How Video Game Companies Can Stay Out of the FTC’s Crosshairs: Avoid Inadvertent Violations of the Children’s Online Privacy Protection Act (COPPA)
Penalties for violating the Children’s Online Privacy Protection Act of 1998 (COPPA) can be extreme. COPPA is federal law that applies to the online collection of personal information about children under 13 years of age. Compliance can be tricky, even for sophisticated companies with in-house attorneys, and the repercussions for violating COPPA can be severe.
A court can hold operators who violate COPPA liable for civil penalties of up to $43,792 per violation and in some cases the FTC has sought millions of dollars in penalties. For example, in 2019 Google agreed to pay $170 million to settle allegations by the FTC and the New York Attorney General that YouTube illegally collected personal information from children without their parents’ consent in violation of COPPA. But it isn’t just big companies that have to worry—COPPA often applies to smaller online video games too.
Does COPPA apply to your company?
COPPA will apply if your website or online service is directed to children under 13 and you collect personal information from them. It will also apply if your website or online service is directed to a general audience, but you have actual knowledge that you collect personal information from children under 13.
It isn’t just about your company either—if you let others collect personal information from children under 13, then COPPA may apply to you as well. For example, COPPA will apply to you if you run an ad network or plug-in and you have actual knowledge that you collect personal information from users of a website or service directed to children under 13.
Here are a few key definitions and other things to keep in mind:
A “website or online service” is a broad term that includes most online video games, including mobile apps, internet-enabled gaming platforms, video games that use plug-ins or advertising networks, and even internet-connected toys.
Personal information can include:
first and last name
physical address (or geolocation information that can identify an address)
online contact information (e.g., email address IM identifier, etc.)
screen name or username
telephone number
Social Security number
a persistent identifier, like a cookie number, IP address, or device identifier
a photo, video, or audio file containing a child’s image or voice
Collecting information doesn’t have to be a mandatory part of the game or even something that the game encourages. For example, information collection includes the submission of information, even when it’s optional. You also collect information if you allow a child to publicly post information, for example, with an open chat or posting function. And passively tracking a child online counts as collecting information too.
COPPA applies to you. What now?
The Federal Trade Commission, which enforces COPPA, spells out what operators of websites and online services must do to protect children’s privacy and safety online. For example, you must:
Post a clear and comprehensive online privacy policy,
Give parents direct notice about your information practices and obtain their verifiable consent before collecting information from children under 13,
Allow parents to review collected personal information, revoke their consent, and delete their child’s personal information, and
Implement reasonable procedures to protect children’s personal information.
Sometimes, it’s dangerous to go alone! If you have questions about COPPA compliance or other privacy issues, please do not hesitate to contact us at (415) 868-6900 or contact@tyzlaw.com. Clients rely on our wealth of experience with privacy compliance, including COPPA issues, and our deep understanding of the video game industry so that they can focus on games, not regulations.
By Sean Apple & Rachel Waters