COPPA, or the Children's Online Privacy Protection Act, is an American data protection law that was designed to protect children under the age of 13.
Prior to the introduction of COPPA, online privacy laws treated everybody the same, regardless of their age. Under the Act, additional protection is offered to minors.
So how does COPPA work and is it actually effective?
Why Was COPPA Created?
COPPA was created in 1998 but it didn't become law until 2000. It was originally passed in response to the fact that more and more internet marketing techniques were starting to target children.
At the time, most websites didn't have privacy policies. And the websites targeting children were therefore collecting personal information without consent. Experts also argued that children weren't capable of granting consent because they were unable to understand how such information could be used against them.
Under the Act, if a company now wants to collect the personal information of a child, they must first obtain parental consent.
Who Is Subject to COPPA?
According to the FTC, you are subject to COPPA if any of the following are applicable to you:
- You own a website or web service that is targeted towards children under the age of 13 and you collect personal information about them.
- You own a website or web service that is targeted towards a general audience but you have actual knowledge that you collect personal information about children under the age of 13.
- You own an ad network and you collect personal information about users who visit a website or web service that is targeted towards children under the age of 13.
What Is COPPA Compliance?
In order to be considered COPPA compliant, there are a number of rules that all companies are required to follow.
These rules include:
- Prior to collecting the personal information of children, companies are required to post a clear privacy policy explaining exactly what data is being collected. This page must also include a notice that parental consent is a legal requirement for doing so.
- Prior to collecting the personal information of children, companies are required to obtain verifiable consent from their parents. For example, the parents might be required to sign a consent form or answer knowledge-based questions
- Parents must be given the option to revoke their consent at any time. And the method for doing so must be clearly explained.
- If a company wants to collect the personal information of children, they must implement procedures for preventing that data being stolen or kept longer than is necessary. The same rule applies to anyone who subsequently takes possession of the data.
Do Websites Adhere to COPPA?
Prior to the introduction of COPPA, most websites didn't take the data privacy of children very seriously. This is because there was no real consequence for failing to do so.
When the Act was passed, many websites were forced to completely rewrite their data collection policies. The majority of websites that receive visitors under the age of 13 are now COPPA compliant. Many websites also don't allow users under 13 because of the Act.
According to the FTC, if a company fails to meet the requirements of COPPA, they can be fined up to $43,280 per incident.
Despite the potential for expensive litigation, some companies do ignore COPPA. Evidence of this can be seen in the number of high profile cases that have occurred.
Companies that have been prosecuted under the act include Yelp who were fined $450,000 in 2014 and TikTok who were fined $5,700,000 in 2019.
Does YouTube Adhere to COPPA?
Arguably the biggest effect of COPPA can be seen when you visit YouTube. In 2019, the FTC ordered Google to pay a fine of $170,000,000. This is the largest fine ever collected under the Act and the settlement included an agreement on Google's part to make widespread changes to the platform.
At the time, the FTC claimed that Google was knowingly collecting the personal information of children without obtaining parental consent.
Under the new rules, all content creators are asked whether or not their content is targeted towards children. This question can be answered on a per-video or a per-channel basis. If a video or channel is labeled as targeted towards children, YouTube now collects significantly less personal information from its viewers.
This applies regardless of a user's age.
As a result of the change, both YouTube and the creators of content that targets children experienced a significant drop in advertising revenue. YouTube is heavily monetized by targeted advertising. And targeted advertising is largely impossible without collecting personal information.
Criticism of COPPA
But COPPA has not been without criticism. Critics of the act have labeled it as both unconstitutional and ineffective.
It's considered unconstitutional because many websites now prevent users under the age of 13 from signing up. It's argued that this can prevent such users from exercising their right to free speech.
It's considered ineffective for various reasons, including:
- The language of the Act is ambiguous and therefore open to interpretation. For example, it's often debatable whether or not a website actually targets children. This sometimes makes it difficult to prosecute.
- Some of the mechanisms used to obtain parental consent are easy to fabricate. Many users simply lie about their age.
- When a website prevents a child from signing up, it's argued that they are likely to go to another website that potentially carries more risk.
- When the Act was first written, the internet was a very different place. YouTube, for example, didn't even exist. Despite this fact, very few changes have ever been made to COPPA.
Is COPPA Effective Enough?
The problems associated with online data collection are now well known. And the introduction of COPPA was an important first step in protecting those under the age of 13 from them. The internet is a safer place for children because of the Act.
Despite these facts, there's also no denying that the Act is not as effective as it could be and probably should be. If it were, there wouldn't be so many high profile cases. And to this day, some websites still ignore it without consequence.