The determination of whether a website, app or another online service must comply with COPPA requires a sophisticated analysis of the characteristics of the online platform in question. That is unless the actual knowledge standard comes in to play. Then the determination is a simple one.
COPPA and Actual Knowledge
The actual knowledge standard comes into play when an online operator has, you guessed it, actual knowledge that it is collecting personal information from kids under 13. Once this occurs, you must become COPPA compliant immediately. It does not matter if:
- The site is not directed at children,
- The children lie about their age when registering,
- The information is provided voluntarily,
- The information is provided through comments or forums posts, or
- The information is not asked for during registration but learned later on.
As soon as you learn kids under 13 are using your platform, you must leap into action. If the FTC files a lawsuit, you are dead in the water because actual knowledge shows both an understanding that children are present and a wanton disregard of the law on your part. A judge is likely to throw the book at you in this situation.
The classic example of a company failing to comply with COPPA despite actual knowledge is the Path app case. Path made an app by the same name. The company asked individuals to enter their age when signing up for the app.
The app was very successful. Unfortunately, approximately 3,000 children under 13 signed up for the app. How do we know they were under 13? The kids indicated as much when they entered their birth dates during the registration process.
The exact facts surrounding the case are a bit fuzzy since the case settled quickly. The fact Path paid $800,000 to settle the matter suggests the FTC had plenty of evidence the powers that be in the company were aware of the situation.
What is actual knowledge? It may seem a simple question until you consider it from a business perspective. Is it enough for a programmer to know there are underage kids using your platform or must an executive have this knowledge? What if the programmer is a freelancer and not an employee? As you can image, the FTC tends to take a liberal view suggesting knowledge by any employee is sufficient while companies argue a more conservative approach. There is no definite answer at this time. The debate will most likely be resolved by a jury. Through the discovery process of a trial, the FTC will be able to gain access to your company server, electronic messages, and internal company memos. The Agency will also obtain testimony from company executives and employees under penalty of perjury through the deposition process. Put together, this collection of evidence will either paint a picture of actual knowledge or not.
Given the evidence of actual knowledge will come almost entirely from your electronic business records, there can be a temptation to…how shall I put this…accidently hit the delete key for individual emails or drop an opened 2 liter Coke bottle on the server.
Judges have developed a highly effective legal response to such “accidents.” They rule that you can no longer assert any affirmative defenses in defending the litigation. If the “accident” is particularly questionable, the judge will decide the case in favor of the FTC. At that point, the only question the jury must answer is how big a check you must write to the FTC.
If you or fellow employees have actual knowledge that there are kids under 13 on your site or app, take immediate steps necessary to become COPPA compliant. Trying to pretend “nobody knows nothing” is a poor legal strategy. Contact us today to get the process underway.
Richard A. Chapo, Esq.