Does a general-audience site have to ask visitors how old they are?

A general-audience operator has no duty to ask. COPPA covers it only where it has actual knowledge that a child under age 13 is the person providing personal information, and the Rule does not require operators to ask the age of visitors. The Commission has warned, though, that it will examine closely sites that do not directly ask age or grade but instead ask “age identifying” questions.

What happens if a child lies about their age when signing up?

An operator that screens users for age in a neutral fashion may rely on the age information they enter, even if it is not accurate. If the operator later determines that a particular user is a child under 13, the notice and parental consent requirements are triggered.

Does an under-13 birthdate entered at registration give an operator actual knowledge?

The FTC treats it that way in its complaints. In the Yelp complaint, because Yelp collected information from users who provided birthdates indicating they were under 13, it was deemed to have had “actual knowledge” that it was collecting information from several thousand children under 13. The complaint added that Yelp's privacy policy said the service was “intended for general audiences and is not directed to children under 13,” but that Yelp had failed to implement a functional age screen.

Does naming a COPPA contact point help avoid knowledge through other employees?

It reduces the risk. The FTC says that prominently disclosing methods by which individuals can contact the business with COPPA information will reduce the likelihood that the business would be deemed to have gained actual knowledge through other employees.

Is it enough that an operator should have known a child was using its service?

Two Commissioners wrote that proving actual knowledge in court is not speculation about what a company must have known or should have known, and that the burden would be on the Commission to establish the company's actual knowledge.

Can an age estimate drawn from user data amount to actual knowledge?

The Report on social media and video streaming services reasoned that data-driven inferences about some users' ages were sufficient to satisfy COPPA’s “actual knowledge” requirement. Commissioner Ferguson wrote that a data-driven probabilistic inference of a user's age does not seem to be “actual knowledge” as ordinary people would use that term. The FTC's TikTok complaint, for its part, alleged that the defendants appear to have programmed an age-estimating tool to avoid gaining knowledge that users were under 13.

Does a terms-of-service ban on children under 13 protect us?

A terms-of-service ban does not by itself remove the exposure, because the Commission has made clear that a website or online service may be deemed directed to children even where the developer’s terms of service prohibit children from participating on the site or service. The same letter ties that position to services that are directed to children or whose operator has actual knowledge it has collected personal information from children.

Does the knowledge prong reach foreign operators?

It does when a foreign operator knowingly collects personal information from children in the United States. FTC staff wrote that COPPA covers foreign-based sites or services directed to children in the United States, or that knowingly collect personal information from children in the United States.

Is the knowledge needed for a civil penalty the same as actual knowledge under COPPA?

The penalty standard is a separate test. Civil penalties for a rule violation turn on “actual knowledge or knowledge fairly implied on the basis of objective circumstances.” The YouTube complaint, for example, pleads that the defendants violated the COPPA Rule with the knowledge required by Section 5(m)(1)(A) of the FTC Act.

KidsAct or rule

Actual knowledge (COPPA)

Berkeley Robinson, Managing Attorney at Robinson Law Firm PLLC

Author

Berkeley Robinson, Esq.

Managing Attorney, Robinson Law Firm PLLC

Berkeley has served as the go-to counsel for many scaling businesses in a transactional and litigation management capacity. Before becoming an attorney, Berkeley grew sales teams, ran online marketing campaigns, and did everything else an entrepreneur does—and still does today as the founder of two online businesses.

Definition

Actual knowledge (COPPA) is the rule that brings an operator within COPPA's limits on collecting personal information from children when the operator actually knows it is collecting personal information from a child, even though its website or online service is not directed to children. Source: 15 U.S.C. § 6502(a)(1) A “child” for this purpose is an individual under 13. Source: 15 U.S.C. § 6501(1) The Rule adds a second route: a website or online service is deemed directed to children when it has actual knowledge that it is collecting personal information directly from users of another website or online service directed to children. Source: 16 C.F.R. § 312.2

Key legal rules

Actual knowledge (COPPA) places these primary duties on a business:

