Yesterday, the FTC staff released its latest round of updated Frequently Asked Questions (“FAQs”) for its Rule implementing the Children’s Online Privacy Protection Act (“COPPA Rule”).  These new FAQs address the circumstances in which third parties may obtain “actual knowledge” that they are collecting personal information from a child-directed site or service and whether parental consent is needed for child-directed sites and apps that enable user-generated content to be emailed or shared via social media. 

As we previously reported, the FTC enacted sweeping changes to the COPPA Rule in December 2012 that became effective July 1, 2013.  In the last several months, the FTC staff have provided several updates to the informal FAQs. 

“Actual Knowledge” Standard for Third Parties

Third parties such as plugins and ad networks are liable under the new COPPA Rule only if they have actual knowledge that they are collecting personal information from a child under 13 years old or through sites and services that are directed to such children.  Most of the new FAQs try to resolve lingering questions about when a third party has “actual knowledge”:

1. Third parties can designate specific employees as the points of contact to receive COPPA notices, rather than having actual knowledge imputed to the entire company through any employee.
2. The third party will not be deemed to have “actual knowledge” — and will have no duty to investigate — if it simply receives a list of URLs of purportedly child-directed websites from which it is collecting personal information. 
3. If the third party receives “screenshots or other forms of concrete information” about sites on which the third party’s service are integrated, such information could provide actual knowledge:
   • If, based on the screenshots or other concrete information, the third party is “uncertain” whether a site or service is child directed, it ordinarily may rely on representations from the first-party site about whether the site is child-directed.  These representations could be provided in the form of a technological COPPA signal or “flag,” which industry has been working to develop since the idea was proposed by the FTC’s Chief Technologist in a blog post earlier this year. 
   • If, based on the screenshots or other concrete information, it is clear that the site or service is child directed, then any representations made by the first-party site would be overridden and the third party would be deemed to have actual knowledge.

Continue Reading FTC Releases Updated Guidance on New COPPA Rule