FTC Amps Up Focus on COPPA and Content Creators

The Federal Trade Commission recently issued guidance to content creators to help them determine whether their content is considered “directed to children,” which would trigger notice and consent obligations under the Children’s Online Privacy Protection Act. While it was specifically directed at content hosted or shared on general audience third-party platforms, the guidance is useful whether the content creators publish on third-party platforms or on their own.

COPPA Review

COPPA is a federal privacy statute that prohibits the collection of personal information from children under 13 without parental permission. COPPA requires operators of commercial websites and online services that are directed to children to provide notice to parents about their data and information practices and obtain verifiable parental consent prior to collecting children’s personal data. The FTC enforces COPPA through its COPPA Rule, which defines “personal information” to include a wide range of information, including persistent identifiers used to track users over time and across different sites. 

COPPA also applies to operators of general audience websites and platforms that have actual knowledge that they are collecting personal information from children under 13. In a recent settlement, the FTC alleged that the operator of a popular social media platform collected personal information in the form of persistent identifiers from viewers of child-directed content channels without notifying parents and getting their consent. To settle the case, the platform not only agreed to pay monetary relief but also agreed to create a mechanism so that users can designate when the videos they upload are directed to children, to ensure that both the platform and its user are complying with COPPA. The FTC has also indicated that it plans focused review of user-uploaded content on the platform starting in early 2020 to determine whether there are any additional COPPA violations.

FTC Guidance for Content Creators

After putting creators of child-directed content on notice that it will hold them strictly liable under COPPA for personal information collected from their content—whether it is collected by the content provider, the platform where the content is posted or another third party—the FTC issued guidance for content creators. 

The guidance reminds content creators that COPPA applies the same way whether the creator owns or operates its own website or app, or uploads content to a third-party platform. If the content is directed to children and if the content owner, platform owner or someone on its behalf (for example, an ad network) collects personal information from viewers, COPPA applies and the operator of the site must provide notice and obtain verifiable parental consent, among COPPA’s other requirements.

The FTC offered some guidance on how it determines whether content is or isn’t directed to children. First, the FTC notes the most clear-cut case: “if [the] intended audience is kids under 13, the [content or site] is covered by COPPA.” 

Acknowledging that “there is no one-size-fits-all answer about what makes a site directed to children,” the guidance listed the factors under the COPPA Rule that the FTC considers in determining whether content is directed to children. 

• Subject matter
• Visual content
• Use of animated characters or child-oriented activities and incentives
• Kind of music or other audio content
• Age of models
• Presence of child celebrities or celebrities who appeal to children
• Language or other characteristics of the site
• Advertising that promotes or appears on the site that is directed to children
• Competent and reliable empirical evidence about the age of the audience

The guidance also offered some “general rules of thumb” for making the determination as to whether content is directed to children. 

Unless the content is affirmatively targeted to children, content about traditionally adult subjects (for example, “employment, finances, politics, home ownership, home improvement, or travel”) is not generally covered under COPPA. Likewise, content and videos aimed at high school or college students would not require COPPA compliance. Animated content is not automatically covered by COPPA, but animated child-themed programming or content showing kids playing with toys or participating in other child-oriented activities would be considered directed to children. 

The guidance also noted that “how others view your content and content similar to yours” may help content creators determine whether this content could be considered directed to children. For example, the guidance suggests looking to see whether a creator’s content has been mentioned or reviewed in blogs, articles or other media aimed at parents of young children.

Considerations for Third-Party Platforms

General audience third-party platforms that host user-generated content may be held liable under COPPA if they have “actual knowledge” that their users upload child-directed content. If a platform is aware that its users are publishing child-directed content, the platform must not collect personal information from visitors to that site unless it obtains verifiable parental consent prior to collecting such information. This includes collecting persistent identifiers for behavioral advertising purposes.

Potential Changes to COPPA

The FTC in July also issued a notice of rule review and a call for public comments regarding COPPA Rule reform. While it typically reviews its rules every 10 years, the FTC is calling for a rule review only six years after the last amendments to the COPPA Rule in 2013 because of rapid changes in technology, including the expanded use of education technology. As part of the rule review, the FTC held a public workshop Oct. 7 focused on potential updates to the COPPA Rule. Based on the FTC’s statements and questions during the workshop, the FTC is focused on the following topics:

1. The Definition of Child-Directed Content. The FTC moderators asked several questions probing whether the current test and the factors used to determine whether an online service is child-directed need to be updated. In particular, some of the panelists at the workshop expressed concerns that the definition of child-directed also may sweep in online services that are simply child-attractive.
2. The Definition of Actual Knowledge. The FTC moderators questioned panelists regarding what type of information the FTC should consider in determining that a website operator has actual knowledge that children are using an online service. The panelists discussed whether statements by the online service about its audience or demographic data collected by the online service should constitute evidence of actual knowledge. 
3. The Definition of Personal Information. The FTC asked panelists about the current definition of personal information. Many comments during this discussion focused on whether prohibiting the collection of persistent identifiers for behavioral advertising purposes is harmful to children and furthers the purpose of COPPA—to protect children online. 

The FTC recently extended the deadline for public comments on the COPPA Rule from Oct. 23 to Dec. 9.