"Actual Knowledge" Language in COPPA Places Interactive Web Sites at Risk of Non-compliance
The Children's Online Privacy Protection Act (COPPA), which prohibits website operators from collecting personal information from a child under age 13 without parental consent, has been around for a little over a decade. (fn1) However, because it believes sufficient time has passed for website operators to become aware of and compliant with the rules, the Federal Trade Commission has started imposing higher penalties on violators. In its most recent COPPA enforcement action, against Sony BMG Music Entertainment, Sony agreed to a $1 million fine as part of its settlement with the FTC. .
A brief excursion around the Web suggests that most popular sites appear to attempting to comply with COPPA. Common techniques, for interactive sites that don't want to deal with the hassle of obtaining parental consent, are to post a policy stating that submissions from persons under age 13 will not be accepted, and/or to require users to provide their birth date before being allowed to begin a registration process that allows access to a site.
However, these exclusionary techniques can be easily circumvented. It is no difficult feat for an enterprising 11 or 12 year-old to falsify her birth date in order to gain access to a social networking site. Once on the site, it would not be surprising if that 11 or 12-year old then posted information that provided her true age -- such an account of her birthday party, or pictures from her school yearbook, showing her to be in the 5th grade and listing her actual age. Part of the very purpose of social networking sites is facilitate the exchange of such personal information. This creates a potential COPPA compliance problem for the website operator.
COPPA rules provide that "It is unlawful for an operator of a website or online service directed toward children or any operator that has actual knowledge that it is collecting personal information from a child" to collect information that violates COPPA rules. (fn2) If a COPPA case went to trial, whether a defendant had actual knowledge would likely be based on the jury's assessment of all the relevant facts and circumstances, not just the defendant's statements that it had no personal knowledge. (fn3) Moreover, knowledge of a corporate defendants' employees would likely be charged to the corporation itself.
This means that if evidence of the presence of personal information from children under age 13 were sufficiently prevalent on the site, or were known to individual employees, the website operator could well find itself being held in violation of COPPA. This -- despite the operators' good-faith efforts to exclude children from entry into its site.
Social networking sites that permit the uploading of personal information are becoming ever-more popular -- and increasingly attracting the attention of legislators and regulators. Operators of interactive websites that allow uploading of personal information would be well-advised to consider whether they need to change their systems, or adopt a "safe harbor" program, to avoid this "actual knowledge" trap.
David D. Johnson is a business lawyer whose practice focuses on issues relating to digital media and consumer electronics companies. David can be contacted at (310) 785-5371 or DJohnson@jmbm.com.
Notes:
Fn1 15 USC §6501-6505; 16 CFR § 312.
Fn2 15 USC § 6502(a)(1).
Fn3 See, e.g., Pimental v. Ltd. Canadian Pacific Bul, 965 F.2d 13 (5th Cir. 1992). There are no regulations or case law specifically interpreting "actual knowledge" as applied to COPPA.
