A business that follows the CARU guidelines that has been approved by the FTC will be deemed to have satisfied the COPPA requirements. 15 U.S.C. § 6503. In June of 2017, the FTC published an updated guide to COPPA compliance, addressing new technologies used to obtain personal data, such as voice-activated devices, Internet of things devices, and connected toys or other products intended for children that collect information, such as voice recordings or geolocation data. The guide also introduced two new methods for obtaining verifiable parental consent: knowledge-based authentication questions and facial recognition technology used to match a verified photo ID. (See FTC Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business). COPPA Enforcement. COPPA is enforced by the FTC and violations of COPPA are considered an unfair and deceptive trade practice under the FTC Act. There is no private cause of action under COPPA. State attorneys general can also bring civil actions under COPPA as necessary to protect the public interest and can obtain injunctions and damages. FTC COPPA Enforcement Actions. The following actions have been taken by the FTC against businesses for failure to comply with COPPA: On September 4, 2019 Google LLC and its subsidiary YouTube, LLC agreed to pay a $170 million civil penalty to the Federal Trade Commission and the New York Attorney General to settle allegations that the YouTube video sharing service illegally collected personal information from children without their parents’ consent in violation of the Children’s Online Privacy Protection Act Rule (COPPA). FTC v. Rock You (2012) . Social gaming site allowed users to make slide shows with photos. To save the slide show a user had to enter an email address and password along with birthdate. This information was collected from children under 13. The investigation by the FTC also found that the game site lacked adequate security and exposed email addresses
38
Made with FlippingBook - Online Brochure Maker