Consumer Protection: The Children's Online Privacy Protection Act

Enforcement

Treated as unfair or deceptive act/practice under FTC rules Fines up to 16k per violation Amount of fine depends on a number of factors No private cause of action, states can bring civil actions for violations

Scope

Applies to operator of a website or online service directed to children, or operating that has actual knowledge it is collecting person info from a child Does not apply to info collected from adults about children under 13, applies only to personal data collected from children

Liability when site operates in connection with third parties

Both hosts and third party sites are subject. Hosts liable for acts of third parties Third party liable if actual knowledge the host site is directed at children

Collection of personal info

Defined broadly. Gathering any personal info from a child by any means including, but not limited to Requesting/prompting child to submit personal info Enabling a child to make personal info publicly available in identifiable form

Safe harbor

If operator follows regulatory guidelines issues by marketing or online industry groups that are approved by FTC, then COPPA requirements deemed satisfied

Right to restrict uses

If parent requests

Personal information

Includes a voice, audio, image file containing child's voice and/or image Geolocation data Online contact info such as user name Persistent identifiers that recognize users across time and sites

Notice

Must make specific notice points in privacy policy

Consent

Websites must obtain verifiable parental consent for collection/disclosure/use of child personal info Cannot condition winning prize on disclosure of more info than necessary