COPPA Safe Harbor: Understanding the Seals

The federal Children’s Online Privacy Protection Act (COPPA) allows industry groups to submit for Federal Trade Commission (FTC) approval self-regulatory guidelines that implement the protections for children outlined in the COPPA Rule. 

The BBB National Programs’ Children’s Advertising Review Unit (CARU) was granted Safe Harbor status under COPPA in 2000, which makes it the first and longest-running COPPA Safe Harbor Program in the U.S.

The FTC has been reviewing the COPPA Rule since 2019, and on December 20, 2023, it proposed changes to the COPPA Rule that would impact every COPPA Safe Harbor Program. Last week the CARU team published an explainer on these proposed changes.

CARU takes its COPPA Safe Harbor role seriously. The CARU certification process is thorough, including a comprehensive audit, findings assessment, and ongoing monitoring and support from the CARU Team. 

While the CARU team continues to review the FTC’s Notice of Proposed Rulemaking, we wanted to provide answers to some frequently asked questions about our COPPA Safe Harbor Program and explain the various safe harbor seal types.  

Comprehensive Audit

CARU’s comprehensive audit process includes a review of the product or service a company wishes to get certified. The process includes a data collection evaluation, tracking assessment, and document review. It is important to note that CARU’s processes take into consideration the uniqueness of each company, so its approach to each COPPA Safe Harbor participant is also unique, with individually created guidance and solutions based on the product being certified.

As an overview of the audit process, but not an exhaustive list:

• CARU evaluates a company’s data collection, use, and retention practices for compliance with COPPA and evaluates first- and third-party trackers, a company’s privacy policies, consumer notices, and terms of service or EULAs. 
• CARU performs a comprehensive review of the product or service to determine whether it is directed to children.
• CARU uses the FTC factors -- subject matter, visual content, use of animated characters, child-oriented activities and incentives, music or other audio content, age of models, advertising for and on the site directed to children, and any evidence about the intended audience -- to determine if the product or service is directed to children. Rarely would one single factor be determinative; rather, CARU makes this determination assessing the totality of the factors.

Findings Assessment

CARU provides a findings assessment upon completion of its comprehensive audit, which includes clear instructions and recommendations to achieve compliance with COPPA as well as resources, such as developer checklists. 

Once all issues are addressed and the product or service is compliant with COPPA, the CARU COPPA Safe Harbor seal is set in place and the certified company begins to receive ongoing support from the CARU Team, which includes personalized consultations, regular monitoring, and real-time alerts if issues with certified products or services are found, to ensure continued compliance with COPPA. 

The Seals 

What does the CARU COPPA Safe Harbor seal signify? More than anything else, it signifies trust. Before a company can display our seal on any of its products, it must undergo the holistic and comprehensive audit process evaluating each facet of a product and address any issues found.

It is important to understand that companies don’t need to have a primarily child audience to participate in a COPPA Safe Harbor program, and a COPPA Safe Harbor seal does not necessarily indicate that a site or service is appropriate for children. 

Companies that sell products or have content appealing to children, companies that have a portion of their service directed to children (but children are not the primary audience), and companies whose services are not intended for children but still want to go above and beyond to protect any child visitors of their online services can and do participate in the CARU COPPA Safe Harbor program. 

Because participants of our Safe Harbor are getting certified for different reasons, we have a suite of seals to accommodate those needs. 

General Audiences

The General Audiences COPPA Safe Harbor seal is designed for companies whose online services are not directed to children but who want to build consumer trust in their products or services. CARU assesses the site or service to assure it is not directed to children, and then assesses what kind of information these companies have about their users to validate that the companies do not have actual knowledge that children are using their online services or products. CARU ensures that, to the extent companies gain actual knowledge that children are on their website or using their services or products, those companies have a process in place to delete that data immediately or to obtain verifiable parental consent. 

