The Children’s Online Privacy Protection Act of 1998, better known as “COPPA,” is focused primarily on websites, apps, and online services directed at children under the age of 13. The question many online operators have is what does “directed at children” actually mean? If you’ve had the same thought, be prepared to be disappointed. The answer is…it depends.
Neither the text of COPPA nor the regulations surrounding it provided a specific definition. Instead, the FTC and courts make the determination on a case-by-case review of the platform in question.
FTC COPPA Factors
To determine if a website, app, or online service is directed at children, the FTC will look at several factors before claiming COPPA penalties including, but not limited to:
- The subject matter of the platform;
- The video content on the site;
- The audio content on the website;
- The graphics and pictures on the website;
- The age of models used in any of the above;
- The presence of cartoon or animated characters directed at kids;
- The presence of incentives directed at kids;
- The presence of tasks kids under 13 would enjoy;
- The nature of the language used in the text; and
- The appearance, theme, and content of advertising for the site.
The FTC can also investigate the analytical data of the platform in question. In doing so, the Agency will look to the demographics of users of the online platform to determine if kids are using it and at what frequency as well as whether actual knowledge exists.
The good news is you can provide evidence in support of the position your platform is not directed towards kids. This evidence includes the intended audience for the site, business plans, declarations made under penalty of perjury, and any empirical evidence that supports the position.
Amazon COPPA Evaluation Example
Amazon is a small online retailer you might have heard of in passing. [We joke.] The site sells toys and other items attractive to kids under the age of 13. Does this mean Amazon is “directed at children” in whole or part? If so, what duty does it have to be COPPA compliant?
The Electronic Privacy Information Center asked the FTC to make this very determination in 2004. After evaluating the site, the FTC found Amazon is not a website directed at children in whole or part and was thus not required to obtain verified parental consent from each person opening an account with the site.
In filing a request for review, the Electronic Privacy Information Center [“EPIC”] asked the FTC to pay particular attention to the “toy store” section of Amazon. EPIC argued kids under 13 were opening Amazon accounts to visit the area and that Amazon had actual knowledge of kids under 13 doing so.
The FTC disagreed.
In a responsive letter, the FTC noted that there were elements of the toy store section of Amazon that did fit the definition of a child-directed site including the presence of toys, child models, fonts attractive to children, and bright colors. However, the FTC noted the clear purpose of the site was to sell toys to parents, not to the actual children themselves. Furthermore, Amazon tailored the vocabulary used in the toy section to adult readers, and there were no activities or functions in the toy store section directed at young kids.
Interestingly, EPIC argued that the fact Amazon provided a “Kid’s Review Form” for products in the toy store was a clear invitation for kids under 13 to use the site. EPIC further pointed out seven examples where kids using the form had provided reviews containing personal information that should have triggered COPPA compliance.
The FTC offered an interesting response to the EPIC argument. The Agency first noted Amazon did not collect any personal information from kids that used the form, so there was no need to comply with COPPA. The Agency then brushed aside the evidence of the seven occasions in which kids using the form did provide personal information as inconsequential given Amazon had no actual knowledge of this since it used an automated posting program as well as the fact the seven potential violations represented a tiny fraction of the tens of thousands of reviews with no such information.
What can we take away from this case? A couple of things. First, the FTC acts reasonably when evaluating third party complaints. Second, the number of factors that must be present for the FTC to find a platform is directed at children is as clear as the skyline on a foggy morning in San Francisco, which is to say not very clear at all.
For example, let’s revisit the Amazon analysis and look at it from an alternative perspective. While Amazon may not collect personal information from individuals using the Kid’s Review Form, it can and probably does record the IP address of each user of the form. Under the new FTC COPPA Rule issued in 2013, the IP address is considered a form of personal information, which would arguably trigger a duty to be COPPA compliant. Does this mean the Amazon finding by the FTC no longer applies in 2020? One would think so.
Directed At Children
If you are concerned your website or app may be directed at children, you need to speak with a lawyer who can analyze the platform and provide an opinion letter on the issue. Get the determination wrong on your own, and the COPPA penalties can destroy your company.
Check out our COPPA FAQs page to learn more about COPPA.