Policy Statement of the Federal Trade Commission on Education Technology and the Children's Online Privacy Protection Act

Policy Statement of the Federal Trade Commission on Education Technology
and the Children’s Online Privacy Protection Act
The Federal Trade Commission (“Commission”) is committed to ensuring that education
technology (“ed tech”) tools and their attendant benefits do not become an excuse to ignore
critical privacy protections for children. When Congress enacted the Children’s Online Privacy
Protection Act1 (“COPPA”), it empowered the Commission with tools beyond administering
compliance with notice and consent regimes. The Commission’s COPPA authority demands
enforcement of meaningful substantive limitations on operators’ ability to collect, use, and retain
children’s data, and requirements to keep that data secure. The Commission intends to fully
enforce these requirements—including in school and learning settings where parents may feel
they lack alternatives.
Protecting children’s privacy online has been a priority for the Commission since 1998,
when the Commission recommended “that Congress develop legislation placing parents in
control of the online collection and use of personal information from their children.”2 Thereafter,
Congress enacted COPPA and charged the Commission with enforcing the law, entrusting the
FTC to take the lead in protecting children’s privacy just as the country was entering the Internet
age. To implement COPPA, the Commission issued the COPPA Rule, which became effective in
2000.3
In the decades since COPPA’s enactment, there has been a steady proliferation of
technologies that allow, and business models that depend on, the online collection and
monetization of consumers’ personal information. The development of ever more sophisticated
targeting practices, in some cases based on comprehensive collection of users’ activities across
the Internet, has raised concerns that businesses might engage in harmful conduct and led to calls
for strengthening children’s privacy protections. Partly in response to these concerns, the
Commission revised the COPPA Rule4 in 2013, including to hold third parties such as
advertising networks liable for collection of children’s personal information from child-directed
sites in violation of the Rule5 and to expand the definition of personal information to include
1 15 U.S.C. §§ 6501–6505.
2 FED. TRADE COMM’N, PRIVACY ONLINE: A REPORT TO CONGRESS, at 42 (June 1998). See also Complaint, In re
Liberty Fin. Cos., Inc., FTC File No. 982-3522 (Aug. 12, 1999)(alleging that website operator falsely represented
that personal information collected from children in a survey would be maintained anonymously and that
participants would be sent an e-mail newsletter and prizes); Complaint, In re GeoCities, FTC File No. 982-3015
(Feb. 5, 1999) (alleging that website operator misrepresented which entity collected and maintained personal
identifying information collected from children).
3 16 C.F.R. Part 312. As discussed below, the Commission strengthened the COPPA Rule through amendments that
became effective in 2013. See Children’s Online Privacy Protection Rule, 78 Fed. Reg. 3,972 (Jan. 17, 2013) (Final
Rule amendments codified at 16 C.F.R. Part 312).
4 See id.
5 See id. at 4,010. See also Complaint, United States v. OpenX Techs., Inc., Case No. 2:21-cv-09693 (C.D. Cal. Dec.
15, 2021) (alleging that online advertising platform collected and transmitted location information and persistent
identifiers from users of child-directed apps without complying with COPPA); Complaint, FTC and the State of
New York v. Google LLC and YouTube, LLC, Case No. 1:19-cv-2642 (D.D.C. Sept. 4, 2019) (alleging that YouTube

persistent identifiers used to target advertising to children.6 Since that time, companies’
information collection practices have continued to become more extensive, and concerns remain
that children’s information may be used to target them.
Concerns about data collection are particularly acute in the school context, where
children and parents often have to engage with ed tech tools in order to participate in a variety of
school-related activities. School-issued personal computing devices and online learning services
have provided substantial benefits to students, particularly as the COVID-19 pandemic closed
schools and forced families to switch from in-person to remote learning for their children. At the
same time, parents may have reasonable questions and concerns about the personal information
that ed tech providers collect and how they use and potentially share that information with third
parties, including for marketing purposes. And parent groups, among others, have expressed
concern that children are a captive audience in the school setting and should not be targeted with
advertising as they pursue their educations.7 School-issued devices and applications also enter
families’ homes, potentially allowing for even more private information to be collected and
shared. Commission staff has provided extensive guidance8 on COPPA’s application to ed tech
providers to address these concerns.
In investigating potential violations of COPPA by providers of ed tech and other covered
online services, the Commission intends to scrutinize compliance with the full breadth of the
substantive prohibitions and requirements of the COPPA Rule and statutory language. In
particular, the Commission will focus on:
• 	Prohibition Against Mandatory Collection: COPPA-covered companies, including ed
tech providers, must not condition participation in any activity on a child disclosing more
information than is reasonably necessary for the child to participate in that activity.9
These businesses cannot stop students from engaging in an ed tech activity if they do not
provide information beyond what is reasonably needed to administer the students’
collected persistent identifiers used for targeted advertising from users of child-directed channels without complying
with COPPA); Complaint, United States v. InMobi Pte Ltd., Case No. 3:16-cv-3474 (N.D. Cal. June 22, 2016)
(alleging that mobile advertising network collected geolocation information from users of apps directed to children
under the age of 13 without complying with COPPA).
6 78 Fed. Reg. 3,972, 4,009. See also Complaint, United States v. HyperBeard, Inc., Case No. 3:20-cv-3683 (N.D.
Cal. June 3, 2020) (alleging that app developer allowed third-party ad networks to use persistent identifiers to track
users of its child-directed apps without complying with COPPA); Complaint, FTC and the State of New York v.
Google LLC and YouTube, LLC, Case No. 1:19-cv-2642 (D.D.C. Sept. 4, 2019); Complaint, United States v. Retro
Dreamer, Case No. 5:15-cv-2569 (C.D. Cal. Dec. 17, 2015) (alleging that app developer allowed third-party
advertisers to collect persistent identifiers through its child-directed apps without complying with COPPA);
Complaint, United States v. LAI Sys., LLC, Case No. 2:15-cv-9691 (C.D. Cal. Dec. 17, 2015).
7 See, e.g., COPPA Rule Review, FTC-2019-0054 (Project No. P195404), Comments of Campaign for a
Commercial-Free Childhood, et al., Comment No. 117343, at 8 (Dec. 11, 2019) (“In many cases, parents and
students are not even aware of what data is being collected, why it is being collected, who is collecting it, or where it
is being stored. This data is often used to build behavioral profiles that allow third parties to create more effective
marketing campaigns, targeted advertisements, and, ultimately, psychological manipulation of other children.”).
8 See Complying with COPPA: Frequently Asked Questions, FED. TRADE COMM’N (July 2020) § N,
https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-
questions#N.%20COPPA%20AND%20SCHOOLS.
9 16 C.F.R. § 312.7. See also Complaint, United States v. Looksmart Ltd., Civ. Action No. 01-606-A (E.D. Va. Apr.
19, 2001); Complaint, United States v. BigMailbox.com, Inc., Civ. Action No. 01-605-A (E.D. Va. Apr. 19, 2001).
2