It is unlawful for any operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting or maintaining personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under that part. Source: 16 C.F.R. § 312.3
COPPA covers a general-audience operator only where it has actual knowledge that a child under age 13 is the person providing personal information, and the Rule does not require operators to ask the age of visitors. Source: FTC, Complying with COPPA: Frequently Asked Questions (July 2020), FAQ A.12 Actual knowledge is present, for example, where an operator learns of a child's age or grade from the child's registration at the site or from a concerned parent who has learned that his child is participating at the site. Source: Children’s Online Privacy Protection Rule; Final Rule, 64 Fed. Reg. 59888 (Nov. 3, 1999) (Statement of Basis and Purpose) A general-audience operator is not required to investigate visitors' ages, but the Commission has said it will examine closely sites that do not directly ask age or grade and instead ask “age identifying” questions. Source: Children’s Online Privacy Protection Rule; Final Rule, 64 Fed. Reg. 59888 (Nov. 3, 1999) (Statement of Basis and Purpose)
Where an operator knows that a particular visitor is a child, the operator must either meet COPPA's notice and parental consent requirements or delete the child's information. Source: FTC, Complying with COPPA: Frequently Asked Questions (July 2020), FAQ H.6
A website or online service is deemed directed to children when it has actual knowledge that it is collecting personal information directly from users of another website or online service directed to children. Source: 16 C.F.R. § 312.2 A general-audience platform that has actual knowledge that a creator's content is directed to children, and is collecting personal information, will also need to comply with COPPA. Source: FTC, Complying with COPPA: Frequently Asked Questions (July 2020), FAQ D.2
An ad network is likely to be treated as having actual knowledge where a child-directed content provider directly communicates the child-directed nature of its content to the network. Source: FTC, Complying with COPPA: Frequently Asked Questions (July 2020), FAQ E.1–E.2 An ad network is also likely to be treated as having actual knowledge where one of its representatives recognizes the child-directed nature of the content. Source: FTC, Complying with COPPA: Frequently Asked Questions (July 2020), FAQ E.1–E.2 A third party's list of purportedly child-directed websites is unlikely, by itself, to be actual knowledge and carries no duty to investigate, although screenshots or other concrete information may give a service actual knowledge. Source: FTC, Complying with COPPA: Frequently Asked Questions (July 2020), FAQ E.1–E.2
A service directed to children that does not target them as its primary audience may use an age screen to apply COPPA's protections only to visitors who self-identify as under 13, and the operator is then deemed to have actual knowledge that those users are under 13. Source: Children’s Online Privacy Protection Rule, Statement of Basis and Purpose, § II.A.7 (2013) For a mixed-audience service, any collection of age information, or other means of determining whether a visitor is a child, must be done in a neutral manner that does not default to a set age or encourage visitors to falsify age information. Source: 16 C.F.R. § 312.2

For the sake of space, this page lists only the primary rules related to this term that most businesses should follow. More may apply to your situation, and your unique facts affect how they apply.

Send us a message through our online form to talk through yours.

Send a message

Response within 24 hours

Why these rules exist

The Commission settled on a knowledge standard for plug-ins and ad networks after weighing the comments, deciding that it is reasonable to hold such an entity liable only where it has actual knowledge that it is collecting personal information directly from users of a child-directed site or service. Source: Children’s Online Privacy Protection Rule, Statement of Basis and Purpose, Actual Knowledge Standard, 78 Fed. Reg. 3972 (Jan. 17, 2013) That choice will likely substantially reduce the number of third-party plug-in operators, many of them small businesses, that must comply with the Rule, compared with what the Commission proposed in 2012. Source: Children’s Online Privacy Protection Rule, Statement of Basis and Purpose, Final Rule Amendments, 78 Fed. Reg. 3972 (Jan. 17, 2013) A knowledge trigger also spares a general-audience operator any duty to ask visitors their age. Source: FTC, Complying with COPPA: Frequently Asked Questions (July 2020), FAQ A.12 The duty then bites at a defined point: once an operator knows a particular visitor is a child, it must meet the notice and consent requirements or delete the data, so a parent is not left out of collection the operator already knows involves a child. Source: FTC, Complying with COPPA: Frequently Asked Questions (July 2020), FAQ H.6

The line between knowledge-based coverage and child-directed coverage is deliberate: the Commission refused to let sites primarily targeting children rebut the presumption that all users are children with an age screen, because that would virtually nullify the statutory distinction between “actual knowledge” sites and those directed to children. Source: Children’s Online Privacy Protection Rule, Statement of Basis and Purpose, § II.A.7 (2013) The standard is not uncontroversial: Commissioner Slaughter has written that the practical obstacles in investigating and assembling evidence of knowledge call into question whether “actual knowledge” is the appropriate standard for “general audience” sites. Source: Dissenting Statement of Commissioner Rebecca Kelly Slaughter, In the Matter of Google LLC and YouTube, LLC, n.16 (Sept. 4, 2019)

Enforcement examples

United States v. UMG Recordings, Inc. (record company websites)

