The Federal Trade Commission (FTC) has updated its COPPA guidance (a redline showing changes is available here). The guide was intended to help online service operators navigate the Children’s Online Privacy Protection Act (COPPA), which requires getting consent from parents before collecting information online from children, except in some limited circumstances. The guide was intended to help companies in many ways, including determining if the Act applies to the website, and how to notify under the law and get appropriate parental consent.
Since the law and the FTC Rule were released (and the Rule subsequently updated) there has been ongoing confusion about how to apply the requirements to the constantly changing Internet and online technologies. The FTC recognized this challenge and updated its guidance in many ways. One update was in recognition of new technologies, indicating that a website or online service includes “connected toys” and other “Internet of Things devices.” The guidance does not, however, provide any input on how a company might verify age and obtain parental consent through such devices.
The guidance also adds the multi-factor “directed to children” test to its discussion of sites, which includes the type of visual content, use of animated characters/child-directed activities, etc. Also covered is the situation in which a website does not have children as a primary audience, but is “directed to children” then it can “choose to apply COPPA . . . only to users under age 13.” If the site elects to do this, it cannot collect personal information without first collecting the users’ age, according to the updated guidance.
The guidance also includes two additional methods for getting parental consent. First, letting a parent answer several questions that would be difficult for anyone other than the child’s parent to know. Second, using facial recognition technology to compare the parent’s driver’s license and a second photo of the parent (both submitted by the parent). The guidance also changes where to visit to get more information, from OnGuardOnline.gov to consumer.ftc.gov.
TIP: The COPPA guidance update highlights that complying with the FTC Rule can be confusing, and companies that collect information from children online should proceed with caution.