COPPA and non-US websites

November 11, 2009 7:55 AM

Is a site based outside of the US, that allows US under-13s to join, required to comply with COPPA?

To me, question 19. of the COPPA FAQ's seems to clearly state that it would be - "Foreign-based websites must comply with COPPA and the Rule if they are directed to children in the United States, or if they knowingly collect personal information from children in the U.S.". However, the co-owner of the (still in development, at this point) website, insists that US law cannot possibly apply to a website run from outside of the US. So, I am wondering if I am misinterpreting this quote.

If it makes a difference (because what I read of COPPA refers to operators that are "involved in commerce" in the UnitI'ed States), the site will be free to join but will also have a paid membership option for extra content.

I do intend to meet with a lawyer to check over things before we launch, but for a number of reasons this won't happen for a while, and it'd be very helpful to know the answer to this question before then.

I would also appreciate links to any resources explaining these matters. "Internet Law for Dummies", if you will.

posted by lwb to law & government (5 comments total)

The FTC has been clear that they think COPPA applies if the website is directed to children even if it's not in the US.

Foreign-based websites must comply with COPPA and the Rule if they are directed to children in the United States, or if they knowingly collect personal information from children in the U.S. The definition of “operator” under both COPPA and the Rule includes foreign-based websites that are involved in commerce in the United States or its territories. As a related matter, U.S.-based websites that collect information from foreign children also are subject to COPPA and the Rule.

posted by jessamyn at 8:03 AM on November 11

I'm not sure about the answer to your specific question, but will note that the question of enforcement is separate from applicability.

The Georgetown Law Library has a research guide covering Computer Law. Some of those resources are available online -- others in print, which might not be as available where you are.

Franklin Peirce Law Center has collected and indexed the Congressional Research Service reports about intellectual property, cyberlaw, and electronic commerce (i.e. "Internet Law for Congress"). In many cases those reports will point to relevant laws and regulations and wider social and industry issues. They aren't updated, so if you're reading an old one I'd advise cross-referencing other sources.
posted by GPF at 8:47 AM on November 11 [2 favorites]

"The definition of “operator” under both COPPA and the Rule includes foreign-based websites that are involved in commerce in the United States or its territories."

This is probably the important bit. But: LAWYER. COPPA is both complicated and a big deal.
posted by Medieval Maven at 9:23 AM on November 11

I am not a US lawyer, but here's my two cents (Canadian): You probably should be concerned, particularly if you are in Canada or the European Union. Just as the FTC will want foreign websites with enough of a nexus with the US to comply with American consumer protection and privacy laws, foreign jurisdictions are looking for the FTC's cooperation going the other way. If you're in Canada and there's an issue, I would not be surprised to see the Canadian Privacy Commissioner get involved in a complaint, as the Commissioner here has an interest in making sure that the FTC will help cooperation for her cases on the other side of the border.

And, as said above, applicability and enforcement are different. Applicability is based on the criteria above and enforcement depends upon foreign cooperation, your having assets in the US, using US banks/PayPal for your payments or any of your executives ever stepping foot on US soil. Any one of the four and you've got problems.
posted by Hali at 10:33 AM on November 11

We are in Australia. I guess I am confused about how exactly it works that this US law is applicable to us.

My personal preference is not to collect any information from under 13's at all, but co-owner refuses to agree to anything that he considers kowtowing to U.S law unless I can prove that it legally applies to us. Bleh.
posted by lwb at 6:45 PM on November 11