COPPA for App Developers

Jan 28, 2020, 11:00 AM by BBB National Programs

Are you an app publisher looking to make it big with that addictive new game you’ve come up with? Does your imagination spawn brilliant, colorful worlds that are the perfect setting for that mobile app game? Are you looking at ways to monetize your new app with different types of third-party data collection, including interest-based advertising? If you’ve answered “yes” to at least one of these questions, you might want to think about your obligations under the Children’s Online Privacy Protection Act of 1998, also known as COPPA.

What is COPPA?

COPPA is a U.S. privacy law that governs when and how different platforms are allowed to advertise to children (13 and under) online. The law includes some strict requirements that are important to be aware of and understand if you work in mobile app development. Basically, the law outlines when you or your third-party partners are allowed to collect personal information (PI) from children through your app or website.

How does COPPA define personal information?

Broadly speaking, PI under COPPA is any type of information that can identify an individual. This definition includes not only name, home address, screen name, and phone number, but also covers persistent identifiers, such as HTTP cookies or mobile device identifiers, which are technologies commonly used to facilitate interest-based advertising.

So, what are the rules?

Under COPPA, companies must obtain verifiable parental consent when they 1) allow the collection of PI from children they have actual knowledge are under the age of 13, or 2) allow the collection of PI on apps or websites that are child directed. Verifiable parental consent means permission from a parent for the collection of PI, which can be obtained through means such as a consent form, a credit card, answering knowledge-based questions, or providing a copy of a parent’s ID.

What do you mean by child directed?

What does child directed mean? It depends! The term “child directed” turns on legal interpretations of COPPA set out by the Federal Trade Commission (FTC), the U.S. government agency in charge of watching the marketplace for unfair and deceptive advertising practices. Under the FTC regulations, whether an application is child directed or not is based on a multi-factor test, which covers:

  • Subject matter
  • Visual content
  • Use of animated characters
  • Use of child-oriented activities or incentives

Back in 2014, the FTC applied this legal test in its TinyCo settlement. In that case, the FTC stated that a company’s mobile apps were child directed because they “appeal[ed] to children by containing brightly-colored, animated characters… and by involving subject matters such as a zoo, tree house, or resort inspired by a fairy tale.”

Critically, COPPA imposes strict liability on the owners and operators of child-directed services where third parties collect PI. This precludes app publishers from disclaiming data collection practices in their privacy policies with respect to children under the age of 13, and from disclaiming responsibility for the actions of third parties collecting on its app or website.

So, if you’re publishing a fantasy game app that might involve particularly cute, cuddly animal characters in a colorful environment, be careful! Your app might be considered child directed, and therefore you may have to get verifiable parental consent before being allowed to collect any data.

What if my app isn’t meant just for kids?

COPPA allows the designation of some child-directed apps as “mixed-audience” when the app does not target children as its primary audience but nonetheless “attract[s] a substantial number of children under 13.” In these circumstances, COPPA allows app publishers to use an age screen to flag users under the age of 13 so they can prevent their third-party partners from collecting PI, obtain parental consent prior to the collection of PI, or point the kids to content that doesn’t involve the collection or use of PI.  Essentially,  even if your app doesn’t target under 13-year-old kids as its primary audience and focuses on older teenagers, if the app is considered mixed audience, you still have to comply with COPPA.

So, let’s say you have a roleplay game app that you want to monetize with interest-based advertising that has a whimsical environment with animated characters. Your game, though intended by you for older teenagers, may attract under 13-year-old kids based on its content. In that scenario, you can add an age screen where users enter the year they were born. If users enter an under-13 age, you can engineer your app to halt data collection for targeted ads.

Do I have to follow these rules all the time? Are there any exceptions?

COPPA does list several exceptions that outline instances where verifiable parental consent for the collection of PI is not needed. A key exception is “support for internal operations.” App developers frequently showcase their mobile apps on their own websites in addition to listing them on the various app stores. Customers can even purchase licenses for apps through some of these sites. If your showcase website is setting and requesting HTTP cookies to maintain payment or delivery functions, these internal operations don’t require verifiable parental consent.

Other exceptions for COPPA cover scenarios that don’t involve the automatic collection of data from kids. For example, if the child is providing you with information that is only used to respond to a one-time request, you don’t need to get verifiable parental consent. Finally, if you’re responding to actions you must take as result of a court order, you also don’t need to get verifiable parental consent.

What else should I be looking out for?

You can work with BBB National Programs’ Children’s Advertising Review Unit, a designated COPPA Safe Harbor, to help come into compliance with the law! If you have a range of apps that you’re publishing that you’re considering monetizing with interest-based advertising, please also reach out to the Digital Advertising Accountability Program about complying with the Digital Advertising Alliance’s best practices for data privacy and interest-based advertising, which also incorporate COPPA’s child-protective rules. 

Other Blog Articles

Blog

Harmful Stereotyping in Advertising Must Not Be a “Forever Problem”

Though the annual celebration of Black History Month is drawing to a close, the plethora of issues raised by the study of Black history must always remain top of mind. For those of us who work in truth in advertising at BBB National Programs’ National Advertising Division (NAD), we are paying very close attention to the issues of diversity and stereotyping, as presented in various forms of advertising. Developing a mechanism to addressing representation in advertisements would not be simple, but the time is now to start the conversation. Harmful stereotypes in advertising must not be a forever problem.
Read more
Blog

5 Tips for Truthful and Transparent Influencer Marketing and Product Reviews

BBB National Programs’ National Advertising Division is dedicated to truth-in-advertising. To help you ensure that influencer marketing and the use of product reviews in your advertising is both transparent and truthful, we offer the following five tips.
Read more
Blog

In 2021, Consumer And Stakeholder Privacy Is About Defining Trust

As business and nonprofit leaders navigate the Fourth Industrial Revolution, consumer and stakeholder privacy has become a matter of defining trust. As new digital services and connected devices fueled by personal data flourish, consumers’ reasonable expectation of privacy shifts. If expectations do not match reality, it can lead to gaps in trust and new paths for litigation and regulatory enforcement. In this piece I outline a few 2021 privacy developments business and nonprofit leaders should note.
Read more
Blog

Broadening the Definition of Express and Implicit Representation in Children’s Advertising

One way to gauge exactly how far we have come in implementing diversity and inclusion is by analyzing what we see on our screens, particularly in advertising. The Children’s Advertising Review Unit (CARU) recognizes the special vulnerabilities of children with their limited knowledge, experience, sophistication, and maturity and often places itself in children’s shoes to gain insight when assessing the role advertisement has in shaping their perception.
Read more