14 Oct Privacy Update: TinyCo and Yelp settle with the FTC for COPPA violations
The Federal Trade Commission (FTC) has begun to actively enforce the recently amended Children’s Online Privacy Protection Act (COPPA). COPPA requires an operator of a website or app to provide notices of its practices on collection, use, and disclosure of personal information from children under 13, and obtain verifiable parental consent prior to collection, use or disclosure of personal information from children under 13. In two separate actions the FTC filed claims for COPPA violations against TinyCo, Inc. (TinyCo) and Yelp, Inc. (Yelp).
The FTC claimed that TinyCo’s use of themes, such as bright colors and animated characters, in their mobile apps and their game titles like Tiny Pets, Tiny Monsters, Tiny Zoo, Tiny Village and Mermaid Resort demonstrated they were marketing towards children under the age of 13, thus the need to comply with COPPA. TinyCo failed to implement proper COPPA protections (1) to provide notice on its website or online services of the information it collected online from children, how it used such information, and its disclosure practices, among other required content, in violation of Section 312.4(b) of the COPPA Rule, (2) to provide direct notice to parents of the information it collected online from children, how it used such information, and its disclosure practices for such information, among other required content, in violation of Section 312.4(c) of the COPPA Rule, and (3) to obtain verifiable parental consent before any collection or use of personal information from children, in violation of Section 312.5(a)(1) of the COPPA Rule. When your app or website is targeted towards children under 13 and you are collected information, you better be COPPA compliant.
In the case of Yelp, the FTC alleged COPPA violations from 2009 to 2013. Specifically, from 2009 (when the Yelp App was launched) until April 2013, Yelp collected personal information, such as full names and email addresses, mobile device IDs, location, and any other information they posted on Yelp (such as photos) from several thousand children who input birthdates during the user registration process indicating that they were between ages 9 and 13. While the Yelp mobile app did ask for birthdate upon user registration, the app had a bug in its software that allowed the user to proceed with registration without any regard to the entered age; that led to the collection of name, e-mail address, and location of over 1,000 children under age 13 without parental consent. By having an age gate, Yelp was deemed to have “actual knowledge” under the COPPA Rule that it was collecting personal information from children under 13 through its mobile app.
Both comapnies settled with the FTC last month; TinyCo agreed to pay a $300,000 civil penalty, while Yelp agreed to pay a $450,000 civil penalty. Under the terms of the settlement, both companies must also delete all of the information it collected from children under 13, and submit a compliance report to the FTC within one year of the settlement.
This is a good time to evaluate your websites, online services, and mobile apps and get your COPPA house in order. If you offer a mobile app, build privacy in from the start and comply with the additional requirements under COPPA. As people – especially children – move more of their lives onto mobile devices, it’s important that they have the same consumer protections when they’re using an app that they have when they’re on a website…companies should take steps as they build and test their apps to make sure that children’s information won’t be collected without a parent’s consent.