Social Networking Site Operator Resolves COPPA Allegations

This posting was written by Jeffrey May, Editor of CCH Trade Regulation Reporter.

The operators of a social networking web site for kids and “tweens” have agreed to settle FTC charges that their data-collection practices violated the Children’s Online Privacy Protection Act (COPPA) and the Commission’s implementing rule.

COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use, or disclosure of personally identifiable information from and about children under 13 on the Internet.

According to a complaint filed by the Department of Justice on behalf of the FTC, the defendants—Industrious Kid, Inc. and its owner—promoted the imbee.com web site as a “free, secure, social networking and blogging destination specifically designed for kids ages 8 to 14.”

In addition, the web site was promoted as “purposely designed to ensure the greatest level of safety and satisfaction for young members” and as “safer than other social networking sites.”

Lack of Parental Notice, Consent

According to the FTC, imbee.com collected and maintained personal information from children under the age of 13 without first notifying parents and obtaining their consent. The agency’s complaint alleged that imbee.com collected and maintained personal information from more than 10,500 children under the age of 13.

The complaint charged that the defendants failed to: obtain verifiable parental consent before any collection of personal information from children; provide sufficient notice of what information they collected online from children, the site’s information use and disclosure practices, and other require content; and provide sufficient notice of the types of personal information they had collected from children prior to obtaining verifiable parental consent.

Right to Review, Delete Personal Information

The e-mail notice also failed to inform parents of their right to review or have their children’s personal information deleted, according to the agency. Imbee’s privacy policy suffered from similar shortcomings, the agency claimed.

Under the terms of the proposed consent decree, the defendants would be required to pay a $130,000 civil penalty and to delete all personal information they collected and maintained in violation of the law. The consent decree also would prohibit future violations of the rule.

The January 31 proposed consent decree is U.S. v. Industrious Kid, Inc., FTC File No. 072-3082, CCH Trade Regulation Reporter ¶16,105.