The Ultimate Guide to the Children's Online Privacy Protection Act (COPPA)

The internet is an incredible tool that has revolutionized our world, but it has also introduced unique challenges, particularly when it comes to protecting children’s privacy.

That’s where the Children’s Online Privacy Protection Act (COPPA) comes in. Since its inception in 1998, COPPA has worked to safeguard children’s online privacy and prevent companies from collecting and using their personal information without proper consent.

In this article, we’ll provide an in-depth look at COPPA, including its history, who it protects, the roles of parents, website owners, and schools, penalties for violating COPPA, its impact on technology, and frequently asked questions.

What Is COPPA? Definition and Scope

The Children’s Online Privacy Protection Act (COPPA) is a United States federal law enacted by Congress in 1998 and put into effect on April 21, 2000. Its primary goal is to place parents in control over what personally identifiable and protected health information (PII/PHI) is collected online from their young children.

Specifically, COPPA applies to operators of commercial websites, online services (including mobile apps and IoT devices), and plug-ins that are either directed toward children under the age of 13 or have actual knowledge that they are collecting personal information from children under 13.

The law mandates specific requirements for these operators, including notice to parents and obtaining verifiable parental consent before collecting, using, or disclosing children’s personal data.

It’s important to understand that COPPA is a U.S. law enforced by the Federal Trade Commission (FTC); while it has international scope for services targeting U.S. children, it is distinct from global privacy frameworks like the GDPR, which has its own protections for children’s data (GDPR-K).

Who Is Protected Under COPPA?

COPPA applies to children under the age of 13 who use the internet. The legislation aims to protect children’s personal information when they access online services, games, apps, or websites. The U.S. Federal Trade Commission (FTC) enforces COPPA to ensure that companies comply with the law. COPPA was created due to the recognition that children’s personal information is more sensitive than adults’, and they may have difficulty understanding the potential consequences of providing personal data online.

COPPA requires websites, apps, games, and online services that collect personal information from children to provide clear and understandable notices to parents and get verifiable parental consent before collecting, using, or disclosing children’s personal information. The following are some examples of the type of information that COPPA protects:

• Full name
• Home address
• Email address
• Phone number
• Social Security number
• Information collected online, such as IP address, geolocation data, and behavioral data

What Privacy Rights Do Children Have Under COPPA?

Children have several privacy rights under COPPA, including:

1. The right to know what personal information is being collected from them
2. The right to opt out of the collection of personal information
3. The right to have their personal information deleted upon request
4. The right to refuse to disclose personal information to a website or app

How Are Children’s Rights Upheld Under COPPA?

Websites and apps must uphold these rights by providing notice to parents about the types of personal information collected from their children, obtaining verifiable parental consent before collecting personal information, and giving parents the option to review and delete their children’s personal information at any time.

Key Provisions of COPPA

The Children’s Online Privacy Protection Act (COPPA) establishes clear requirements for operators of websites, apps, and online services that collect personal information from children under the age of 13. The following key provisions outline the core obligations under COPPA, aimed at protecting children’s privacy and giving parents greater control over the information collected from their children:

• Privacy Policy & Direct Notice: Operators must post a clear, comprehensive, and easily accessible privacy policy detailing their information practices for children’s personal data. They must also provide direct notice to parents before collecting information.
• Verifiable Parental Consent: Operators must obtain verifiable parental consent before collecting, using, or disclosing personal information from children under 13, subject to limited exceptions.
• Data Minimization: Operators may not condition a child’s participation in an activity on the child disclosing more personal information than is reasonably necessary to participate in that activity.
• Confidentiality & Security: Operators must establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children. This includes ensuring third-party service providers can maintain security.
• Data Retention Limits: Operators must retain personal information collected online from a child for only as long as is reasonably necessary to fulfill the purpose for which it was collected and must delete the information using reasonable measures.
• Parental Rights (Review/Delete): Operators must provide parents, upon request, with the ability to review the personal information collected from their child, refuse further collection or use, and request deletion of the child’s information.
• FTC Oversight: The Federal Trade Commission (FTC) enforces COPPA regulations and has the authority to issue rules and bring enforcement actions against non-compliant operators.

How Is COPPA Enforced?

COPPA is enforced by the Federal Trade Commission. The FTC is responsible for investigating and bringing legal action against companies that violate COPPA regulations. COPPA applies to websites and online services that target children under the age of 13, and requires these websites to obtain parental consent before collecting personal information from children. Companies that fail to comply with COPPA regulations can face fines and other penalties. The FTC may also require companies to implement new privacy policies and procedures to ensure compliance with COPPA. In addition to enforcement by the FTC, COPPA violations can also be reported to state attorneys general or consumer protection agencies. Noncompliance can result in civil penalties of up to $42,530 per violation.

What Are the Consequences of Noncompliance?

