Protect your business by protecting kids’ privacy

In January 2023, the FTC fined Fortnight maker Epic Games $275 million for COPPA violations related to how it collected children’s personal information and allowed them to chat with adults on its platform. Regulators said Epic’s Fortnight platform must no longer have voice and text communications turned on by default for minors; now, players 13 and younger will need parental consent to use chat. Epic was also penalized for keeping some children’s data despite parents’ requests to delete it. The regulator claimed Epic made it difficult for parents to request data deletion and rejected some of those requests anyway.

Two bills that recently passed the U.S. Senate would substantially increase requirements for tech platforms to protect children’s online privacy and data. Supporters of the Kids Online Safety Act (KOSA), and the Children and Teens’ Online Privacy Protection Act (COPPA 2.0) – considered “the most significant restrictions on tech platforms” to pass a chamber of Congress in decades – are now pressing House members to take up the bill. Critics from the tech industry claim KOSA’s “duty of care” provision would allow regulators to force companies to suppress content they dislike. COPPA 2.0, which has not received as much industry opposition as KOSA, would increase the age for parental consent requirements, as well as ban advertisers from targeting kids and teens. If the bills eventually become law, they will likely face legal challenges from tech businesses.

The FTC is increasingly penalizing game platforms for using default privacy and consent settings that violate COPPA. In June 2023, it levied a $20 million fine against Microsoft for using default account sign-up settings for Xbox Live that allowed the company to collect and share children’s personal information before getting parental consent. The FTC also alleged Microsoft failed to disclose how it would handle children’s data, and then kept that data longer than reasonably necessary. Regulators said this penalty makes clear that COPPA covers children’s biometric and health data, which Microsoft collected for its Xbox Live platform.

In August, the U.S. Justice Department and the FTC filed suit against TikTok, claiming the platform failed to get parental consent before collecting children’s personal data. TikTok is also accused of ignoring parents’ requests to delete children’s accounts. The DOJ alleges TikTok collected young users’ activities and profile identifiers, and then shared that data with other companies, including Meta and an analytics company. The government further claims that TikTok moderators spent only a few seconds checking accounts flagged as possibly belonging to children, showing there was no serious effort to catch and remove such accounts. The company claims the accusations relate to past reports that were inaccurate or have been resolved.

Regulators in California are accusing Tilting Point, the creator of the free-to-play app “SpongeBob: Krusty Cook-Off”, of failures to follow the state’s privacy rules and COPPA. They claim the app, among other violations, did not sufficiently disclose how it collected, sold or shared children’s data with third-party advertisers. Tilting Point also allegedly failed to get parental consent or notify parents that it was collecting their children’s data.

There are 11 new state privacy laws scheduled to go into effect over the next two years, and dozens more currently under consideration by local legislatures. In July, new requirements in Florida, Oregon, and Texas could result in substantial fines for companies that are behind on data collection and consent requirements in those states. While there are similar elements among the new laws, each has unique provisions; for example, Florida’s law will primarily affect large companies, while the laws in Texas and Oregon may also apply to nonprofit groups and small businesses, respectively. Regulatory changes are coming quickly throughout the U.S., and without a thorough understanding of the new laws, your business is vulnerable to legal challenges. Common Sense Privacy closely monitors new legislation and can alert you when your policies fail to meet new requirements.