Apps Developers: Please Pay Attention to the New Amendments to COPPA

This blog’s mission is to summarize the recent amendments to the Children’s Online Privacy Protection Act (COPPA), a federal law that regulates whether and how website owners as well as mobile apps developers can use personal information collected from children under the age of 13. Interestingly, according to The Wall Street Journal’s study, apps and websites that target children tend to collect more tracking data than any other websites or apps. The WSJ compared 50 popular sites for teens and children with the 50 most popular sites generally aimed at adults, and found that the sites targeting kids placed 30% more cookies, beacons and other pieces of tracking technology than the sites targeting the adults.

So, what are the new amendments to COPPA that affect apps?

• The definition of “personal information” has been expanded to include photos, videos, voice recordings, the IP addresses and the geo-location data, in addition to name, address and phone numbers. Such personal information cannot be collected from children under the age of 13 without parental consent; 
• Data received by apps cannot be shared with third parties unless the third parties are “capable of maintaining the confidentiality, security and integrity of such information”; 
• Collecting certain tracking processes, such as cookies, usernames, IP addresses and device IDs also require parental consent (but no consent is needed if the collected data is used only for internal purposes, such as ensuring functionality of the app, personalizing its content, offering contextual advertisements, authenticating users); 
• Interactive features in the apps, such as integration with social networks, are allowed so long as such third party networks do not collect and share information in violation of COPPA; 
• Parents can now provide their consent in a variety of ways, including electronically scanned consent forms, video-conferencing, emails accompanied by a PIN or password, and toll-free numbers they can call to answer consent questions (obtaining valid parental consent, however, is likely the most confusing aspect of complying with COPPA since the consent must meet certain criteria to be valid. The exact criteria, however, have not been disclosed by the FTC); 
• App stores and app download platforms are exempted from complying with COPPA and therefore don’t have to confirm that apps for sale are in compliance with COPPA. 

According to The New York Times, small apps developers will be affected the most by these amendments. Previously, many small app developers were able to comply with COPPA by outsourcing data collection, often free of charge, to advertising networks and analytics companies. The new COPPA, however, makes app developers primarily liable for inappropriate or illegal data collection processes by such third parties. In practice, it means that the app developers have to notify parents of data collection practices of every third party whose services are integrated into the app and obtain parental consent. This greatly increases compliance burdens on the small apps developers that often operate on a tight financial budget. Additionally, if the small developers continue outsourcing their data collection practices to the analytics companies, they will have to limit such companies’ use of the collected information in compliance with COPPA, which may provide a disincentive for the analytics companies to collect and analyze data free of charge.

So, what can children’s apps developers do now to comply with the new rules? They can stop collecting any personal information from children unless it is for strictly internal use (which may negatively affect the monetization of their apps). Alternatively, they can target their apps to teenagers who are older than 13 (thus avoiding COPPA). Finally, they can increase the price of their apps to account for the increased legal and compliance costs associated with obtaining parental consents and providing adequate disclosure regarding the data collection practices of the apps and their affiliates.

In any case, it is highly advisable for the apps developers to have a well-written privacy policy that accurately describes data collection and data use practices of the app and its partners. It is also helpful to bring any unusual or important data collection practices to the attention of the parents through special notices.

Some argue that the amendments may already be ineffective and outdated. For example, it is widely believed that children can get around privacy protections by simply misrepresenting their age. While app developers play a part in enforcing privacy policies, parents should be the ones ultimately bearing the burden of policing their children’s online behavior and the amount of information they reveal while playing the apps. Parents should use device controls such as location blocking and privacy management settings on their mobile devices to limit access to theirs and their children’s private information.

Compliance with COPPA is by far the most important legal aspect of apps development that developers should be aware of if their apps are targeting children. Failure to comply can result in costly lawsuits. Earlier this month, an apps developer Path, Inc. settled with the FTC for $800,000 for inappropriately acquiring personal information from children. Path's app allowed users to share their journals that included photos, thoughts or their location with up to 150 people. Path collected personal information from users’ mobile address books without disclosing such collection practices or obtaining parental consent. The FTC said that the app had been downloaded over 2.5 million times and that Path allowed the registration of approximately 3,000 users whose birth dates showed that they were under 13. Aside from having to delete all personal information relating to children, Path also agreed to implement a thorough privacy program and to obtain privacy audits from a third party. Path’s alleged practices are now subject of a putative class action lawsuit in the Northern District of California.

This article is not a legal advice, and was written for general informational purposes only.  If you have questions or comments about the article or are interested in learning more about this topic, feel free to contact its author, Arina Shulga.  Ms. Shulga is the founder of Shulga Law Firm, P.C., a New York-based boutique law firm specializing in advising individual and corporate clients on aspects of business, corporate, securities, and intellectual property law.