United States v. UMG Recordings, Inc., Civ. No. CV-04-1050 JFW (Ex) (C.D. Cal. Feb. 17, 2004)

According to the complaint, many of the company's websites were general-audience sites where it had actual knowledge when visitors submitting personal information were under 13. Source: United States v. UMG Recordings, Inc., Complaint Tens of thousands of visitors entered birth dates indicating they were children under thirteen. Source: United States v. UMG Recordings, Inc., Complaint The company, the complaint said, collected and maintained their information without first sending parents a direct notice of its information practices and without obtaining parental consent. Source: United States v. UMG Recordings, Inc., Complaint

Outcome. The Commission has identified UMG as one of two cases it brought against website operators alleged to have had actual knowledge that they were collecting personal information from children under 13 on general-audience websites. Source: Prepared Statement of the Federal Trade Commission, Social Networking Testimony, n.15 The case ended in a $400,000 civil penalty. Source: Prepared Statement of the Federal Trade Commission, Social Networking Testimony, n.15

United States v. Musical.ly (lip-sync video app)

Musical.ly and Musical.ly, Inc.: Complaint for Civil Penalties, Permanent Injunction, and Other Equitable Relief - February 27, 2019

According to the complaint, the youth of the app's user base was easily apparent from users' profile pictures and profiles, many of which explicitly noted the child's age, birthdate, or school. Source: Musical.ly and Musical.ly, Inc.: Complaint for Civil Penalties, Permanent Injunction, and Other Equitable Relief (Feb. 27, 2019), ¶¶ 28–29 The complaint also alleged that since at least 2014 the defendants had received thousands of complaints from parents of children under 13 who were registered users. Source: Musical.ly and Musical.ly, Inc.: Complaint for Civil Penalties, Permanent Injunction, and Other Equitable Relief (Feb. 27, 2019), ¶¶ 28–29

Outcome. The complaint alleged that because the defendants operated an online service directed to children and had actual knowledge they collected personal information from children, they were subject to the COPPA Rule. Source: Musical.ly and Musical.ly, Inc.: Complaint for Civil Penalties, Permanent Injunction, and Other Equitable Relief (Feb. 27, 2019), ¶¶ 28–29 Commissioner Phillips later wrote that the defendant paid a $5.7 million fine, at that point the largest COPPA penalty ever assessed. Source: Dissenting Statement of Commissioner Noah Joshua Phillips, FTC v. HyperBeard, Inc., et al., Matter No. 1923109 (June 4, 2020)

FTC v. Google LLC and YouTube, LLC (video-sharing platform)

FTC v. Google LLC and YouTube, LLC, Complaint and Stipulated Order for Permanent Injunction and Civil Penalty Judgment; Statement of Joseph J. Simons & Christine S. Wilson (Sept. 4, 2019)

The complaint alleged that Google and YouTube had actual knowledge that they were collecting personal information from viewers of child-directed channels, gained through direct communications with channel owners, their work curating content for the YouTube Kids App, and their content ratings. Source: Complaint for Permanent Injunction, Civil Penalties, and Other Equitable Relief, ¶ 42 (FTC and New York v. Google LLC and YouTube, LLC) In email exchanges, the complaint said, the defendants asserted that channels on the platform did not need to comply with COPPA, even while marketing YouTube as the favorite website for kids 2-12. Source: Complaint for Permanent Injunction, Civil Penalties, and Other Equitable Relief, ¶ 24 (FTC and New York v. Google LLC and YouTube, LLC)

Outcome. The stipulated order provided for a $136,000,000 civil penalty judgment in favor of the FTC against the defendants, jointly and severally. Source: Stipulated Order for Permanent Injunction and Civil Penalty Judgment, §§ I, IV (FTC and New York v. Google LLC and YouTube, LLC) It also provided $34,000,000 for the State of New York as damages, restitution, or other compensation to its residents. Source: Stipulated Order for Permanent Injunction and Civil Penalty Judgment, §§ I, IV (FTC and New York v. Google LLC and YouTube, LLC) Beyond the money, the order barred YouTube from failing to develop, implement, and maintain a system for channel owners to designate whether their content is directed to children. Source: Stipulated Order for Permanent Injunction and Civil Penalty Judgment, §§ I, IV (FTC and New York v. Google LLC and YouTube, LLC) Two Commissioners called that requirement the first and only one mandated on a platform or third party to seek actual knowledge of whether content is child-directed. Source: Statement of Joseph J. Simons & Christine S. Wilson Regarding FTC and People of the State of New York v. Google LLC and YouTube, LLC (Sept. 4, 2019)