The consequences of noncompliance with COPPA can vary depending on the severity and frequency of the violations. Some potential consequences include:

1. Fines: The FTC can impose civil penalties of up to $43,280 per violation of COPPA. In some cases, fines can reach millions of dollars.
2. Legal Action: Noncompliance with COPPA can also result in legal action brought against the company or individuals responsible for the violations.
3. Reputation Damage: Violations of COPPA can damage a company’s reputation and result in a loss of consumer trust.
4. Regulatory Action: The FTC can take various regulatory actions against companies that violate COPPA, such as requiring them to implement new privacy policies or practices.
5. Criminal Penalties: In some cases, individuals responsible for violating COPPA can face criminal charges, which can result in fines or imprisonment.

COPPA Safe Harbor Programs

The COPPA Rule includes a “Safe Harbor” provision that allows industry groups or other organizations to submit self-regulatory guidelines to the FTC for approval. These guidelines must provide protections that are the same as or greater than those outlined in the COPPA Rule.

If an organization’s Safe Harbor program is approved by the FTC, members of that program who adhere to its guidelines are generally subject to the program’s disciplinary procedures instead of direct FTC enforcement actions for potential violations, offering a clearer framework for COPPA compliance.

Benefits include potentially reduced FTC scrutiny and a structured path to compliance. Examples of FTC-approved Safe Harbor programs include those operated by ESRB Privacy Certified, kidSAFE Seal Program, PRIVO, and TrustArc.

To become certified, an operator typically applies to an approved program, undergoes a comprehensive audit of its privacy policies and practices, and agrees to ongoing monitoring and annual reviews to ensure continued adherence to the Safe Harbor guidelines.

How Does COPPA Impact Parents and Guardians?

Parents and guardians play a significant role in protecting their children’s online privacy. COPPA requires that companies obtain verifiable parental consent before collecting any personal information from children. This means that companies must take appropriate steps, such as sending a confirmation email, to ensure that the person providing consent is the child’s parent or legal guardian. In addition, COPPA mandates that companies provide parents with the right to review their children’s personal information and ask for it to be deleted.

Parents should talk to their children about the dangers of sharing personal information online and monitor their kids’ online activity regularly. Educating children on the importance of online privacy is critical in today’s digital age.

How Does COPPA Impact Website Owners and Operators?

COPPA has significant implications for websites, apps, and online services that collect personal information from children. Website owners and operators must ensure they comply with COPPA’s requirements to avoid facing legal action from the FTC. Failure to comply with COPPA can result in monetary and legal penalties.

To comply with COPPA, website owners and operators must provide clear and easily understandable privacy policies to parents. These policies must inform parents of the personal information collected from children, how it’s used, and whether it’s shared with third parties.

Website owners and operators must also obtain verifiable parental consent before collecting personal information from children. They can do this by sending a confirmation email or asking parents to provide personal information that can be checked against public records.

COPPA Compliance Checklist

To comply with the Children’s Online Privacy Protection Act (COPPA), organizations must take proactive steps to protect the personal information of children under 13. This checklist outlines the essential actions operators must follow to ensure compliance—from determining applicability to maintaining ongoing oversight and documentation:

1. Determine Applicability: Assess if your website, app, or online service is directed to children under 13 or if you have actual knowledge of collecting personal information from them.
2. Publish a Compliant Privacy Policy: Create and post a clear, comprehensive, and easily accessible privacy policy outlining your practices for children’s personal information, including data collected, usage purposes, disclosure practices, and parental rights.
3. Implement Age Screening (If Applicable): If not primarily child-directed but potentially appealing to children (mixed audience), implement a neutral age gate to identify users under 13 before collecting personal information.
4. Provide Direct Notice to Parents: Before collecting personal information, send a direct notice to parents explaining your specific information practices and seeking their consent.
5. Obtain Verifiable Parental Consent: Use an FTC-approved method (e.g., signed consent form, credit card transaction, video call, knowledge-based challenge questions) to obtain verifiable consent from parents before collection, use, or disclosure of their child’s data.
6. Limit Data Collection: Collect only the personal information reasonably necessary for a child to participate in the activity.
7. Establish Security Safeguards: Implement and maintain reasonable procedures (including a written security program) to protect the confidentiality, security, and integrity of children’s personal information.
8. Honor Parental Rights: Provide mechanisms for parents to review their child’s personal information, request its deletion, and refuse further collection or use.
9. Manage Data Retention & Deletion: Retain children’s personal information only as long as necessary and securely dispose of it afterward according to a defined policy.
10. Oversee Third Parties: Ensure any third parties (service providers, ad networks) receiving children’s data are capable of maintaining its confidentiality and security.
11. Train Staff & Document Compliance: Educate relevant staff on COPPA regulations and document all COPPA compliance efforts, including policies, procedures, consent records, and training.

COPPA, Social Media, and User-generated Content

COPPA has had a significant impact on technology companies, particularly social media and messaging apps. COPPA applies to social media sites and user-generated content that is directed at children under the age of 13. It requires social media sites to obtain verifiable parental consent before collecting personal information from children and to provide notice to parents about the types of personal information collected.

