Q: When does the amended Rule go into effect? What should I do about information I collected from children prior to the effective date that was not considered personal under the original Rule but now is considered personal information under the amended Rule?
A: The amended Rule, which goes into effect on July 1, 2013, added four new categories of information to the definition of personal information. The amended Rule of course applies to any personal information that is collected after the effective date of the Rule. Below we address, for each new category of personal information, an operator’s obligations regarding use or disclosure of previously collected information that will be deemed personal information once the amended Rule goes into effect:
If you have collected geolocation information and have not obtained parental consent, you must do so immediately. Although geolocation information is now a stand-alone category within the definition of personal information, the Commission has made clear that this was simply a clarification of the 1999 Rule. The definition of personal information from the 1999 Rule already covered any geolocation information that provides information precise enough to identify the name of a street and city or town. Therefore, operators are required to obtain parental consent prior to collecting such geolocation information, regardless of when such data is collected.
If you have collected photos or videos containing a child’s image or audio files with a child’s voice from a child prior to the effective date of the amended Rule, you do not need to obtain parental consent. This is consistent with the Commission’s statement contained in the 1999 Statement of Basis and Purpose for the COPPA Rule that operators need not seek parental consent for information collected prior to the effective date of the Rule. However, as a best practice, staff recommends that entities either discontinue the use or disclosure of such information after the effective date of the amended Rule or, if possible, obtain parental consent.
Under the original Rule, a screen or user name was only considered personal information if it revealed an individual’s email address. Under the amended Rule, a screen or user name is personal information where it functions in the same manner as online contact information, which includes not only an email address, but any other “substantially similar identifier that permits direct contact with a person online.” As with photos, videos, and audio, any newly-covered screen or user name collected prior to the effective date of the amended Rule is not covered by COPPA, although we encourage you as a best practice to obtain parental consent if possible. A previously-collected screen or user name is covered, however, if the operator associates new information with it after the effective date of the amended Rule.
Persistent identifiers were covered by the original Rule only where they were combined with individually identifiable information. Under the amended Rule, a persistent identifier is covered where it can be used to recognize a user over time and across different websites or online services. Consistent with the above, operators need not seek parental consent for these newly-covered persistent identifiers if they were collected prior to the effective date of the Rule. However, if after the effective date of the amended Rule an operator continues to collect, or associates new information with, such a persistent identifier, such as information about a child’s activities on its website or online service, this collection of information about the child’s activities triggers COPPA. In this situation, the operator is required to obtain prior parental consent unless such collection falls under an exception, such as for support for the internal operations of the website or online service.
This information was obtained from the FTC’s webpage on “Complying with COPPA: Frequently Asked Questions.”