Children’s Online Privacy Protection Act - FTC-Approved COPPA Safe Harbor Program

Swiss Digital Game Developer Settles FTC Allegations that it Falsely Claimed it was a Member of COPPA Safe Harbor Program

Republication

FTC, May 19, 2020

https://www.ftc.gov/news-events/press-releases/2020/05/swiss-digital-game-developer-settles-ftc-allegations-it-falsely?utm_source=govdelivery

A digital game maker has settled Federal Trade Commission allegations that it misled consumers about its membership in a program aimed at ensuring companies adhere to requirements of the Children’s Online Privacy Protection Act (COPPA).

In a complaint, the FTC alleges that Miniclip, S.A., a Swiss-based company that makes mobile and online digital games, falsely claimed it was a current member of the Children’s Advertising Review Unit’s (CARU) COPPA safe harbor program. Under the FTC’s COPPA Rule, companies are deemed in compliance with COPPA if they are a member and adhere to the guidelines of an FTC-approved COPPA safe harbor program, such as the Better Business Bureau’s CARU program.

The COPPA Rule requires companies that collect personal information about children under 13 to provide parents with notice of their collection practices and obtain verifiable parental consent.

“Consumers rely on companies to tell them the truth, especially when it comes to how they treat personal information about children,” said Andrew Smith, Director of the FTC’s Bureau of Consumer Protection. “When companies like Miniclip promise consumers that they are an approved participant of a safe harbor program even after they’re removed, the FTC will take action.”

Miniclip joined CARU’s safe harbor program in 2009 and remained a member until 2015, when CARU terminated Miniclip’s participation in the program. From 2015 through mid-2019, Miniclip falsely claimed on its website and on its Facebook games privacy policy page that it was a member of CARU’s safe harbor program, according to the FTC complaint.

As part of the proposed settlement Miniclip is prohibited from misrepresenting its participation or certification in any privacy or security program sponsored by a government or any self-regulatory organization, including the CARU COPPA safe harbor program. Miniclip is also subject to compliance and recordkeeping requirements.

The Commission voted 5-0 to issue the proposed administrative complaint and to accept the consent agreement with Miniclip. Commissioner Rohit Chopra issued a concurring statement. The FTC will publish a description of the consent agreement package in the Federal Register soon. The agreement will be subject to public comment for 30 days after publication in the Federal Register after which the Commission will decide whether to make the proposed consent order final. Instructions for filing comments will appear in the published notice. Once processed, comments will be posted on Regulations.gov.

NOTE: The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $43,280.

Related Case

Miniclip, In the Matter of

Related Actions

Statement of Commissioner Rohit Chopra Regarding Miniclip and the COPPA Safe Harbors

For Businesses

• Blog: Do your COPPA Safe Harbor claims hold water?
• Children’s Privacy

Children’s Online Privacy ; COPPA

FTC Approves Modifications to Video Game Industry Self-Regulatory COPPA Safe Harbor Program

FTC

August 14, 2018

Republication

https://www.ftc.gov/news-events/press-releases/2018/08/ftc-approves-modifications-video-game-industry-self-regulatory?utm_source=govdelivery

Children’s Online Privacy: COPPA: Privacy: Data: FTC:

The Federal Trade Commission approved changes to a video game industry self-regulatory program aimed at ensuring compliance with the Children’s Online Privacy Protection Act (COPPA) Rule.

The Entertainment Software Ratings Board (ESRB) applied for approval of proposed modifications to its COPPA safe harbor program. The FTC’s COPPA Rule requires, among other things, that operators of commercial websites and online services directed to children under the age of 13, or general audience websites and online services that knowingly collect personal information from children under 13, must obtain parental consent before collecting, using, or disclosing any personal information from children under the age of 13. The FTC’s COPPA Rule includes a “safe harbor” provision that allows industry groups and others to ask the Commission to approve self-regulatory guidelines that implement the protections of the Rule. Companies that comply with an FTC-approved safe harbor program are exempt from agency enforcement action under the Rule.

Earlier this year, the FTC sought comment on ESRB’s proposed changes to its COPPA safe harbor guidelines. For example, ESRB proposed changes to its definition of “personal information and data” in light of recently issued Commission guidance about collection of audio recordings.

