The New Landscape of Children's Online Privacy

This is the latest in a series of columns by O’Melveny & Myers attorneys, focusing on key legal issues specific to a variety of U.S. industries.

With the Federal Trade Commission’s amendment to the Children’s Online Privacy Protection Act (COPPA) now in effect, website operators or online services face stricter limits on their ability to collect information from preteen children without parental consent. Enacted in 1998, COPPA prohibits the collection, use, and disclosure of a child’s personal information, except under conditions consistent with the rule prescribed by the Federal Trade Commission. The FTC’s rule requires operators of websites or online services either directed to children under 13 years of age or with actual knowledge that they are collecting personal information from children to provide notice to parents and obtain their verifiable consent before collecting, using, or disclosing such personal information. The rule also requires the operators to keep this information secure and not to condition a child’s participation in activities on the collection of more personal information than is reasonably necessary for the child’s participation.

The FTC’s amended rule, which took effect July 1, reflects changes required to keep abreast of technological advancements and online trends, especially the surge in the use of mobile devices and social networking. Specifically, the amended rule (i) broadens the reach of the term “operator,” (ii) expands the definition of “personal information,” (iii) clarifies the types of protection that operators must offer in order to collect information from children online, and (iv) expands the ways in which operators can comply with COPPA. To ensure their compliance, website operators and their counsel may need to implement new or more stringent policies and practices for the collection of personal information from children under 13.

Operators

The amended rule now extends to operators of websites or online services that do not directly collect a child’s personal information but instead permit third parties to access that information through plug-ins or advertising networks. Generally, COPPA applies to a website operator or an online service provider that: (i) operates a commercial website or an online service (including mobile apps) directed to children and collects personal information from children (or engages an agent or service provider to collect or maintain personal information on its behalf); (ii) operates a general audience website with a separate children’s section and collects personal information from children; or (iii) operates a general audience website and has actual knowledge that it is collecting personal information from children.

Seeking to close what the FTC has described as a technological “loophole,” the amended rule subjects operators of websites and online services to COPPA if the operator permits third-party services, such as plug-ins or advertising networks, to collect personal information from the site’s visitors—and that operator maintains direct or indirect control of the design and functionality of the child-directed sites or services. The amended rule also clarifies that the definition of “website or online service directed to children” includes plug-in or ad networks with actual knowledge that they are collecting personal information through a child-directed site or service.

Personal Information