When is your website or app covered by the Children’s Online Privacy Protection Act (“COPPA”) and the FTC’s COPPA Rule? Although there are gray areas under COPPA, one clear way to fall under this law is to know that you’re collecting information from children under the age of 13 online. That’s part of what landed Musical.ly, now known as TikTok, in trouble with the FTC – including a record-setting COPPA fine of $5.7 million. COPPA isn’t limited to the kinds of video social network apps that Musical.ly provides; broadcasters’ websites and apps may end up falling under COPPA.
According to the FTC’s complaint, Musical.ly knew that it was collecting information from children under 13 (COPPA doesn’t apply to anyone else) for several reasons. For instance, press articles described the popularity of Musical.ly among under-13 users, the company received hundreds of complaints from parents trying to close their kids’ accounts, and the company itself provided guidance to parents regarding their children’s usage of the app.
When operators of websites, apps, and other online services know that they’re collecting information from children – or if their services are “directed to” children – they need to satisfy COPPA’s requirements. Among these requirements are providing notice to parents, obtaining their verifiable consent to collect information, and deleting information at the request of parents. The FTC alleged that Musical.ly failed to meet these requirements.
In addition to agreeing to pay a multi-million dollar fine, Musical.ly is being ordered to make a choice: either destroy all personal information associated with user accounts; or allow users (regardless of age) to transfer their videos to their own devices, and allow users 13 or older to maintain their registration.
These are serious consequences, but Commissioners Rohit Chopra and Rebecca Kelly Slaughter issued a statement suggesting that the FTC could have gone further: “When any company appears to have a made a business decision to violate or disregard the law, the Commission should identify and investigate those individuals who made or ratified that decision and evaluate whether to charge them.” As the FTC continues to be scrutinized for its privacy enforcement track record, you can expect calls for harsher penalties to continue.