Most articles on the Children’s Online Privacy Protection Act involve esoteric interpretations of vague regulations. In this article, I take a look at a rather simple issue, but one constantly asked by poor souls who learn their online platform must comply with COPPA.
As a general rule, COPPA requires an online provider to obtain verified consent from parents before collecting personal information from a child under 13. This requirement raises a certain chicken-egg conundrum. How can an online business contact parents without first asking the child in question for the contact information of their parents?
As an attorney, I’m tempted to dig into a logical argument over whether the contact information for a parent triggers COPPA compliance given the definition of “personal information” under the COPPA Rule. Fortunately for you, I’ll have to hold off. The FTC has developed clear guidance on the issue.
In amending the COPPA Rule in 2013, the attorneys with the FTC sought to clarify and address a number of practical issues arising under the law. The question of how an online provider can collect information to contact parents is one such topic. The appropriate language is found in 16 C.F.R. § 312.5(c)(1):
(c) Exceptions to prior parental consent. Verifiable parental consent is required prior to any collection, use and/or disclosure of personal information from a child except as set forth in this paragraph. The exceptions to prior parental consent are as follows:
(1) Where the operator collects the name or online contact information of a parent or child to be used for the sole purpose of obtaining parental consent or providing notice under § 312.4. If the operator has not obtained parental consent after a reasonable time from the date of the information collection, the operator must delete such information from its records;
Put simply, an online provider can ask the child in question for the contact information of parents. The operator must then move to seek consent from the parent within a reasonable time period or delete the information. The “reasonable time” standard is open to interpretation. The answer will likely depend on the number of children trying to join the platform on a particular day as well as other practical factors that make it more or less difficult to seek such verification.
Can an online provider ask a child to supply contact information for a parent prior to obtaining consent from parents to collect personal information from children? The act is clearly allowed pursuant to 16 C.F.R. § 312.5(c)(1).
Richard A. Chapo, Esq.