Discussions of COPPA compliance typically focus on the collection, storage and use of information obtained from children under 13 in text format. The web, however, is about so much more than mere text these days. User-generated images and videos have become so prevalent with Instagram and other platforms, that one can argue the posting of visual content is now the norm. This evolution also happens to raise interesting COPPA compliance issues.
You launch a social media site devoted to the Guardians of the Galaxy movie and comics. Older teens and adults are the intended audience, so you include a statement during the signup process indicating kids under 13 are not allowed. The site becomes a big success with 100,000 people registering for memberships.
A key feature of the site is a user’s ability to upload photos and videos to a forum section. An email comes in one day from a user indicating another user may be a child. You click through to the post in question and find a photo of a boy with his collection of Guardians of the Galaxy comics. He appears to be young, perhaps eight years old.
Are there any COPPA obligations in this situation?
The first thing to understand is COPPA applies in this situation. The presence of a child under 13 in a photo or video they upload to your site constitutes “actual knowledge” of their presence. It does not matter that you’ve restricted the site to adult users or that the child lied about their age to get access. You must comply with COPPA and gain verified parental consent as detailed in the regulations. The failure to do so opens you up to FTC and state enforcement actions for violating the law.
An offshoot of this issue concerns content uploaded by parents. Let’s return to our previous example, but with a twist. What if a parent joins your site and then posts an image of their 8-year-old with the parent’s collection of Guardians of the Galaxy comics?
What are your COPPA obligations in this instance?
The good news is you have none. COPPA only applies to situations where the child provides the information in question. In this case, the parent is the providing party. The FTC takes the view that the parent is de facto consenting to the collection of information associated with the child in the image since they are, after all, uploading it.
There is, however, a practical problem with this situation.
How do you know who uploaded the image as a site owner – the child in the picture or the parent? If you are lucky, the text uploaded with the photo might state “here’s a picture of my son” or something of this sort. Such a statement would clearly suggest the parent is the posting party, which relieves you of any COPPA obligations.
Ah, but what if the language is changed to “here’s a picture of my Guardians comics”? Now it isn’t clear if the person posting the image is the child or parent. Whether COPPA compliance is necessary becomes a murkier question. The only way to make the determination is on a case-by-case analysis involving a look at the totality of the circumstances and all other user-generated content posted by the party in question.
Photos and Videos
The FTC expanded the regulations associated with COPPA in July 2013. There is now no doubt COPPA obligations arise if you have actual knowledge of a child under 13 joining your site, even a photo or video is the source of that knowledge.
Questions about COPPA? Set up a consultation today.
Richard A. Chapo, Esq.