[author: Peter Ormerod]
Peter Ormerod
Peter Ormerod
On April 22, the Federal Trade Commission (FTC) updated its "Frequently Asked Questions" (FAQ) website to provide additional information on how operators can collect students' personal information—in compliance with the Children's Online Privacy Protection Act (COPPA) — when consent is obtained in the educational setting from entities or individuals other than the child's parents.
In general, COPPA forbids online services from collecting data on children under 13 without verified parental consent. A previous post on this blog discussing approved methods for obtaining verified parental consent under COPPA is available here.
This general prohibition, however, has generated significant uncertainty in the educational context.1 In a blog post announcing the updates, FTC senior attorney Lesley Fair wrote: "[E]ducators, administrators, and parents have been asking an important question: How do the protections of [COPPA] and the accompanying FTC rule apply in the school setting?"2
The updated COPPA FAQ seeks to answer this and related questions, and it is available here.
The FAQ previously contained four questions and responses within the section titled "M. COPPA AND SCHOOLS."3 The updated FAQ adds two questions and responses, and also revises the four existing questions.4
The Two New Questions & Responses
In the new portions of the FAQ, the Commission clarifies who should be responsible for providing consent on behalf of students whose data is being collected by online services used in schools; addresses the role parents should play; and provides guidance on best practices.5
The FTC recommends that schools or school districts should be responsible for determining whether a particular online service (and the service's information practices) are appropriate—rather than leaving that decision to individual teachers.6 The Commission also suggests schools consider providing parents with a list of the websites and online services that the school has provided consent to collect students' information on behalf of the parents.7
The updated FAQ further advises schools to make operators' information collection and use policies available to interested parties.8
Revisions to the Four Previous Questions & Responses
The FTC revised one of the FAQ's existing questions to clarify that the school's authority to provide consent on behalf of a parent is constrained to information used in the educational context—and not for other commercial purposes.9 The Commission also clarified that website operators must comply with the statute's notice and consent requirements whether they obtain permission from a school or from a parent.10
Finally, the guidance reminds schools that they have additional obligations under the Family Educational Rights and Privacy Act (FERPA), which gives parents certain rights with respect to their children's education records.11 Unlike COPPA, FERPA is administered by the U.S. Department of Education.12
Notes
1 See Leslie Fair, "New COPPA FAQs can help schools make the grade," Federal Trade Commission, Bureau of Consumer Protection, Business Center Blog, Apr. 23, 2014, 12:32 PM, http://www.business.ftc.gov/blog/2014/04/new-coppa-faqs-can-help-schools-make-grade.
2 Id.
3 See Allison Grande, "COPPA Guide Updated To Tackle Student Privacy Concerns," Law360, Apr. 23, 2014, 6:56 PM ET, http://www.law360.com/privacy/articles/531076 [hereinafter "Law360 Article"].
4 See id.
5 See Federal Trade Commission, "Complying with COPPA: Frequently Asked Questions," Bureau of Consumer Protection, "M. COPPA AND SCHOOLS" (revised April 2014), http://www.business.ftc.gov/documents/0493-Complying-with-COPPA-Frequently-Asked-Questions#Schools [hereinafter "Updated COPPA FAQ"].
6 See id.
7 See id.
8 See id.
9 See Updated COPPA FAQ, supra note 4; Law360 Article, supra note 2.
10 See Updated COPPA FAQ, supra note 4; Law360 Article, supra note 2.
11 See Updated COPPA FAQ, supra note 4; Law360 Article, supra note 2.
12 See Law360 Article, supra note 2.
