In December 2012, the Federal Trade Commission (FTC) adopted final amendments to the Children's Online Privacy Protection Act (COPPA) Rule, which regulates how companies may collect information online from children under 13.  Last month, the FTC also issued an updated set of Frequently Asked Questions regarding the revised COPPA Rule.  The revised COPPA Rule went into effect today, July 1, 2013, and will impact "operators" of certain websites and online services for a long time to come.  In particular, the revised COPPA Rule will likely impact you and your business if:

• You collect personal information from children under 13 via a website or an online service that is primarily directed at children under 13.  Note, this could include websites, mobile applications and other online services that allow users to play online games, engage in social networking and/or purchase goods or services.
• You collect personal information from children under 13 via a website or online service that is directed at teenagers or adults but that may attract a substantial number of children under 13 as a secondary audience.
• You operate a website or online service that is directed at a general audience (as opposed to children), but you have actual knowledge that you collect personal information from children under 13 (e.g., by asking for age information as part of your account registration process).
• You allow third parties (e.g., advertising networks and/or operators of plug-ins) to collect personal information from children under 13 through your website or online service.
• You operate an advertising network or a plug-in and have actual knowledge that you are collecting personal information from children under 13 through a third party's website or online service.

To determine whether a website or online service is directed at children under 13, the FTC will consider a variety of factors, including, without limitation, subject matter, visual content, use of animated characters or child-oriented activities and incentives, music or other audio content, age of models, presence of child celebrities or celebrities who appeal to children, language and other relevant characteristics.

Individuals and businesses that qualify as "operators" and fall within the scope of the revised COPPA Rule are required, with some limited exceptions, to provide notice of their information collection practices to parents of children under 13 and obtain verifiable parental consent prior to collecting, using or disclosing personal information from such children.  In addition, the revised COPPA Rule strengthens the data security protections that operators are obligated to provide and requires them to take reasonable steps to ensure that any service providers or other third parties that have access to personal information from children under 13 are capable of maintaining the confidentiality, security and integrity of such information.

Operators who violate the revised COPPA Rule can be liable for civil penalties of up to $16,000 per violation.  In addition to the FTC's enforcement authority, states and certain federal agencies (such as the Office of the Comptroller of the Currency and the U.S. Department of Transportation) have the authority to enforce COPPA compliance with respect to individuals and entities over which they have jurisdiction.  The FTC declined a request submitted by trade associations that would have allowed for more time before the revised COPPA Rule went into effect, stating that there had already been sufficient time for operators to come into compliance with the revised COPPA Rule.  Further, although the FTC has been telling concerned companies that it is not going to enforce the revised COPPA Rule immediately, this does not mean that the FTC will not be asking questions.  Companies may see requests for information, access letters or civil investigative demands about their COPPA compliance efforts or for information that will help the FTC determine whether a particular website or online service is directed at children under 13. 

There is no doubt that the revised COPPA Rule changes the landscape for publishers, application developers and social media.  The months ahead will determine whether this change is radical.

For more information regarding the revised COPPA Rule, please see:

• Federal Registrar Notice of the revised COPPA Rule, available here.
• FTC, Complying with COPPA: Frequently Asked Questions, available here.
• Perkins Coie LLP, Client Update: FTC Expands Scope of Children's Privacy Law to Keep Pace With New Technologies, available here.

If you think that you or your business may be impacted by the changes to the COPPA Rule, please contact counsel immediately.

© 2013 Perkins Coie LLP