On July 22, 2020, the Federal Trade Commission ("FTC") issued revised FAQs regarding the Children's Online Privacy Protection Act and the FTC Rule issued thereunder (together "COPPA"). The COPPA FAQs provide practical guidance to help operators of commercial websites and online services determine if COPPA applies to them and how to comply.
In a blog post announcing the revised FAQs, the FTC described the update as a "decluttering and reorganizing," explaining that the revisions are largely consistent with and serve to consolidate and streamline the FTC's existing COPPA-related guidance. The FTC noted that the FAQs do not raise new policy issues and that COPPA continues to be under review.
COPPA imposes certain requirements on operators of websites or online servicers directed to kids, and on operators of websites or online services that the operator has actual knowledge that personal information is collected from a child under the age of 13. COPPA was enacted by Congress in 1998 to protect the privacy of children using the Internet. COPPA required the FTC to issue and enforce regulations concerning children's online privacy. The FTC issued the COPPA Rule, which became effective on April 21, 2000. An amended COPPA Rule became effective on July 1, 2013.
Generally, when an entity subject to COPPA collects personal information from children under the age of 13, the entity must post a clear link to a privacy policy explaining how it handles personal information collected from children under 13. Before collecting COPPA-covered information, the entity must notify parents directly about its information-collecting practices and get parents' express consent. Under COPPA, parents have ongoing rights to review information collected from their kids, revoke their consent, refuse further collection or use of the data, or request deletion of the information. An entity subject to COPPA must also implement and maintain appropriate information security procedures.
Notably, in revising the FAQs, the FTC removed some FAQs and revised others that addressed the amendment of COPPA in 2013 because they were not longer relevant. Additionally, the FTC incorporated guidance offered elsewhere on the FTC's website on technologies that have developed since the initial FAQs - including, for example, connected toys, the Internet of Things, the FTC's Enforcement Policy Statement on COPPA and audio recordings, and new methods of verifiable parental consent approved by the FTC. The FAQs also reference recent FTC enforcement actions involving YouTube and inMobi.
Operators of websites or online servicers directed to kids should review the updated FAQs and consider whether any changes to policies and procedures may be warranted based on the updates to the FAQs. Even without changes to the FTC's policies, the updated and restated information may raise new or different considerations for entities subject to COPPA. The FTC's revised FAQs are available at https://www.ftc.gov/news-events/blogs/business-blog/2020/07/tidying-decluttering-coppa-faqs.
