Protecting your Child's Personal Information Online: COPPA

When it comes to a child’s personal information, the Children’s Online Privacy Protection Act (COPPA) puts the parents in control. In 1998, after a great concern over the privacy of America’s youth, the United States Congress passed COPPA to protect children under the age of 13.[1] Young children can be more vulnerable than adults online because they may be more easily manipulated into sharing private data and can’t meaningfully provide consent for data collection.[2]

COPPA protects any information collected from the child that is combined with any personal identifiable information (PII). For example, a child’s name, address, photo, or username is all protected personal information under the act. The name of a child’s elementary school is not explicitly listed as protected data. However, if a website collects a child’s photo and the name of the elementary school, it becomes possible to identify, or even locate the child which in turn makes the name of the school protected PII under COPPA.

What Rights as a Parent do I Have Under COPPA?

Though COPPA was enacted to serve the interests of children, parents have a bulk of rights over what information an online service can take from your child. Operators regulated under the act are required to give “direct notice” to parents of their children’s information practices before collecting information from kid(s).[3] Parents must be notified directly before any online service can collect personal information on your children.[4] Parents must also give “verifiable consent” before any organization begins collecting PII from their children.[5]

Moreover, as a parent, you have a right to review and access the information collected on your child as well as revoke your prior consent by requiring the organization to halt any further collection of PII from your child.[6] However, if a parent does not provide consent and an organization collects a child’s information, the organization must delete the information immediately.[7]

Enforcement

Because the Federal Trade Commission (FTC) enforces COPPA, there is no “personal right of action” which would allow parents to sue corporations that sell or collect their children’s information without their consent.[8] However, that does not mean you have no recourse if you know an online organization is taking your child’s PII without your consent. As a parent, you have three courses of action: The FTC, your State’s Attorney General, and data deletion services.

The FTC has vested enforcement authority, as well as all state Attorney Generals[9], to seek fines up to $43,280 for each violation. Why such a random number? Who knows, maybe the legislature didn’t have their morning coffee. In 2019, the FTC secured a landmark judgment against YouTube (a Google owned online service). YouTube knowingly collected children’s personal information without following regulations under COPPA since YouTube knowingly was collecting children information without parent consent. The FTC and Google reached a $170 million settlement over the allegations that violated COPPA.[10]

Furthermore, if you know of any corporation refusing to delete your child’s information or want to make sure their information is deleted, our deletion service website, deleteyourdata.com, ran by the Neon Law Foundation, can make sure your child’s information is deleted permanently.[11]

______________

[1] Katie Terrell Hanna, COPPA (Children’s Online Privacy Protection Act), TechTarget (last viewed Jun. 29, 2022), https://www.techtarget.com/searchcio/definition/COPPA-Childrens-Online-Privacy-Protection-Act.

[2] Children at increased risk of harm online during global COVID-19 pandemic, UNICEF (Apr. 14, 2020), https://www.unicef.org/press-releases/children-increased-risk-harm-online-during-global-covid-19-pandemic.

[3] Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business, F.T.C. (Jun. 2017), https://www.ftc.gov/business-guidance/resources/childrens-online-privacy-protection-rule-six-step-compliance-plan-your-business.

[4] Id.

[5] Id.

[6] Id.

[7] Id.

[8] Benjamin Stein, Plaintiffs Continue Search for de facto COPPA Right of Action, InfoLawGroup LLP (Mar. 25, 2020), https://www.infolawgroup.com/insights/2020/3/23/plaintiffs-continue-search-for-de-facto-coppa-right-of-action.

[9] Id.

[10] Kate Cox, YouTube Unlawfully Violates Kid’s Privacy, new $3.2B Lawsuit Claims, Arstechnica (Sep. 14, 2020), https://arstechnica.com/tech-policy/2020/09/google-faces-3-2b-lawsuit-over-claims-it-violated-childrens-privacy/.