Some companies that participate in the CARU COPPA Safe Harbor Program may have products or online services that appeal to children or younger teens, or they may be a B2B company with end-users who are children, but the company itself does not interact with or collect data from end-users. Because of this appeal or downstream interaction, the CARU team works with these companies to help them assess the age of their audience as well as their privacy and data collection practices.

For example, Brand X, a confectionery company, has products that may appeal to children, such as candy. However, Brand X and its online services are not primarily directed or designed to interact with children. To determine the appropriate audience designation, CARU looks to the COPPA factors such as subject matter, visual content, use of animated characters, child-oriented activities and incentives, age of models, presence of child celebrities or celebrities who appeal to children, and whether advertising promoting or appearing on the website or online service is directed to children. 

A thorough analysis of Brand X’s product sites and online services shows the subject matter displays candy bars and other treats, recipes and history about the brand, nutritional and allergy information, and a career page. The visual content of the site features photos of the candy products, ingredients, and photos of children and adults in a familial context while enjoying Brand X’s products. There are no child celebrities or celebrities that appeal to children featured on the site, no animated characters, and there are no interactive activities or incentives directed to children. Additionally, the advertising featured on the site is for Brand X’s candy products and merchandise such as clothing, is not directed to children.

Based on the FTC factor analysis, the audience designation is general audience and a General Audiences COPPA Safe Harbor seal is the most appropriate. During its certification process, CARU ensures that should Brand X become aware that children under 13 are on its website or using its services or products, it has policies and procedures in place to delete that data immediately or to obtain verifiable parental consent. 

Child-Directed Audiences

The Child-Directed Audiences COPPA Safe Harbor seal is for companies who intend for their product or online service to be directed to children. These can include toy sellers, online game developers, candy companies, or online platforms designed for children, among others. CARU works with these companies to help them limit the data collected from children, guide them on their parental consent process when appropriate, draft clear disclosures for children and parents, include parental settings and tools, and serve appropriate contextual advertising. 

For example, Brand Y, a candy company, has products and online services primarily directed to children. An analysis of Brand Y’s online services, based on the COPPA factors outlined above, shows that the site features fun and simple games and activities based on its candy products, contains animated characters and bright colors, and even has an advertising disclosure that speaks to kids, i.e. “Hey Kids! This is Advertising!”  

There is no option for users to purchase anything from the kids’ site. The bottom banner of the kids site contains a link to a Parent Site that takes parents to the candy company’s parent company site. Users who click on the Parent Site link are shown a bumper page indicating that users are leaving the kids’ site. The Parent Site does not contain any content that is attractive to children and contains information about Brand Y’s parent company, nutritional information about the products, and a Careers page with open job opportunities. The Parent Site also offers a “Buy Now” option that was not available on the kids’ page.  

Based on the above factors, Brand Y’s kids’ site products and online services are primarily directed to children. As such, the Child-Directed Audiences COPPA Safe Harbor seal is the most appropriate.

Mobile Products

The Mobile Products COPPA Safe Harbor seal is specifically for companies that wish to certify an online product or service that is only available on a mobile device, i.e., a mobile app. CARU does a deep dive to address issues specific to mobile products in its assessment process and helps companies address the complex SDK/API data collection issues mobile app developers face. 

Connected Products

The Connected Products COPPA Safe Harbor seal is designed for companies that wish to certify a connected product. These include companies that sell smart watches, TVs, and toys. The CARU team helps companies address cross-device tracking issues, first- and third-party advertising issues, and privacy issues that arise in the Internet of Things (IOT) context in its assessment. 

More Questions?

A CARU COPPA Safe Harbor Program seal reflects a company’s dedication to its customers' privacy and to maintaining high standards in privacy and data collection practices relating to children. Through the proud display of its seal, a company indicates that it takes the protection of children’s information online seriously, helping to assure families that a product is privacy-safe for their children to use.  For clarity, a COPPA safe harbor seal should not be deemed as an indication of whether an online service’s content is appropriate for children under 13. 

If we didn’t address your questions here, use our Safe Harbor contact us form to learn more about the CARU COPPA Safe Harbor program.