TSCA Reform Center
TSCA Reform Center
Professionals By Name
Professionals By Practice Area
Professionals By Location
Advertising and Promotion
California's Proposition 65
Business Counseling and Transactional
Chemical Control REACH
Employment and Labor
Environmental and Toxic Tort Litigation
Food and Drug
Tobacco and E-Vapor
Health and Safety Compliance Audit
International Regulatory Affairs
Nanotechnology Strategy, Regulation and Defense
Biocidal Products Regulation (BPR)
Privacy and Internet
Product Stewardship, Green Chemistry and Sustainability
Trade and Professional Associations
Workplace Safety and Health
Washington, DC Office
San Francisco Office
News & Events
Summer Associate Program
FTC and VTech Settle Alleged COPPA Privacy and Security Violations
Jan 10, 2018
Kids love connected toys, and the market for them is expanding rapidly. But companies that deal with any online service directed to kids must ensure that consumer privacy is protected, the data they collect is properly secured, and parents are engaged where necessary. So, when news broke in
that electronic toymaker VTech allegedly collected personal data on hundreds of thousands of children without permission and hackers were able to access files, it appears that the Federal Trade Commission (FTC) launched an investigation that has now ended with an important
, including an injunction and payment of a civil penalty of $650,000.
Although the FTC has initiated multiple enforcement actions over the years for violations of the Children's Online Privacy Protection Act (COPPA), this is the first time a COPPA enforcement action has settled allegations of both security and privacy violations. The FTC alleged that VTech's Kid Connect app used with some of VTech's electronic toys collected the personal information of hundreds of thousands of children without providing the direct notice to parents required under COPPA, and without obtaining verifiable consent from parents. The FTC also alleged that VTech failed to use reasonable and appropriate data security measures to protect the personal information it collected, in violation of Section 5 of the FTC Act.
The Order reinforces a point clear from the COPPA Rule: COPPA requires reasonable security of children's data. In addition to paying a $650,000 civil penalty, VTech agreed to a set of compliance measures, including avoiding misrepresentations about security, and implementing comprehensive data security and assessment programs verified by a competent third party. The Order makes clear that a reasonable security program should also include designating a responsible employee or team of employees, training all employees, and imposing appropriate security requirements on third-party partners by contract.
COPPA applies to all online services, including websites, apps and connected kids' products. It includes obligations not only to minimize data collection, post privacy notices, directly notify parents, and obtain parental consent where required, but also to implement reasonable safeguards to protect children's data. Reasonable safeguards do not mean infallible safeguards or a one-size-fits all standard, but a process to manage security risks. The Order establishes that an appropriate security program for children's data under COPPA must include the use of regular assessments, testing, and monitoring to ensure that security checks are functioning effectively, similar to the types of requirements that have appeared in consent agreements involving security of adults' data.
COPPA compliance can be challenging in a quickly changing digital landscape. The settlement agreement serves as a reminder of the central importance of knowing the legal obligations under COPPA, understanding and managing your data flows, and implementing compliance procedures. It also reinforces a basic point about the importance of accurately describing your privacy and security practices: if you say what you'll do, you'd better do what you say.
For more information, contact Sheila A. Millar at
; Tracy P. Marshall at
Nathan A. Cardon at
. Subscribe to our blog, the
Consumer Protection Connection
for regular in-depth analysis and updates on important consumer protection developments.
Sheila A. Millar
Tracy P. Marshall
Nathan A. Cardon
Privacy, Data Security and Digital Media
Join our Mailing List
Updated Privacy and Cookies Policy
© 2018 Keller and Heckman LLP. All rights reserved