How to comply with COPPABy: Gen Li

Disclaimer

This is not a legal advice. You must not rely on the

information on this slide as an alternative to legal

advice from your attorney or other professional legal

services provider. If you have any specific questions

about any legal matter you should consult your

attorney or other professional legal services provider.

You should never delay seeking legal advice, disregard

legal advice, or commence or discontinue any legal

action because of information in this presentation.

What is COPPA?

A type of meat?

A restaurant’s name?

!

COPPA

• The Children’s Online Privacy Protection Act (COPPA) was

enacted by Congress in 1998. COPPA required the Federal Trade

Commission (FTC) to issue and enforce regulations concerning

children’s online privacy. The FTC’s amended Rule became effective

on July 1, 2013.

• COPPA’s primary goal is to ensure that parents have control over

what information is collected from their young children online.

• The Rule only covers developers that:(1) that operate mobile apps that are directed to children under 13 and collect, use or

disclose personal information from children, and

(2) those who have actual knowledge that they are collecting, using, or disclosing

personal information from children under 13.

What does “personal information”

include?

(5) a telephone number;

(6) a social security number;

(7) a persistent identifier;

(8) a photograph, video, or audio

file, where such file contains a

child’s image or voice; or

(9) geo-location information

sufficient to identify street name

and name of a city or town.

(1) first and last name;

(2) a home or other physical

address including street name

and name of a city or town;

(3) online contact information;

(4) a screen or user name that

functions as online contact

information;

If you are covered, what should you do?

• Post a clear and comprehensive privacy policy

• Send direct notice to parents

• Obtain verifiable parental consent from parents

• Provide sufficient security to collected personal

information

• Allow parents to review collected information

Post a clear and comprehensive Privacy

Policy

What does “comprehensive” mean?

Your privacy policy needs to include the following information:

• The developer and related operators’ personal information.

Including: (1) name, (2) address, (3) telephone number and (4)

email address.

• A description of the types of information the developer collects from

children, and how the developer uses the information.

• A statement that parents can review or delete their children’s

personal information and prevent future collection.

For example:

What does “clear” mean?The amended Rule requires the developer to post the privacy policy

link in a clear and prominent location on the website or on the landing

page.

A“clear and prominent” link must stand out and be noticeable to the

site’s visitors. The link is likely to be “clear and prominent” if it is in a

larger font size and in all caps in a color that contrasts with the

background.

For example:

Send a direct notice to parents

What needs to be in the notice?1. If the notice is used to obtain a parent’s verifiable consent

prior to the collection of a child’s personal information, then

you must:

• State that you have collected the parent’s online contact information from the

child, and that it is only used to obtain the parent’s consent;

• State that the parent’s consent is required for the information collection;

• List the personal information that is going to be collected if there is consent;

• Include a hyperlink to your privacy policy;

• State how the parent can grant verifiable parental consent; and

• State that if the parent does not provide consent within a reasonable amount of

time, then you will delete the parent’s online contact information.

2. If the notice is to provide a parent information about the child’s

online activities and does not involve personal information

collection, then :

• State that you have collected the parent’s online contact information from the

child, and that it is used to obtain the parent’s consent;

• State that the parent’s online contact information will not be used or disclosed for

any other purpose;

• State that the parent can prevent the child from using the app and may require

you to delete the online contact information, and how the parent can do so, and

• Include a hyperlink to your privacy policy.

• For example:

How to send a notice?

Based on section 312.4 (b) of the amended Rule, you must make

reasonable efforts, taking into consideration the available technology, to

ensure that a parent or child receives the direct notice.

There is no absolute standard about what counts as a proper way to

send a direct notice, and you need to make your own decision based

on the available technology and information.

For example:

Obtain verifiable parental consent from

parents

Obtain verifiable parental consent from parents

• Existing approved verifiable parental consent

methods

• Alternative “Email-plus” method

Existing approved verifiable parental consent

• Provide consent through mail or fax;

• Provide information about a credit card or a debt card;

• Call a toll-free telephone;

• Send consent via video-conference;

• Checking a government-issued identification.

Alternative “Email-plus” method

If you will only use the personal information for internal purposes, then

you can use the next two steps:

First: send an email to the child’s parent, and the parent can manifest

his consent in the returning email

Second, after receiving the email consent, you need to either (1) make

a confirmation phone call, fax or letter to the parent; or (2) send a

confirmation message via the parent’s online contact information within

a reasonable amount of time.

Provide sufficient security to collected

personal information

Provide sufficient security to collected personal information

• COPPA requires developers to establish and maintain reasonable

procedures to protect the confidentiality, security, and integrity of

personal information collected from children.

• If there is an industry security standard, FOLLOW IT!

For example:

Allow parents to review collected information

Allow parents to review collected information

• Based on section 312.6 of the COPPA Rule, upon a parent’s

request, the developer must grant the parent access to the collected

personal information.

For example:

For more detailed information, please see......

Famigo’s “COPPA for Newbies” blog series:

• http://www.famigo.com/blog/2013/09/coppa-for-newbies-

your-privacy-policy/

• http://www.famigo.com/blog/2013/08/coppa-for-newbies-

who-is-covered-by-this-rule/

• http://www.famigo.com/blog/?p=3653

• http://www.famigo.com/blog/2013/10/coppa-for-newbies-

what-do-we-need-to-get-from-the-parents/