In announcing COPPA violation settlements with Yelp and TinyCo, the FTC is bearing its enforcement teeth for the first time since issuing a new COPPA Rule in 2013. The Agency is making much of the enforcement actions. While the cases could represent a new enthusiasm for COPPA enforcement acts; they could also be an effort to quell growing criticism of a lack of such enforcement cases being filed the last few years.
Much Ado About Nothing?
July 1, 2013 is a day that will live in infamy…or perhaps not. The FTC issued a new COPPA Rule designed to clarify the application of COPPA to social media sites, plugins, apps and other technology platforms that didn’t exist when the first COPPA Rule was established in 2000.
In issuing the new COPPA Rule, the FTC effectively forced companies to spend a good bit of time and money updating both their information collection processes and compliance procedures. From investigating whether third-party ad networks were COPPA compliant to determining whether otherwise benign company apps could be considered to be collecting personal information about kids under 13 pursuant to the expanded definitions found in the new Rule, companies hustled to meet their COPPA obligations.
And then nothing happened.
For 14 months.
The management of many businesses began to grumble rather loudly about whether the time and money spent on compliance efforts were worth, well, the time and money. The FTC has now answered the question with the Yelp and TinyCo enforcement actions…or has it?
Low Hanging Fruit?
With trumpets blaring and press releases flying, the FTC is triumphantly publicizing the Yelp and TinyCo enforcement actions. Yelp will pay $450,000 while TinyCo will settle for $300,000. Do these enforcement actions involve issues unique to the new COPPA Rule? Other than the fact the actions focus on apps, it appears not.
Yelp is, of course, the dominant consumer review site online. Like any other user generated content company of any significant size, Yelp has an app to facilitate access to the site for members. The app contains a standard age gateway as part of the registration process. It is this app age gateway where Yelp runs afoul of COPPA.
In a complaint filed in federal court on September 16, 2014, the FTC alleged Yelp had actual knowledge of children under 13 using its app without parental permission. A review of the complaint makes it clear young children were able to open accounts, but that this was a software problem more than any nefarious plot by Yelp to vacuum up information from children. The age gateway appears to have had a glitch that allowed children under 13 to continue with the app registration process even when entering an age of 12 or younger during the registration process. At its core, this is an “actual knowledge” case that breaks no new ground and is strikingly similar to the Path enforcement action conducted under the original COPPA Rule.
TinyCo is the provider of a variety of apps directed at children under 13 including Tiny Pets, Tiny Zoo, Tiny Monsters, Tiny Village and Mermaid Resort. The FTC contends these apps collected user information in the form of email addresses. Given the apps can clearly be classified as directed at children under 13; TinyCo should have first obtained parental consent before requesting the information. Since this was not done, the company is alleged to have violated the provisions of the COPPA Rule.
The TinyCo case incorporates more aspects of the new COPPA Rule to the extent it involves the collection of personal information within the app itself. That being said, the violation in question is blatant and hardly involves the application of any of the finer points of the new COPPA Rule such as the collection of geolocation information or third party behavioral tracking.
The prosecutions in these two cases are more than justified. This being said, one can’t help but wonder if the prosecution of Yelp, in particular, is less about enforcing COPPA per se and more about:
- Making an example of a well known brand as a warning to other app developers,
- Showing the FTC is focused on the app industry when it comes to COPPA compliance, and
- Showing the FTC is still active in enforcing COPPA despite a long period of inactivity.
With two settlements under its belt, is the FTC set to pursue additional actions? If so, will the Agency continue to go after low hanging fruit or seek to enforce the finer points of the new COPPA Rule? The FTC has continually voiced the view the app industry is failing to meet its COPPA obligations. A betting man might suggest a few more COPPA enforcement actions involving apps will become public before the end of the year.
Richard A. Chapo, Esq.