In re Retina-X Studios, LLC (monitoring apps)

Retina-X Studios, LLC: Complaint, October 17, 2019

The complaint alleged that the company collected user dates of birth during TeenShield registration, many indicating a monitored user under 13, and so had actual knowledge that the product was collecting, using, and/or disclosing personal information from children. Source: Retina-X Studios, LLC: Complaint (Oct. 17, 2019), ¶ 29

Outcome. The Commission's response to a public comment explains that the presence of some child users justified a COPPA count, but the civil penalty factors, such as ability to pay and stay in business, would have led to a quite small penalty, so the Commission focused on injunctive relief to prevent future violations. Source: Response to Public Comment in In re Retina-X Studios, LLC, Matter No. 172-3118 (Mar. 26, 2020)

United States v. OpenX Technologies, Inc. (ad exchange)

United States v. OpenX Technologies, Inc., Complaint for Permanent Injunction, Civil Penalties, and Other Relief

The complaint alleged that OpenX had actual knowledge that child-directed apps were child-directed based on its own human review of the apps. Source: United States v. OpenX Technologies, Inc., Complaint for Permanent Injunction, Civil Penalties, and Other Relief, ¶¶ 50, 52 The apps' names and developer names, it said, included obvious references to children. Source: United States v. OpenX Technologies, Inc., Complaint for Permanent Injunction, Civil Penalties, and Other Relief, ¶¶ 50, 52

Outcome. The complaint alleged that OpenX took no steps to obtain verified parental consent or provide the notices COPPA prescribes. Source: United States v. OpenX Technologies, Inc., Complaint for Permanent Injunction, Civil Penalties, and Other Relief, ¶¶ 50, 52 In a concurring statement, Commissioner Phillips observed that OpenX opened itself up to liability by having people review apps to make sure they were not child directed, but that without any such review it might not be subject to penalties at all. Source: Concurring Statement of Commissioner Noah Joshua Phillips Regarding United States v. OpenX Technologies, Inc.

FTC v. NGL Labs, LLC (anonymous messaging app)

Complaint for Permanent Injunction, Monetary Judgment, Civil Penalty Judgment, and Other Relief; Stipulation as to Entry of Order for Permanent Injunction, Monetary Judgment, Civil Penalty Judgment, and Other Relief

The complaint alleged that the company had actual knowledge it collected personal information from children under 13 because it received complaints from children and parents that included the child's age. Source: Complaint for Permanent Injunction, Monetary Judgment, Civil Penalty Judgment, and Other Relief, ¶¶ 63–65 (FTC and Los Angeles County District Attorney v. NGL Labs, LLC) It also alleged that the defendants did not impose, implement, or require any age screening in connection with downloading, installing, or using the app. Source: Complaint for Permanent Injunction, Monetary Judgment, Civil Penalty Judgment, and Other Relief, ¶¶ 63–65 (FTC and Los Angeles County District Attorney v. NGL Labs, LLC)

Outcome. The stipulated order called for deleting all personal information associated with any messaging app user, subject to stated exceptions. Source: Stipulation as to Entry of Order for Permanent Injunction, Monetary Judgment, Civil Penalty Judgment, and Other Relief, §§ IX–X (FTC v. NGL Labs, LLC) One exception is a user who has provided age information through a neutral age gate identifying the user as age 13 or older. Source: Stipulation as to Entry of Order for Permanent Injunction, Monetary Judgment, Civil Penalty Judgment, and Other Relief, §§ IX–X (FTC v. NGL Labs, LLC) The order also provided for $4,500,000 in monetary relief in favor of the plaintiffs against the individual defendants and the corporate defendant, jointly and severally. Source: Stipulation as to Entry of Order for Permanent Injunction, Monetary Judgment, Civil Penalty Judgment, and Other Relief, §§ IX–X (FTC v. NGL Labs, LLC)

United States v. TikTok (short-video social app)

Complaint For Permanent Injunction, Civil Penalty Judgment, and Other Relief [Public]

The complaint alleged that in a 2018 exchange a high-level employee explicitly acknowledged that the defendants had “actual knowledge” of children on TikTok upon receiving the first parental request, and yet the children's accounts were not deleted. Source: Complaint For Permanent Injunction, Civil Penalty Judgment, and Other Relief, ¶ 71 (United States v. TikTok) It further alleged that the defendants appear to have programmed an age-estimating tool to avoid gaining knowledge that users were under 13. Source: Complaint For Permanent Injunction, Civil Penalty Judgment, and Other Relief, ¶ 105 (United States v. TikTok)

