The revised Children’s Online Privacy Protection Rule (“COPPA Rule”) is poised to take effect as scheduled on July 1, 2013. On May 6, 2013, the Federal Trade Commission (“FTC”) declined requests filed by numerous trade associations for a six-month extension of the effective date for the revised regulation. The final revisions were published in December 2012, and the associations had requested additional time for companies to review and change their practices in light of the revisions, which affected many aspects of the COPPA Rule and marked the first time the FTC had changed the Rule since its original publication.
In denying the extension requests, the FTC stated that “all stakeholders have had sufficient opportunity to raise issues and articulate their concerns, the [Statement of Basis and Purpose] provides sufficient guidance regarding the obligations the amended Rule will impose on COPPA-covered entities, and the more than sixmonth time period between issuance of the amended Rule and its effective date is adequate.” The FTC noted that staff are available to respond to questions on COPPA and pledged that the FTC would exercise its enforcement discretion with respect to small businesses that make good-faith attempts to comply in the early months following the effective date.
FTC Commissioner Maureen Ohlhausen also recently stated in an interview that the FTC will not begin enforcement immediately following the July 1 effective date and is aware that companies will require time to come into compliance. However, she urged companies to work toward compliance and to seek clarification if needed.
The FTC’s denial of the trade associations’ extension request followed the release, in April 2013, of the agency staff’s longawaited updated Frequently-Asked Questions (FAQs), the primary guidance document on the COPPA Rule. Of this set of FAQs, many are consistent with FAQs from the prior COPPA Rule while others are new and reflect the revisions to the regulation. Much of the guidance is drawn from the Statements of Basis and Purpose issued with the 1999 and 2012 rulemakings. The FAQs represent staff’s views and are not binding on the FTC.
On the pressing issue of how the revised COPPA Rule will apply to data collected previously, one of the FAQs explains that parental consent should be obtained immediately for geolocation information and should also be obtained if an operator associates new information with a persistent identifier or a screen/user name after the revised COPPA Rule takes effect. In contrast, parental consent is recommended but not required for previously-collected photos, videos, and audio files, and for persistent identifiers or screen/user names that are not associated with new information after the effective date.