraging’’ does not trigger COPPA unless an operator actually collects personal information from a child.

The Rule defines collection as ‘‘the gathering of any personal information from a child by any means,’’ and the terms ‘‘prompting’’ and ‘‘encouraging’’ are merely exemplars of the means by which an operator gathers personal information from a child. This change to the definition of collects or collection is intended to clarify the longstanding Commission position that an operator that provides a field or open forum for a child to enter personal information will not be shielded from liability merely because entry of personal information is not mandatory to participate in the activity. It recognizes the reality that such an operator must have in place a system to provide notice to and obtain consent from parents to deal with the moment when the information is ‘‘gathered.’’ Otherwise, once the child posts the personal information, it will be too late to obtain parental consent.

After reviewing the comments, the Commission has decided to modify paragraph (1) of the definition of collects or collection as proposed in the 2011 NPRM.”

…

c. Collects or Collection, Paragraph (3)

In the 2011 NPRM, the Commission proposed to modify paragraph (3) of the Rule’s definition of collects or collection to clarify that it includes all means of passively collecting personal information from children online, irrespective of the technology used. The Commission sought to accomplish this by removing from the original definition the language ‘‘or use of any identifying code linked to an individual, such as a cookie.’’

The Commission received several comments supporting, and several comments opposing, this proposed change. Those opposing the change generally believed that this change somehow expanded the definition of personal information. As support for their argument, these commenters also referenced the Commission’s proposal to include persistent identifiers within the definition of personal information.

The Commission believes that paragraph (3), as proposed in the 2011 NPRM, is sufficiently understandable. The paragraph does nothing to alter the fact that the Rule covers only the collection of personal information. Moreover, the final Rule’s exception for the limited use of persistent identifiers to support internal operations— 312.5(c)(7)—clearly articulates the specific criteria under which an operator will be exempt from the Rule’s notice and consent requirements in connection with the passive collection of a persistent identifier. Accordingly, the Commission adopts the definition of collects or collection as proposed in the 2011 NPRM.

It appears that the FTC’s recent COPPA revisions suggest that website operators cannot rely on data collection by social media sites and other similar third-parties and avoid COPPA. Strict liability for website operators wasn’t intended to necessarily cover social media. But, it is illogical to think that operators can circumvent the requirements of COPPA when their actions are in essence no different then collecting personal information directly. If your business or your website is storing and/or using personal information from children provided to you via third-parties, assume COPPA applies.

Regardless, the outcome of the FTC complaint filed against Topps should conclusively answer this question. In the meantime, businesses, marketers, ad agencies and social media managers should take a hard look at the Ring Pops campaign and err on the side of caution.