The Federal Trade Commission today reached a $3 million settlement with 20 operators of online virtual worlds.  The settlement is the largest civil penalty that the FTC has obtained to date for a violation of the Children’s Online Privacy Protection Act (COPPA). 

The FTC alleged that the operators collected children’s ages and email addresses during registration and then enabled children to publicly post their full names, email addresses, instant messenger IDs, and location, among other information, on personal profile pages and in online community forums before obtaining parental consent.  Specifically, if a user entered age information indicating he or she was under 13, the operator displayed a message warning the user that: “You are under 13 years old and we cannot ask you for your email address.  In order to register, you must ask your Parent or Guardian to fill out this screen…”  Once a parent’s email address was provided, the child was granted full access to the virtual world.  The FTC did not believe this approach constituted the verifiable parental consent required for public disclosures of children’s information.  The FTC made similar claims against the social networking website Imbee.com in 2008.  

Children’s privacy is receiving the heightened attention of regulators.  For example, last week Senator Markey released a discussion draft of his Do Not Track Kids Act.  The bill would expand COPPA’s scope and impose new restrictions on the collection, use, and disclosure of information from children, and, in some cases, individuals under the age of 18.  In addition, the FTC is expected to announce the next steps in its COPPA Rule review in the next few months.