The staff of the Federal Trade Commission (“FTC”) has released updated guidance on how the Children’s Online Privacy Protection Act (“COPPA”) and its implementing regulations apply to schools and educational online services through revisions to the Frequently Asked Questions (“FAQS”) that are published on the FTC website.  For a comparison between the old and new school FAQs, please click here.  The FAQs constitute informal guidance, but they are useful for understanding how FTC staff interprets COPPA’s application in different contexts.  Here is a brief summary:

• The revised FAQs do not change the circumstances under which schools can provide verifiable parental consent on behalf of parents, that is, when an operator collects personal information from students “for the use and benefit of the school, and for no other commercial purposes.”  Examples of prohibited commercial purposes include online behavioral advertising and “building user profiles for commercial purposes not related to the provision of the online service” to the school.

• While the prior FAQs noted that, in such circumstances, operators should provide schools with robust notice about their data collection, use, and sharing practices, the revised FAQs suggest that these disclosures should track the direct notice requirements outlined in the COPPA Rule.  In COPPA FAQ M.1, FTC staff explains that “the operator must provide the school with all the required notices.”

• The FTC staff also provides additional guidance on the nature of the COPPA consent that operators should obtain from schools on behalf of parents.  In new FAQ M.2, the staff suggests that such consent should meet the same high standard as verifiable parental consent:  “Where an operator gets consent from the school rather than the parent, the operator’s method must be reasonably calculated, in light of available technology, to ensure that a school is actually providing consent, and not a child pretending to be a teacher, for example.”  It is worth noting, however, that the FAQ does not explicitly state that the school’s consent must be provided through one of the limited methods outlined in the COPPA Rule or approved under the new voluntary parental consent process.

• New FAQ M.3 addresses the scenario in which schools provide verifiable parental consent on behalf of parents and asks “Who should provide consent – an individual teacher, the school administration, or the school district?”  The staff recommends that, “as a best practice,” schools and school districts should decide which online services are appropriate for the school rather than individual teachers.

• New FAQ M.4 addresses the obligations of schools to notify parents when the schools provide the required verifiable parental consent.  The FTC staff states that, “[as] a best practice, the school should consider providing parents with a notice of the websites and online services whose collection it has consented to on behalf of the parent.”  This may include schools making available to parents the direct notices that they will receive from operators of websites and online services.

Although we do not expect further updates to the COPPA FAQs in the near future, we are continuing to track these developments.