What Are the Requirements for Social Media Sites Under COPPA?

Social media sites must comply with the same requirements as other websites and apps under COPPA, including providing notice to parents about the types of personal information collected, obtaining verifiable parental consent before collecting personal information, and giving parents the option to review and delete their children’s personal information at any time. In addition, social media sites must provide a clear and conspicuous link to their privacy policy from their homepage and within any online service directed at children.

COPPA and Schools

Schools and educational institutions are also subject to COPPA’s requirements. Schools must comply with COPPA when using online services, apps, and websites that collect personal information from children. Schools must obtain verifiable parental consent before allowing children to access online services, and they must ensure that they are using COPPA-compliant services.

COPPA has had a significant impact on online educational services, as many schools have had to adapt their online learning platforms to comply with COPPA’s requirements. Online education service providers must obtain verifiable parental consent before collecting personal information from children and must ensure that their services have appropriate security measures to protect children’s data.

When Is Parental Consent Not Required for COPPA?

Parental consent is not required under the following circumstances:

1. When a website or app collects personal information for the sole purpose of responding to a one-time request from a child
2. When a website or app collects personal information for internal use to improve the website or app, so long as the information is not disclosed to third parties
3. When a website or app collects personal information in connection with certain educational activities, such as online tutorials or contests

COPPA and Marketing to Children

COPPA prohibits websites and apps from collecting personal information from children for the purpose of marketing or advertising. In addition, it prohibits websites and apps from targeting children with personalized ads based on their personal information.

What Are the Restrictions on Advertising to Children Under COPPA?

Websites and apps cannot collect personal information from children for the purpose of marketing or advertising products or services to them. They also cannot target children with personalized ads based on their personal information. If a website or app serves ads to children, they must ensure that the ads are appropriate for children and do not collect personal information.

COPPA and International Privacy Regulations

COPPA is one of the most comprehensive privacy laws in the world when it comes to protecting children’s personal information online. However, other countries have their own privacy laws that may be more or less stringent than COPPA. For example, the European Union’s General Data Protection Regulation (GDPR) provides strong protections for children’s personal information, and Australia’s Privacy Act requires websites and apps to obtain parental consent before collecting personal information from children under the age of 16.

COPPA vs. Other Privacy Laws: Similarities and Differences

COPPA shares many similarities with other privacy laws around the world, including the need to obtain parental consent before collecting personal information from children, the requirement to provide notice to parents about the types of personal information collected, and the need to maintain the confidentiality, security, and integrity of the personal information collected. However, there may be differences in the specific requirements of each law, such as the age of consent or the types of personal information protected.

Frequently Asked Questions (FAQs)

Who Does COPPA Apply To?

COPPA applies to websites, apps, games, and online services that collect personal information from children under the age of 13.

What Information Is Protected by COPPA?

COPPA protects personal information such as full name, home address, email address, phone number, Social Security number, and information collected online, such as IP address, geolocation data, and behavioral data.

What Are the Penalties for Violating COPPA?

Violating COPPA can result in monetary and legal penalties. The FTC can impose fines of up to $42,530 per violation, and COPPA violators can face lawsuits from consumers and state attorneys general.

How Can Parents or Guardians Give Consent Under COPPA?

Parents or guardians can give consent under COPPA by completing the consent form provided by the website, app, or online service. Verifiable parental consent must be obtained before collecting any personal information from children.

Are Schools Exempt From COPPA Regulations?

No, schools and educational institutions must comply with COPPA when using online services, apps, and websites that collect personal information from children.

Kiteworks Helps Organizations Demonstrate Compliance With the Children’s Online Privacy Protection Act (COPPA)

COPPA is a critical regulation that aims to protect the privacy and security of children under the age of 13 years who use online platforms. COPPA requires all online platforms that collect, store, or use information from children to comply with strict guidelines, including obtaining parental consent and providing clear and concise privacy policies. Google Drive, Dropbox, and OneDrive are some of the popular online file-sharing services that are used by many organizations across the globe. However, these platforms struggle to demonstrate COPPA compliance, putting them at risk of fines and legal repercussions.

The Kiteworks Private Content Network provides organizations an efficient way to comply with COPPA guidelines. Kiteworks offers automated workflows that help companies obtain parental consent and ensure the safe and secure handling of children’s data. With Kiteworks secure file sharing, organizations can create secure online portals where parents can provide consent for their children to use their platform. Based on the consent received, the system can tag and encrypt files to ensure that only authorized parties access them. Kiteworks also provides a clear and concise privacy policy that outlines how children’s data is collected, used, and secured. This helps meet COPPA’s requirements for transparency and disclosure.

Organizations requiring compliance with COPPA can request a custom-tailored demo to learn how Kiteworks protects, governs, and controls content and other confidential information.

 

Back to Risk & Compliance Glossary