If your application collects data from children, you may be required to obtain parental consent.
1.What is COPPA?
The Children’s Online Privacy Protection Act (“COPPA”) specifically requires website operators to notify parents and obtain their consent when collecting, using, or disclosing the personal information of children under the age of 13. COPPA was established in 2000 in response to growing concern and awareness of the online targeting of children and the collection and use of children’s personal information without parental notice and consent.
The term personal information includes: name, address, e-mail address, telephone number, Social Security number, and any other information that would identify the child.
2. Does the FTC Actually Enforce COPPA Against Mobile App Developers?
YES. In a recent enforcement action against W3 Innovations, the mobile app developer was required to pay a $50,000 penalty for violation of these rules. Read more about the settlement here.
3. How do I know if COPPA Applies to Me?
If your mobile app:
- is “directed” at children under the age 13 OR
- has actual knowledge that the users are under the age of 13,
COPPA rules will apply. In making this determination, consider the following:
- Does your mobile app include subject matter that is “directed” at children under the age of 13?
- Factors include subject matter, visual and audio content, age of the models used, language used, nature of the ads displayed, use of animated characters)
- Does you have actual knowledge that the users are under the age of 13?
- Consider whether your app collects the age of users or if you engage in analytics or other tasks that indicates actual knowledge of user age
4. What are the implications of the proposed amendments to COPPA for app developers?
Under the September 2011 FTC proposed amendments, the definition of “personal information” was expanded to include: geolocation, tracking cookies, and other persistent identifiers that are common in mobile devices, which are typically used to track users across websites and apps for targeted marketing purposes.
As an app developer, this means that you would be required to obtain parental consent even when your mobile app is passively collecting data about children as they move across applications or sites. For example, if you track the ads on a children’s site or app that bring users to an advertiser’s site, collection of that data would first require parental consent.
The FTC is accepting comments on these proposed changes up until November 28, 2011.
5. Where can I find more guidance on COPPA?
For guidance on complying with COPPA requirements, refer to the following resources:
- COPPA FAQ – Helpful guidance from the FTC website including links to other COPPA compliance resources
- You, your Privacy Polices and COPPA – Compliance Guidelines from the FTC
- COPPA’s Compliance website
- How to Comply with COPPA – TrustE’s Guidelines for COPPA compliance
- Does COPPA apply to you? – A quick reference guide to COPPA provided by Information Shield