The determination of whether a website, app, or another online platform must comply with COPPA requires a sophisticated analysis of the characteristics of the online platform in question. That is unless the COPPA actual knowledge standard comes in to play. Then the determination is a simple one.
The actual knowledge standard comes into play when an online operator has, you guessed it, actual knowledge that it is collecting personal information from kids under 13 without first obtaining verified parental consent from the parents of said kids. Once a company makes this determination, it must comply with COPPA. The determination is much simpler than one sees with the “directed at children” COPPA standard. It does not matter if:
- The site is not directed at children,
- The children lie about their age when registering,
- The information is provided voluntarily,
- The information is provided through comments or forums posts, or
- The information is not asked for during registration but learned later on.
As soon as you learn kids under 13 are using your platform, you must leap into action regarding COPPA compliance. If the FTC or a state agency files a lawsuit for COPPA violations and penalties, you are dead in the water because actual knowledge shows not only an understanding that your company was collecting information from children under 13, but a wanton disregard of the law. A judge is likely to “throw the book” at a company under this scenario.
The classic example of a company failing to comply with COPPA despite actual knowledge is the Path case. Path was a company that made an app by the same name. The company asked individuals to enter their age when signing up for the app, and the company used an age gateway to filter out kids under 13.
The app was very successful. Unfortunately, approximately 3,000 kids joined. How do we know they were under 13? The kids indicated as much when they entered their birth dates during the registration process.
The exact facts surrounding the case are a bit fuzzy since Path settled the litigation instead of going through a public trial for all the world to see, but one can hazard a guess that the age gateway failed. The fact Path paid $800,000 to settle the matter suggests the FTC had plenty of evidence the powers that be at the company had actual knowledge personal data was being collected from kids under 13.
Evidence Of Actual Knowledge
What is actual knowledge? It may seem a simple question until you consider it from a business perspective. Is it enough for a programmer to know underage kids are using your platform, or must an executive have this knowledge? What if the programmer is a freelancer and not an employee? What if a parent enters the information for the child?
As you can imagine, the FTC tends to take a liberal view suggesting knowledge by any employee is sufficient, while companies argue a more conservative approach. There is no clear answer at this time. A jury will most likely resolve the debate. Through the discovery process of a trial, the FTC will be able to gain access to your company server, email and instant messages, internal company memos, as well as obtain testimony from company executives and employees under penalty of perjury. Put together, this collection of evidence will either paint a picture of actual knowledge or not.
Given the evidence of actual knowledge will come almost entirely from your electronic business records, there can be a temptation to…how shall I put this…accidentally hit the delete key for certain emails or drop an opened 2 liter Coke bottle on the server.
Judges have developed a highly effective legal response to such “accidents.” They simply rule that you can no longer assert any affirmative defenses in defending the litigation. If the “accident” is particularly questionable, the judge will rule liability exists on your part and move the trial along to the stage where a jury determines how big of a check you will be writing. This is not a good place to be as a defendant in a lawsuit.
If you or fellow employees have actual knowledge that there are kids under 13 on your site or app, take immediate steps necessary to become COPPA compliant. Trying to pretend “nobody knows nothing” is a poor legal strategy. Check out our COPPA FAQs page to learn more about COPPA.