The U.S. FTC announced today that Yelp agreed to pay $450,000 to settle a complaint brought for violations of the Children’s Online Privacy Protection Act (COPPA). The alleged violation involved collection of registration information from minors under the age of 13.
COPPA prohibits the collection of personal information of anyone under 13 without verifiable parental consent. Here “personal information” includes any of the following:
A first and last name
A home or other physical address including street name and name of a city or town
An e-mail address
A telephone number
A Social Security number
Any other identifier that the Commission determines permits the physical or online contacting of a specific individual
Information concerning the child or the parents of that child that the website collects online from the child and combines with an identifier described in this paragraph
Beyond home address, location is generally included and considered personal information. Certainly that’s true in California and especially where minors are concerned.
Under the statute, parental consent means “any reasonable effort (taking into consideration available technology), including a request for authorization for future collection, use, and disclosure described in the notice, to ensure that a parent of a child receives notice of the operator’s personal information collection, use, and disclosure practices, and authorizes the collection, use, and disclosure, as applicable, of personal information and the subsequent use of that information before that information is collected from that child.”
The FTC argued that between 2009 and 2013 Yelp collected registration/personal information from those under 13 without notifying parents and gaining their consent. Among other things Yelp’s registration process asks for birth date. Thus Yelp had reason to know these registrants were “children” within the meaning of the statute.
These kids could still have used the site or app without registering or violating COPPA. It’s the fact of collecting their information that’s the problem.
The FTC said that “Yelp failed to implement a functional age-screen in its apps, thereby allowing children under 13 to register for the service, despite having an age-screen mechanism on its website. In addition, the complaint alleges that Yelp did not adequately test its apps to ensure that users under the age of 13 were prohibited from registering.”
Beyond the fine, Yelp will need to delete all the information collected from those under 13 at the time of registration. It will also be required to submit a compliance report to the FTC a year from now.
Postscript: Yelp posted a response on its blog, saying that “only about 0.02% of users who actually completed Yelp’s registration process during this time period provided an underage birth date, and we have good reason to believe that many of them were actually adults.” This latter statement is strange, frankly.
Postscript 2: I spoke to Yelp and gained some insight into why they made this statement about many of them being adults. In short these may be people who were being lazy or not providing their actual birth dates (intentionally or otherwise) but who are are also mostly likely older than the registration data suggest.
140917yelpcmpt from gesterling
Comments