Food Marketing to Children: FTC Report Paints a Positive Picture But There is Still Room for Improvement

One of the reasons why many parents strictly regulate their kids’ TV time is because of the advertising that the kids see on TV. A majority of the TV ads are about food, and they typically do not include the healthiest food choices. In the country where obesity among children has reached an alarming peak, watching TV is like gaining extra calories. According to the Center for Disease Control and Prevention, 18.8% of American children ages 6-11 were obese in 2003-2004, as compared to only 4% in 1971-1974. It is scary to imagine what the obesity rates are right now, in 2013. But it seems that nowadays the food and beverage industry is taking steps to remedy the situation by providing and marketing healthier food choices. On December 20, 2012, the Federal Trade Commission (the “FTC”) released a report titled “A Review of Food Marketing to Children and Adolescents: Follow-Up Report,” where it identified certain positive trends. This is their second report on the same topic, and is based on the 2009 data (as compared to the first report that was based on the 2006 data).

According to the Report, total spending on food marketing to youth dropped 19.5% in 2009, to $1.79 billion. This, of course, still seems like an extraordinarily big figure. There has been a big shift in the placement of youth-directed food advertising. Spending on TV advertising fell 19.5%, while spending on new media, such as online and viral marketing, increased by 50%! This means that parents need to closely monitor not only their kids’ TV time, but also their online exposure to food ads. And there is a good reason for it. Incredibly, in 2009, 72% of the total food advertising money was spent on fast foods, carbonated beverages and breakfast cereals. So, the rest of the food (such as veggies, healthy snacks, fish, meats, eggs, yogurts, milk, beans, etc.) all together got marketed with only 28% of the revenue, which seems unevenly low. Looking at the bright side, drinks marketed to children and teens were slightly lower in calories in 2009 than in 2006 (although they still averaged more than 20 grams of added sugar per serving!). Also, fast food marketed to children and teens was lower in calories, sodium, sugar and saturated fat in 2009, compared to 2006. Actually, kid’s meals in fast food restaurants were more nutritious than other meals and main dishes directed to children ages 2-11. Additionally, marketing to children of cereals with 13 g of sugar or more per serving was eliminated.

I cast my hopes on the self-regulatory efforts of the food and beverage industry. The industry has made a lot of progress in the last several years in terms of marketing healthier products to kids primarily in response to First Lady Michelle Obama’s Let’s Move! campaign and the FTC’s earlier report on the same issue. Self-regulatory initiatives are mainly spearheaded by organizations such as the Children’s Food and Beverage Advertising Initiative (the “CFBAI”) and the Alliance for a Healthier Generation. The CFBAI has recently experienced an increase in membership, so now all, or nearly all, children’s marketing in many food categories is covered by their program that aims to introduce further improvements in the nutritional quality of foods marketed to children. Current members include the giants of the food and beverage industry, such as Burger King Corp., Campbell Soup Company, The Coca-Cola Company, Kraft Foods Gorup, Inc., Mars, Inc., McDonald’s USA, ConAgra Foods, Inc., The Dannon Company, General Mills, Inc., Nestle USA, PepsiCo, Inc., Post Foods, LLC, The Hershey Company, Kellogg Company, Hollshire Brands, Unilever United States.

Perhaps, what we really need to change is not which foods and drinks are advertised to our kids but the overall quality of food that is produced and consumed in the United States. Changing our consumer preferences away from the fast foods, carbonated beverages and sugary cereals and towards healthier choices may prompt the food and beverage industry to advertise healthy foods to us and our children. After all, the law of economics says that it is the consumer demand that determines the supply.

This article is not a legal advice, and was written for general informational purposes only.  If you have questions or comments about the article or are interested in learning more about this topic, feel free to contact its author, Arina Shulga.  Ms. Shulga is the founder of Shulga Law Firm, P.C., a New York-based boutique law firm specializing in advising individual and corporate clients on aspects of business, corporate, securities, and intellectual property law.

FINRA Takes Steps Towards Implementing Crowdfunding Portals

On January 10, 2013, FINRA issued a call to all prospective crowdfunding portals asking them to voluntarily submit information regarding their business. This information will help FINRA develop rules relating to crowdfunding portals. The information provided is not bounding on the portals. Once the SEC and FINRA issue final rules regarding the portals, all applicants will be asked to apply for FINRA membership and complete the final funding portal application form.

The interim form asks the portals about their ownership, funding, management, business models and relationships, and any other information that may be useful to FINRA in its rule-making. The final question asks the tough questions mandated by the JOBS Act: how the portals intend to address investor education, take measures to reduce the risk of fraud, ensure adherence to the aggregate selling limits and protect the privacy of information collected from the investors. The submitted information will be kept confidential.

It looks like it will be a while before we see any final rules on crowdfunding from the SEC or FINRA. For an opinion, check out Compliance Building's blog post on the same subject.

This article is not a legal advice, and was written for general informational purposes only. If you have questions or comments about the article or are interested in learning more about this topic, feel free to contact its author, Arina Shulga. Ms. Shulga is the founder of Shulga Law Firm, P.C.