Delve into the Children's Online Privacy Protection Act (COPPA) and the COPPA Rule to grasp how it safeguards children's online privacy. Learn about the requirements for businesses, potential updates, and the significance of COPPA Safe Harbor Programs.
Children are the most vulnerable group of internet users. It comes as no surprise that we are witnessing the rise of privacy laws aiming to protect children from businesses that process their personal data and target them with content or products.
The youngest members of society become internet users at a very young age nowadays, so there is no shortage of online services directed at children. These services often collect children's data, and that's inherently a threat to children's privacy and safety online.
Data protection laws such as the California Consumer Privacy Act (CCPA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), and a few other data privacy laws of the US states prescribe stricter requirements for the processing of personal information from a child.
Explore more privacy compliance insights and best practices
However, there is an often overlooked law that prescribes a set of rules that every business processing data on US children must conform to. That's the Children's Online Privacy Protection Act of 1998.
The Children's Online Privacy Protection Act (COPPA) is a US federal law that has been designed to protect the online privacy of children under the age of 13. It aims to regulate the collection and use of personal information from children on the internet and provide parents with controls on how their children's personal information is being processed.
The Act was passed in 1998 and came into force in 2000. Having in mind the global reputation of the US data privacy landscape, the mere existence of the COPPA surprises many businesses.
The COPPA was created to give parents more control over the online collection of personal information from their children. That includes a requirement for operators of child-oriented websites and services to obtain verifiable parental consent before collecting any personal information from children, to implement adequate security safeguards, to include a privacy policy on the websites, and other obligations that we'll dive deeper into further in this article.
Unlike the state privacy laws, the COPPA applies to all businesses that are directed at children under 13 years old or knowingly collect information from them. This includes websites, apps, and online platforms. There are no exclusions based on revenue thresholds or the number of users.
Amendments and Updates: COPPA has seen updates over the years to adapt to changes in technology and the online landscape. These updates have expanded its scope to include newer forms of online tracking and data collection.
The Federal Trade Commission can take legal action in the case of non-compliance and issue penalties for COPPA violations. The Children's Online Privacy Protection Rule helps them enforce COPPA compliance.
The Children's Online Privacy Protection Rule (COPPA Rule) is a set of regulations developed by the Federal Trade Commission (FTC) to implement and enforce the provisions of the Children's Online Privacy Protection Act (COPPA). The COPPA Rule provides specific guidelines and requirements for operators of websites, online services, and mobile apps that collect personal information from children under the age of 13.
The COPPA sets out the legal framework for processing the personal information of children. The COPPA Rule specifies the specific standards that businesses must meet in order to comply with the law and avoid trouble with the FTC.
When we combine the COPPA requirements and the COPPA Rule standards developed by the FTC, we get the following COPPA requirements from any website or online service that knowingly processes kids' data:
If you already comply with US state privacy laws, such as the CCPA, you may already comply with COPPA.
The COPPA Safe Harbor programs are mechanisms that allow certain organizations to seek "safe harbor" from some of the specific requirements and liabilities under COPPA while still demonstrating their commitment to protecting children's privacy online.
The FTC maintains a list of Safe Harbor programs. If you apply it to your operations, you are eligible for it.
Your chosen program comes with a set of data protection guidelines that you must implement when handling information from children under 13. You can choose one that is suitable for your industry. Compliance with the guidelines leads to certification, which further builds trust among your users.
The FTC will oversee your compliance with your chosen Safe Harbor program.
As of now, COPPA is the only US federal law requiring websites and online services to protect personal information collected from children.
The consumer privacy laws of the US states include provisions on children's data, but that's often in line with the COPPA requirements, so there is nothing new there.
However, the COPPA may soon be updated. The Protecting Kids on Social Media Act, also known as COPPA 2.0, has been introduced in the legislative bodies recently and, in this version or another, may be passed into law soon.
The Protecting Kids on Social Media Act is a federal privacy proposal aimed at regulating the relationship between young people and social media. It aims to:
The Federal Trade Commission and state attorneys general would carry out enforcement, with civil penalties for violations.
While some of the proposed provisions of this act seem like a long shot, several US states also prepare their own regulations regarding children's online activities.
