COPPA: When Parents Change Their Mind

I’ve spent the last few blog posts describing the many things you are required to do in order to comply with the latest update of the U.S. COPPA law.  You have positively identified the parent, given them an up-to-date disclosure of all the private data your game and your ad networks capture, and they have approved your game for their children’s use.  Junior is happily playing the game.  What could go wrong?

Well, a couple of things could happen.

Any privacy changes in your game require the parent to approve it again

COPPA states that if the private data captured by your game changes at any time after your initial privacy disclosure, you have to get the parent’s approval again.  But of course, that wouldn’t happen very often, would it?  Actually, it probably will.

Like most game developers, you have probably integrated a variety of ad networks into your game. What happens if one of those ad networks changes the data they capture? In order to comply with COPPA, they must tell every developer who uses their network that a change has been made, and in turn, each developer must get parental approval for the changes. To make more money by serving ads that deliver better results, ad networks are competing with each other by tinkering with their analytics and targeting. So, if you use many ad networks, the likelihood of this happening is actually fairly high.

Parents can change their mind about giving you permission

The other thing that could go wrong is if the parent sees something in your game that they don’t like and decides to change their mind about giving permission.  In the language of COPPA, that’s called “Parental Permission Revocation”.  By law, you are required to give them a way to contact you to rescind their permission for junior to run the game. When that happens, COPPA compliant developers must:

AgeCheq has built a first-of-its-kind “Compliance as a Service” platform that handles these complex notifications and disclosures for game developers; but at the end of the day, the responsibility is on you, the game developer to manage the data you capture, manage the privacy issues of all third party APIs you use, and to “do the right thing” when a parent changes their mind about your game. 

How to improve your privacy law compliance by design and actions

As a first step, never capture any player information unless you have a compelling reason to do it. Every data item you capture increases your risk. Storing the private data further increases it, and providing it to third parties increases the risk even more.

As you design new games, consider organizing your player data in ways that would make it easier for you to erase that data completely if you received a request to do so. Interrogate your ad networks to see if they have a method to delete user data when notified by you.  Don’t accept “We’re COPPA Compliant” as an answer. Everyone thinks they are, and very few are right.  If you end up on the wrong end of an FTC COPPA complaint with thousands of children’s private data, it could be a career ending mistake.

If you'd like to educate yourself on COPPA, here's a page of history and links we've created for game developers at AgeCheq. To learn more about COPPA directly from The Federal Trade Commission, check out this list of answers to frequently asked questions: http://business.ftc.gov/documents/Complying-with-COPPA-Frequently-Asked-Questions