In updating the COPPA Rule in July of 2013, the FTC sought to clarify how it viewed the application of the law to a more mature Internet. One area of particularly interest to practitioners was how COPPA would apply to social media button plug-ins for sites directed at children.
An Island No More
Not all that long ago, the web was essentially a collection of websites connected only by links. Everything changed with the explosion of social media. With Facebook, Instagram, Twitter, Pinterest and other sites becoming hugely popular, most sites now incorporate social media buttons into their layout as standard operating procedure. The question is what COPPA implication do these buttons have for sites targeting kids under 13?
Directed at Children
The FTC Rule suggests the operator of an online platform directed at children under 13 has an affirmative duty to establish whether any third parties collecting information through the site are doing so in a COPPA compliant manner. Social media button plug-ins, which appear to create an inherent conflict between sites directed at children and those with a general audience emphasis, are included. Let’s use Facebook as an example.
Facebook is a general audience website. The site uses an age gateway to keep kids under 13 from opening accounts with the site. The company manifests this in its terms:
Registration and Account Security
Facebook users provide their real names and information, and we need your help to keep it that way. Here are some commitments you make to us relating to registering and maintaining the security of your account:
5. You will not use Facebook if you are under 13.
Twitter, Pinterest, Instagram and most other major social media sites use similar language.
By definition, the users of a site directed at children are almost universally going to be 12 or younger. Legally, Facebook is clearly a general audience site directed at kids 13 and older. Does it not logically follow then that the FTC Rule essentially prohibits the use of any social media buttons on sites directed at children under 13? The answer is yes…unless it isn’t.
Section 312.5(c)(8) of the COPPA Rule contains a similar exception. Compliance and notice requirements are not necessary for social media buttons where:
- a third-party operator only collects a persistent identifier and no other personal information;
- the user affirmatively interacts with that third-party operator to trigger the collection; and
- the third-party operator has previously conducted an age-screen of the user, indicating the user is not a child.
All of these elements must be present for the exception to apply. Practically speaking, this means a legal analysis must be performed one each site the social media button plug-in links out to as well as the plug-in widget itself to determine if all of these elements are present.
What if an operator skips the analysis and adds social media buttons to their platform? The operator is strictly liable under COPPA. Liability exists even if the operator is properly complying with COPPA in its information collection practices.
Does adding social buttons to a website directed at children under 13 make the website owner liable to the social media site as well? Let’s consider an example.
Bob launches a math tutorial site directed at children between 6 and ten years of age. The website tutorials consist of math problem videos. Kids provide answers to the questions in a text box located below the video and then comment on how the tutorial compares to what they learn in school. The kids often voluntarily add their:
- School grades,
- School name, and
- Teachers’ names.
The site is COPPA compliant, but also allows users to share each video and the accompanying comments on Facebook. Bob has never contacted Facebook to investigate the data collection policies of the company.
Bob’s website becomes very popular. He is soon receiving millions of impressions a day and users are sending 50,000 uploads to Facebook each month. Nearly all of these shares are from kids under 13.
After receiving numerous complaints from parents, the FTC starts an enforcement action against Facebook. [Yes, hard to believe.] The enforcement action is based on the assertion Facebook has actual knowledge of kids under 13 given the information uploaded from Bob’s site and is failing to respond appropriately.
Can Facebook sue Bob? Yes. Bob is arguably violating the Facebook terms by sending personal information of children under 13 to a site that requires members to be 13 or older. The relevant language is:
Special Provisions Applicable to Social Plug-ins
3. You will not place a Social Plug-in on any page containing content that would violate this Statement if posted on Facebook.
This language opens Bob up to a breach of contract lawsuit, but this isn’t the end of Bob’s problems. The Facebook terms also include the following language:
If anyone brings a claim against us related to your actions, content or information on Facebook, you will indemnify and hold us harmless from and against all damages, losses, and expenses of any kind (including reasonable legal fees and costs) related to such claim. Although we provide rules for user conduct, we do not control or direct users’ actions on Facebook and are not responsible for the content or information users transmit or share on Facebook. We are not responsible for any offensive, inappropriate, obscene, unlawful or otherwise objectionable content or information you may encounter on Facebook. We are not responsible for the conduct, whether online or offline, or any user of Facebook.
Given this language, one can expect Facebook to serve an indemnity claim on Bob. The claim will demand that Bob pay all the attorneys’ fees of Facebook in defending the FTC action as well as any civil penalty the FTC can establish.
Bob would appear to be in a world of trouble. Not only is he facing a COPPA enforcement action against his personal site, but he now faces the prospect of paying:
- Damages awarded against Facebook in favor of the FTC,
- Attorney’s fees of Facebook, and
- Damages awarded to Facebook against Bob for violating the Facebook terms.
Practically speaking, Bob may well have a viable defense against the Facebook claims because kids can only upload content from Bob’s site if they already have a Facebook account. Of course, if the evidence shows kids are coming from Bob’s site and opening accounts by lying about their age, Bob is in serious trouble.
Should we be concerned about Bob? No. The real concern is the number of actual websites, apps and other services directed at kids under 13 that uses social media buttons without the proper analysis or a second thought. Those operators are gambling their financial futures – often without even realizing it.
Can sites directed at children under 13 that are otherwise COPPA compliant incorporate social media buttons on the layout of their site? Possibly, but only after pursuing a close review of the social media sites in question.
Richard A. Chapo, Esq.