Broad Reach of COPPA Extends to IoT

This article is co-authored by Kathleen Scott, Megan Brown, Joan Stewart, and Eve Klindera Reed

This month, the Federal Trade Commission (FTC) updated its Children’s Online Privacy Protection Act (COPPA) Rule Compliance Guide in its ongoing effort to ensure that COPPA reflects changes in technology, including the Internet of Things (IoT).  Although the FTC’s update confirms that COPPA applies to IoT devices, it does not provide meaningful guidance to operators regarding how to effectively implement the COPPA requirements in the unique IoT context.   

The updates make clear the expansive scope of COPPA.  COPPA applies to operators of websites and online services that collect personal information about children under 13.  Each of the operative terms in that general statement about COPPA have expansive definitions, according to the FTC.

  • Websites and Online Services include not just traditional websites and apps, but also Internet-enabled gaming platforms, Internet-enabled location-based services, and even connected toys and other IoT devices.

  • “Collect” is broadly defined to include any time an operator “request[s], prompt[s], or encourage[s] the submission of information, even if it’s optional,” as well as any time an operator allows personal information to become public (for example, an open chat room). Collection under COPPA also includes passively tracking a child.

  • Personal Information includes the obvious name, home or physical address, and Social Security number, as well as the not-so-obvious “photo, video, or audio file containing a child’s image or voice.” The FTC explicitly calls out other data as personal information as well, including geolocation information and persistent identifiers like device serial number and IP address.

COPPA does not prohibit the collection of children’s personal information; instead, it requires (among other things) that online operators must provide direct notice to parents about information collection practices and collect verifiable consent from parents before doing so.  The FTC’s updated Compliance Guide outlines new acceptable methods of collecting parental consent:   posing knowledge-based authentication challenge questions and utilizing facial recognition technology to compare and match a verified photo ID with another picture submitted by the parent.  These acceptable methods are in addition to others that the FTC has previously recognized, including getting consent via video conference.  While the recognized methods of collecting consent reflect new and innovative technologies, the FTC’s Guide does not provide any guidance about how to provide notice and collect consent in an understandable and accessible way on small IoT devices.

The FTC updated its COPPA rule in 2013, and since then has spent significant resources educating businesses and the public about COPPA.  In recent years, the FTC has several brought COPPA enforcements against operators, including enforcements against a mobile-advertising company and app developers.   

For additional information about COPPA and how it might apply to your online operations, please contact us.  

Categories

Tags

Wiley Connect

Sign up for updates

Wiley Rein LLP Cookie Preference Center

Your Privacy

When you visit our website, we use cookies on your browser to collect information. The information collected might relate to you, your preferences, or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. For more information about how we use Cookies, please see our Privacy Policy.

Strictly Necessary Cookies

Always Active

Necessary cookies enable core functionality such as security, network management, and accessibility. These cookies may only be disabled by changing your browser settings, but this may affect how the website functions.

Functional Cookies

Always Active

Some functions of the site require remembering user choices, for example your cookie preference, or keyword search highlighting. These do not store any personal information.

Form Submissions

Always Active

When submitting your data, for example on a contact form or event registration, a cookie might be used to monitor the state of your submission across pages.

Performance Cookies

Performance cookies help us improve our website by collecting and reporting information on its usage. We access and process information from these cookies at an aggregate level.

Powered by Firmseek