participation in the activity.10 For example, if an ed tech provider does not reasonably
need to be able to email students, it cannot condition the student’s access to schoolwork
on students providing their email addresses.11 Students must not be required to submit to
unnecessary data collection in order to do their schoolwork.
• 	Use Prohibitions: COPPA-covered companies, including ed tech providers, are strictly
limited in how they can use the personal information they collect from children. For
example, operators of ed tech that collect personal information pursuant to school
authorization12 may use such information only to provide the requested online education
service. In this context, ed tech companies are prohibited from using such information for
any commercial purpose, including marketing, advertising, or other commercial purposes
unrelated to the provision of the school-requested online service.13
• 	Retention Prohibitions: COPPA-covered companies, including ed tech providers, must
not retain personal information collected from a child longer than reasonably necessary to
fulfill the purpose for which it was collected.14 It is unreasonable, for example, for an ed
tech provider to retain children’s data for speculative future potential uses.
• 	Security Requirements: COPPA-covered companies, including ed tech providers, must
have procedures to maintain the confidentiality, security, and integrity of children’s
personal information.15 For example, even absent a breach, COPPA-covered ed tech
providers violate COPPA if they lack reasonable security.16
Such limitations on collection, use, and retention, along with security requirements, place
significant responsibility on COPPA-covered businesses to implement strong privacy
protections, in addition to the notice and consent requirements of the COPPA Rule. The
responsibility for COPPA compliance is on businesses, not schools or parents—and agreements
must reflect that.
10 The text of the COPPA Rule addressing prohibitions against conditioning access (16 C.F.R. § 312.7), which is
described here, restates nearly verbatim the text of the statutory language (15 U.S.C. § 6502(b)(1)(C)). As part of its
ongoing rule review, the Commission is carefully analyzing this provision to ensure that operators are aware of their
obligations. See Request for Public Comment on the Federal Trade Commission’s Implementation of the Children’s
Online Privacy Protection Rule, 64 Fed. Reg. 35,842, 35,846 (July 25, 2019).
11 See Children’s Online Privacy Protection Rule, 64 Fed. Reg. 22,750, 22,758 (proposed Apr. 27, 1999) (codified at
16 C.F.R. § 312) (discussing email address example).
12 Children’s Online Privacy Protection Rule, 64 Fed. Reg. 59,888, 59,903 (Final Rule released Nov. 3, 1999)
(codified at 16 C.F.R. § 312).
13 Complying with COPPA: Frequently Asked Questions, FED. TRADE COMM’N § N, https://www.ftc.gov/business-
guidance/resources/complying-coppa-frequently-asked-questions#N.%20COPPA%20AND%20SCHOOLS (last
visited May 18, 2022).
14 16 C.F.R. § 312.10. See also Complaint, United States v. Kurbo, Inc. and WW Int’l, Inc., No. 3:22-cv-00946 (N.D.
Cal. Feb. 16, 2022). Complaint, United States v. Musical.ly, Case No. 2:19-cv-1439 (C.D. Cal. Feb. 27, 2019).
15 15 U.S.C. § 6502(b)(1)(D); 16 C.F.R. § 312.8. See also Complaint, In re Retina-X Studios, LLC, FTC File No.
1723118 (Mar. 26, 2020). Complaint, United States v. Unixiz, Inc. d/b/a/ iDressup.com, No. 5:19-cv-02222-NC
(N.D. Cal. April 24, 2019); Complaint, United States v. VTech Elecs. Ltd., Case No. 1:18-cv-114 (N.D. Ill. Jan. 8,
2018); Complaint, United States v. RockYou, Inc., No 3:12-cv-01487-SI (N.D. Cal. Mar. 26, 2012).
16 16 C.F.R. § 312.10.
3

Children should not have to needlessly hand over their data and forfeit their privacy in
order to do their schoolwork or participate in remote learning, especially given the wide and
increasing adoption of ed tech tools. Going forward, the Commission will closely scrutinize the
providers of these services and will not hesitate to act where providers fail to meet their legal
obligations with respect to children’s privacy.
4