As of September 2014, the Federal Trade Commission (FTC) has increased its activity in enforcing the Children’s Online Privacy Protection Act (COPPA). Between fines in the hundreds of thousands of dollars, a settlement with one of its third-party certification companies, and public reprimands coupled with demands for compliance, the FTC is making it clear that COPPA will be vigorously enforced. And the FTC is not alone, Google Play recently removed an application from its store because of a COPPA violation.

Because of the recent enforcement initiative, website and application operators who collect information from children should be familiar with COPPA and how to comply with the law.

What is COPPA?

COPPA, effective as of April 2000, requires more robust privacy policies of websites and applications directed at minors (those under 13 years of age). The act specifies what such privacy policies must detail, when and how to seek parental consent, and what the website or application operator must do to protect minors’ privacy and safety. The FTC has encouraged self-regulation of COPPA by granting “safe-harbor” classifications to companies that enforce the act and discipline violators before any FTC involvement.

Who needs to know?

Under the act, an operator is defined as “any person who operates a website located on the Internet or an online service and who collects or maintains personal information from or about the users of or visitors to such website or online service, or on whose behalf such information is collected or maintained, where such website or online service is operated for commercial purposes, including any person offering products or services for sale through that website or online service, involving commerce.”

To fall under the act, the website must be “directed at children,” which includes entire websites or portions of websites that “target” children.

What does COPPA require?

The act requires that an operator of a website or an online service with actual knowledge that it is collecting information from a child must (1) provide notice on its website that information is being collected from children, how the operator uses that information, and the operator’s disclosure practices for such information; and (2) obtain verifiable parental consent for the collection, use, or disposal of information collected from children.

The act also details the requirements for parental consent, prohibits certain conditional requirements of information beyond reasonable amounts, and requires the implementation of reasonable protective procedures by operators.

How to avoid COPPA violations

The best way for operators to avoid violating COPPA is to be familiar with its requirements and make sure they are in compliance. For application operators, this includes making sure all recycled source code complies as well—the FTC’s recent public warning of BabyBus was due to recycled code that the company did not know captured GPS locations.

Because the FTC is ramping up enforcement and levying large fines, and private distributors like Google Play are closely monitoring their own markets, it is important that website and application operators are familiar with, and in compliance with, COPPA.