Children’s Online Privacy Protection Act (COPPA)

Before collecting personal information from consumers, enterprises have to take into account certain data privacy and age verification regulations. This is important for developing mutual trust among both parties, the customer and the business, and ensure that user data is handled and processed in the right manner. Data protection is more significant when it comes to providing services to minors and collecting their Personally Identifiable Information (PII), which is why laws like COPPA came into effect.

What is the COPPA?

The Children’s Online Privacy Protection Act (COPPA) is a US federal law that protects the personal information of individuals below the age of 13. Enacted in 1998 by Congress, COPPA is regulated by the Federal Trade Commission (FTC). The minor protection act lists guidelines for merchants providing online services to seek consent from guardians and implement privacy protection policies. It also lists responsibilities for digital platforms to safeguard children’s personal information and restrictions for third-party distribution. 

When is COPPA Applicable?

The COPPA is designed specifically for consumers under a restricted age limit. Here are the key aspects and scenarios which determine when COPPA applicable:

• When a consumer of an online product or service is a US resident and is below 13 years of age
• US-based businesses are required to protect children given the COPPA requirements, although those operating outside the US are not legally obligated 
• COPPA aims at online privacy protection of minors but does not prevent profanity or instances like cyberbullying
• It applies to all kinds of online services, websites, mobile applications, e-gaming platforms, plug-ins (also those provided by third parties), IoT-enabled devices, and ad networks
• COPPA ensures considerable parental control towards the collection, removal, and disclosure of identity information of their children 

What is COPPA Compliance?

The Federal Trade Commission enforces COPPA compliance across the US. It makes sure that online service providers and website operators practice minor protection standards and create privacy policies as defined in the act. Personal data of individuals below 13 must be collected and processed keeping in view COPPA compliance guidelines. A non-compliance penalty for a COPPA violation can cost up to $43,792 depending upon the company’s financial standing. 

How can Businesses Comply with COPPA?

Perform the right audience analysis

Businesses need to determine whether their intended audience includes consumers below the age of 13 or if they collect personally identifiable information from anyone from this certain group of users. If the product is solely intended for minors or some features of the online service are directed towards children, the business must take appropriate measures to ensure compliance with COPPA requirements. 

Create lawful privacy policies

A mandatory requirement for COPPA-compliant entities is to develop a privacy policy that clearly defines how the identity information of children under the age of 13 is handled. The policy should also list a comprehensive description of parental rights and which PII is collected. 

Notify guardians before collecting PII

COPPA defines that service providers must acquire contact information of parents in order to get consent for collecting their child’s personal information. It also states that the business should clearly mention which PII will be collected and how will it be used later. Entities following COPPA guidelines are required to delete the contact information of parents in case they do not consent within a certain time limit. 

Take verifiable parental consent

The online service provider must take legal permission from a guardian through a consent form to use their child’s information. The consent could be provided through an email, an official ID document submission, or an online facial scan. 

Grant personal information rights

As per the COPPA guidelines, parents have the right to access PII of their children, revoke the consent or object to it, and request to delete their child’s information permanently. 

Define Data Protection Procedures

To protect the personal information of children below 13, COPPA requires businesses to take the following actions:

• Minimize the amount of PII collection
• Not hold PII unless it is necessary
• Safely dispose off personal information 
• Prohibit third-party access to PII

Suggested Reads:

Online Age Verification Service: Children’s Digital Privacy amid COVID-19
Online Age Verification Keeps A Tight Rein On Minors