Is your Podcast subject to COPPA?

Recently, many YouTube creators have struggled with/complained loudly about the platform’s new rules for designating content directed at children. This, of course has led podcasters, too to become concerned and to wonder whether COPPA applies to them.

COPPA, which stands for Child Online Privacy Protection Act, was enacted by the U.S. Congress in 1998 and has undergone some revision, most recently in 2013. The law can be found at Title 15 U.S. Code § 6506

On September 4, 2019, the FTC issued a fine of $170 million to YouTube for COPPA violations, including tracking viewing history of minors in order to facilitate targeted advertising. As a result, YouTube announced that as part of the settlement, in 2020 it would require channel operators to mark videos that are “child-oriented” as such, and would use machine learning to automatically mark those as clearly “child-oriented” if not marked already. In the settlement terms, channel operators that failed to mark videos as “child-oriented” could be fined by the FTC for up to $42,000 per video, which has raised criticism towards the settlement terms. (I have my doubts about whether this passing-of-the-buck can or will actually be enforced, but it’s got YouTubers in a bit of a panic).

But how might this law apply to podcasters?

Well, in a nutshell, here’s what the law requires:

Organizations that (1) operate a website or online service that is “directed to children” under 13 and that collects “personal information” from users or (2) knowingly collects personal information from persons under 13 through a website or online service.

Those website operators must:

• Post a clear and comprehensive online privacy policy describing their information practices for personal information collected online from persons under age 13;
• Make reasonable efforts (taking into account available technology) to provide direct notice to parents of the operator's practices with regard to the collection, use, or disclosure of personal information from persons under 13, including notice of any material change to such practices to which the parents has previously consented;
• Obtain verifiable parental consent, with limited exceptions, prior to any collection, use, and/or disclosure of personal information from persons under age 13;
• Provide a reasonable means for a parent to review the personal information collected from their child and to refuse to permit its further use or maintenance;
• Establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of the personal information collected from children under age 13, including by taking reasonable steps to disclose/release such personal information only to parties capable of maintaining its confidentiality and security; and
• Retain personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected and delete the information using reasonable measures to protect against its unauthorized access or use.
• Operators are prohibited from conditioning a child's participation in an online activity on the child providing more information than is reasonably necessary to participate in that activity.

An operator is considered as having actual knowledge of a user's age if the site or service asks for – and receives – information from the user that allows it to determine the person's age.  

So, for most podcasters, COPPA shouldn't be a big concern UNLESS your show is directed at (or reasonably likely to attract) an audience of kids, AND you are collecting data about them. (Such as through use of a mailing list subscription tool, or the like). Of course if your podcast is also published on a YouTube channel, you’ll need to comply with YouTube’s new rules about correctly marking your channel and/or episodes. (Youtube's explainer video)

And, if you DO collect subscriber email or other data, it’s probably wise to include a restriction indicating that subscriptions are limited to persons over the age of 13. You should also make sure your website's Privacy Policy and Terms of Use are up to date

Note: Podcast platforms may collect data about your subscribers that you aren't even aware of. Those platforms WILL need to comply with COPPA, and, like YouTube, could end up passing their responsibilities off to their customers. So, be sure to review any changes to Terms of Service, Privacy Policies or User Agreements carefully.