According to a Request for Investigation filed with the Federal Trade Commission (“FTC”) on December 9, 2014, a coalition of consumer and children’s privacy rights organizations has asked for a federal investigation of the Topps Company for allegedly violating the Children’s Online Privacy Protection Act (“COPPA”) by collecting personal information and photos from children without parental permission in a social media contest.

The groups challenge a Topps Co. candy brand contest held in April 2014 that solicited Facebook, Twitter and Instagram social media users to tag photos of themselves wearing Ring Pops with the hashtag #RockThatRock for a chance to be featured in a music video with the popular “tween” band R5. Winning photos were featured in the music video, and the video was posted on the website Candymania, YouTube, and on Bazooka Candy Brand social media pages. Topps Co. also featured submitted photos on its website, social media platforms and in television commercials.

COPPA prohibits companies from collecting personal information from a child unless it provides notice and obtains advance, verifiable parental consent. COPPA was revised and expanded in July 2013. The groups’ Request for Investigation focuses on Topps Co.’s alleged oversight of two significant revisions under COPPA. Under the revised version of COPPA, the definition of personal information includes a broader range of information, including geolocation information, as well as photos, videos and audio files that contain a child’s image or voice, or even a persistent identifier that could be used to recognize the child over time and across different websites or online services.

The revised COPPA also outlines new ways to obtain “verifiable” parental consent. Methods that meet COPPA’s requirement include (i) providing a consent form to be signed by a parent and returned by mail or fax; (ii) requiring parents to use a credit card in a transaction; (iii) having parents call a toll-free number staffed by trained personnel; (iv) having parents connect to trained personnel via video-conference; or (v) verifying parents’ identity by checking a form of government-issued identification, such as a Social Security number, against databases of such information.

The groups argue that Topps Co.’s privacy policy and contest terms of use failed to accurately disclose its data collection practices in violation of COPPA and failed to obtain verifiable parental consent. According to the groups, the contest’s terms of use assert that the use of its services constituted parental consent, and the Company made no further effort to obtain verifiable consent as required under COPPA. Since COPPA was revised in July 2013, the FTC has approved new verifiable parental consent methods, such as knowledge-based identification, and the Commission seeks public comment on other submitted methods. However, when companies do not utilize approved methods or the methods outlined in COPPA, they risk scrutiny as evidenced in the Request.

The groups also point out that the amended COPPA requires operators of a website or online service directed to children to retain personal information only as long as is reasonably necessary. The groups maintain that the Candymania website is directed at children. According to the groups, Topps has violated COPPA because, even though the contest has ended, the #RockThatPop music video featuring submitted photos of children remains on YouTube and Candymania, and Topps hosts an event on social media known as #RockThatPop Fridays where it reposts contest photographs.

Advocacy groups seeking agency action may formally petition the FTC or make an informal request. More recently, these informal Requests for Investigation have resulted in formal government investigations, complaints and settlement agreements. For example, the FTC’s investigation of Snapchat and 2014 settlement occurred after an advocacy group placed the Company and its practices on the FTC’s radar when it filed a Request for Investigation with the Commission in 2013.

For a copy of the Request for Investigation, click here.

Reporter, Elizabeth K. Hinson, Atlanta, +1 404 572 2714, bhinson@kslaw.com.