Outcome. The complaint treated each day the defendants maintained data collected in violation of the Rule as a continuing failure to comply and a separate violation. Source: Complaint For Permanent Injunction, Civil Penalty Judgment, and Other Relief, ¶ 122 (United States v. TikTok) It pleaded civil penalties of not more than $51,744 for each violation assessed after January 10, 2024. Source: Complaint For Permanent Injunction, Civil Penalty Judgment, and Other Relief, ¶ 123 (United States v. TikTok)

Exposure

A business that violates the Rule can face monetary civil penalties of not more than $53,088 for each violation assessed after January 17, 2025, as the complaint in the Iconic Hearts matter pleads. Source: Iconic Hearts Complaint, ¶ 63 Complaints count each collection, use, or disclosure of a child’s personal information that violates the Rule as a separate violation, so the number multiplies with every child whose data is collected. Source: Complaint for Permanent Injunction, Civil Penalties, and Other Equitable Relief, ¶¶ 52–56 (FTC and New York v. Google LLC and YouTube, LLC) The TikTok complaint goes further and pleads each day a defendant kept data collected in violation of the Rule as another violation. Source: Complaint For Permanent Injunction, Civil Penalty Judgment, and Other Relief, ¶ 122 (United States v. TikTok)

Settled amounts have ranged widely. In the YouTube matter the settlement required $136 million to the FTC and $34 million to New York, a $170 million judgment that two Commissioners described as almost 30 times higher than the largest civil penalty previously imposed under COPPA. Source: Statement of Joseph J. Simons & Christine S. Wilson Regarding FTC and People of the State of New York v. Google LLC and YouTube, LLC (Sept. 4, 2019) Microsoft's settlement over Xbox accounts required a $20 million monetary judgment, in a case where the complaint alleged that about 218,000 users entered birthdates showing they were under 13. Source: Microsoft: Reasons for Settlement, FTC Matter No. 1923258 RockYou's consent decree required a civil penalty of $250,000. Source: Consent Decree and Order for Civil Penalties, Injunction and Other Relief, ¶¶ 14, 16, 18, No. 12-CV-1487 (N.D. Cal.) (United States v. RockYou, Inc.)

Money is not the only exposure. RockYou's decree enjoins it, in connection with any website or online service directed to children or through which it, with actual knowledge, collects, uses, or discloses personal information from children, from failing to provide the sufficient notice of its collection practices that the Rule requires. Source: Consent Decree and Order for Civil Penalties, Injunction and Other Relief, ¶¶ 14, 16, 18, No. 12-CV-1487 (N.D. Cal.) (United States v. RockYou, Inc.) The decree also required RockYou to delete personal information collected in violation of the Rule since April 21, 2000. Source: Consent Decree and Order for Civil Penalties, Injunction and Other Relief, ¶¶ 14, 16, 18, No. 12-CV-1487 (N.D. Cal.) (United States v. RockYou, Inc.) States can sue too: in the YouTube complaint, New York invoked authority under COPPA to enjoin violations, enforce compliance with the Rule, and obtain damages, restitution, or other compensation. Source: Complaint for Permanent Injunction, Civil Penalties, and Other Equitable Relief, ¶¶ 52–56 (FTC and New York v. Google LLC and YouTube, LLC) Civil penalties carry their own knowledge requirement: the violator must act with “actual knowledge or knowledge fairly implied on the basis of objective circumstances that such act is unfair or deceptive and is prohibited by such rule.” Source: Brief for Respondents, Soundboard Association v. Federal Trade Commission (D.C. Cir. July 28, 2017), n.2 A small company's ability to pay can move the outcome toward injunctive relief rather than a large penalty, as the Commission explained in Retina-X. Source: Response to Public Comment in In re Retina-X Studios, LLC, Matter No. 172-3118 (Mar. 26, 2020)

FAQs

1.15 U.S.C. § 6502. 15 U.S.C. § 6502(a)(1)See also 16 CFR 312.3. 16 C.F.R. § 312.3See also Appendix B [Federal Trade Commission Guide: How To Comply With The Children's Online Privacy Protection Rule]. FTC, How To Comply With The Children’s Online Privacy Protection Rule, Who Must Comply
2.s6501. 15 U.S.C. § 6501(1)
3.16 CFR 312.2. 16 C.F.R. § 312.2See also Attachment A. Attachment A, 16 C.F.R. Part 312, § 312.2 (Definitions)