The FTC received five comments from individuals and consumer advocates. For example, the Campaign for a Commercial-Free Childhood and the Center for Digital Democracy jointly recommended changes to ESRB’s proposal. Among their recommendations was that ESRB retain language from the existing program that defines street-level geolocation information as personal information and data, and include language that would make it a requirement – instead of a suggestion – to limit collection of “personal information and data.” Another commenter, the Electronic Privacy Information Center, called for other changes, including asking that the Commission reject a proposed change that would narrow ESRB’s definition of “child/children” to only U.S. residents. The revised guidelines approved by the Commission include a number of changes to address issues identified by commenters.

The Commission vote to approve the changes to ESRB’s COPPA safe harbor program was 5-0.

Children's Online Privacy

Children's Online Privacy: Privacy: Data security: Competition: Internet: Safe WEB Act.

FTC, Bureau of Consumer Protection, Jan. 8, 2018.

Electronic toy manufacturer VTech Electronics Limited and its U.S. subsidiary have agreed to settle charges by the Federal Trade Commission that the company violated a U.S. children’s privacy law by collecting personal information from children without providing direct notice and obtaining their parent’s consent, and failing to take reasonable steps to secure the data it collected. VTech will pay $650,000 as part of the settlement with the FTC.

In a complaint filed by the Department of Justice on behalf of the FTC, the Commission alleges that the Kid Connect app used with some of VTech’s electronic toys collected the personal information of hundreds of thousands of children, and that the company failed to provide direct notice to parents or obtain verifiable consent from parents concerning its information collection practices, as required under the Children’s Online Privacy Protection Act (COPPA). In its first children’s privacy case involving Internet-connected toys, the FTC also alleges that VTech failed to use reasonable and appropriate data security measures to protect personal information it collected.

COPPA requires that companies collecting personal information from children under 13 online follow steps to ensure that children’s information is protected, including clearly disclosing to parents the information it collects, how the information will be used, and seeking verifiable parental consent. Companies also must take reasonable measures to protect the confidentiality, security and integrity of the personal information they collect about children.

According to the complaint against VTech, the company collected personal information from parents on its Learning Lodge Navigator online platform, where the Kid Connect app was available for download, and also through a now-defunct web-based gaming and chat platform called Planet VTech. Before using Kid Connect or Planet VTech, parents were required to register and provide personal information including their name, email address as well as their children’s name, date of birth and gender. VTech also collected personal information from children when they used the Kid Connect app.

With respect to Kid Connect, VTech failed to provide direct notice of its information collection and use practices to parents and did not link to its privacy policy in each area where personal information was collected from children.

At the same time, the complaint alleges that the company did not take reasonable steps to protect the information it collected through Kid Connect, such as implementing adequate safeguards and security measures to protect transmitted and stored information and implementing an intrusion prevention or detection system to alert the company of an unauthorized intrusion of its network. In November 2015, VTech was informed by a journalist that a hacker accessed its computer network and personal information about consumers including children who used its Kid Connect app.

The FTC also alleges that VTech violated the FTC Act by falsely stating in its privacy policy that most personal information submitted by users through the Learning Lodge and Planet VTech would be encrypted. The company, however, did not encrypt any of this information.

In addition to the monetary settlement, VTech is permanently prohibited from violating COPPA in the future and from misrepresenting its security and privacy practices as part of the proposed settlement. It also is required to implement a comprehensive data security program, which will be subject to independent audits for 20 years.

The FTC collaborated with the Office of the Privacy Commissioner of Canada, which is releasing its own Report of Findings. To facilitate cooperation with its Canadian partner, the FTC relied on key provisions of the U.S. SAFE WEB Act, which allows the FTC to share information with foreign counterparts to combat deceptive and unfair practices that cross national borders.

The Commission vote authorizing the staff to file the complaint and stipulated final order was 2-0. The complaint and stipulated final order was filed in the U.S. District Court for the Northern District of Illinois.

NOTE: The Commission files a complaint when it has “reason to believe” that the law has been or is being violated and it appears to the Commission that a proceeding is in the public interest. Stipulated final orders have the force of law when approved and signed by the District Court judge.

Related Case

VTech Electronics Limited

For Consumers

• Blog: If your kids have electronic devices, read this
• Protecting Your Child’s Privacy Online
• FTC.gov/OnGuardOnline

For Businesses

• Blog: VTech settlement cautions companies to keep COPPA-covered data secure
• Children’s Privacy
• Data Security