Most discussions of the Children’s Online Privacy Protection Act of 1998 focus on the legal implications for online businesses running websites and apps. Ad networks, however, also must comply with COPPA in certain circumstances.
Post July 1, 2013
Ad networks have historically had little reason to be concerned about COPPA. As secondary platforms, ad networks didn’t appear to be covered by the scope of COPPA as detailed in the original COPPA Rule issued by the FTC. This interpretation changed in 2013.
In July of 2013, the FTC issued a revised COPPA Rule. The purpose of the new Rule was to update the COPPA regulations to reflect modern data collection practices by online companies. The new Rule included expanding the types of collected information that trigger COPPA compliance as well as the types of operators who must comply with the Rule. With the collection of even just IP addresses now triggering COPPA compliance, nearly every ad network must now be concerned about COPPA.
Two situations trigger COPPA compliance. The first occurs when the online platform is “directed at children under 13.” An example would be a website for a child’s entertainment program such as Dora the Explorer. Ad networks targeted at children under 13 are rare indeed since the average six-year-old doesn’t exactly fit within a desired marketing demographic for most advertisers.
“Actual knowledge” is the second trigger for COPPA compliance and the area of concern for most ad networks. Under this standard, an online platform that is not directed at children under 13, but discovers such children are on the platform, must comply with the law. For example, SnapChat recently settled alleged COPPA violation claims that the company had thousands of kids under 13 using its platform, and it knew this because the kids had provided their ages during the registration process.
How exactly does an ad network gain “actual knowledge” of the fact it is collecting personal information from children under 13? The FTC suggests there are three ways:
- The ad network receives direct notice from a website owner in its network that the site is directed at children under 13,
- Where an employee of the ad network recognizes a site publishing the ads of the network is directed at children under 13, or
- Where a totality of the facts presented suggests the ad network has actual knowledge it is collecting personal information from children under 13.
Please note the FTC interpretation is merely a guide to how the Agency might proceed in enforcement actions against ad networks. The standard of “actual knowledge” is one that is a bit hazy from a legal point of view. Specifically, what constitutes actual knowledge particularly when the online platform in question is a background system such as an ad network? The courts will make that determination in the future.
Representatives of the FTC continue to suggest the Agency is in the process of ramping up the number of enforcement actions. Were the FTC to go after an ad network, the potential damage claims could be historic. With damages of up to $40,000 being claimed on a per child basis for COPPA violations, the fact ad networks serve millions of people makes for some very interesting math.
The FTC is promising an increase in COPPA enforcement actions and it is “looking at all forums.” Ad networks would do well to become intimately familiar with COPPA and the compliance steps required should the network be confronted with an actual knowledge scenario.
Richard A. Chapo, Esq.