Skip to main content

COPPA Makes its Mark on HBO’s Silicon Valley


You know you’ve made it when you’re featured on HBO’s hit comedy, Silicon Valley, the show that portrays the hilarious ups and downs of a Bay Area tech start-up.  The Children’s Online Privacy Protection Act (COPPA) got a starring role last week in the second episode – “Term of Service” – of the show’s 4th Season on HBO.

To recap, Dinesh Chugtai, CEO of the company that developed the wildly popular app “PiperChat,” has a breakdown when he realizes that the video chat app violates COPPA because 1/3 of its users are kids under 13 years old.  He loses his power-trip swagger when the start-up’s ex-con lawyer tells him about the $16,000 per usage violation –potential fines in the billions of dollars – and eventually collapses in a pitiful heap in the company bathtub. 

What Dinesh and the show’s writers don’t know is that it in June 2016, the FTC announced that it would be increasing its maximum civil penalty amount from $16,000 to $40,000 per violation under COPPA.

Had Dinesh turned to the Children’s Advertising Review Unit (CARU) before taking PiperChat live, we would have explained exactly what he needed to do to keep his “incredible” app on the right side of the law.

As a long-time expert in the COPPA arena, CARU works with app developers and website operators from the conceptual stage through to launch and beyond to help companies incorporate best privacy practices into their design. 

COPPA imposes specific requirements on operators of websites and online services directed to children or those that have actual knowledge that children are on their service.  The law was recently updated in 2013 to include photos, videos and audio files containing a child’s voice or image in its definition of what is personally identifiable information .

The good news for the guys at PiperChat is that the FTC rarely fines companies such large amounts and looks at a number of factors when considering penalties including, among other factors, the level of harm to the public, gains made by the company, and the defendant’s ability to pay.  In a recent FTC settlement, the FTC took the company’s ability to pay into consideration and only fined the advertising platform, InMobi, $950,000, which similar to PiperChat, could have amounted to billions.

The bad news is that the fine here would still be quite large because it is a video chat app.  The harm in this case would be considerable because children could communicate via video chat, thereby publicly disclosing their personally identifiable information: photos, videos and audio recording of themselves. 

The best news is that for non-fictional companies operating in the children’s space, there is a real-world organization that exists to provide clear guidance on COPPA and otherwise assure that marketing to children is truthful, accurate, not misleading and appropriate.

We don’t anticipate that the show’s writers will be turning to CARU for advice on plot and structure, given that strict compliance with all applicable laws and regulations doesn’t make for exciting TV.

We do, however, stand ready to help companies of all sizes comply with COPPA’s provisions and CARU’s guidelines. 


Popular posts from this blog

20 Years Young: The History and Maturing of COPPA in a Privacy-Conscious Age

1998: A Concern for Children’s Privacy Was Born From the moment home computers had the capacity to connect to the Internet, children had the ability to use these technologies to access online websites and services. In the 1990s, concerns about children’s privacy and safety online arose amid fears of marketing practices around selling children’s personal information and exposing children’s information to predators. The Children’s Advertising Review Unit (CARU), founded in 1974, has always been on the forefront of safeguarding children’s privacy. CARU is the self-regulatory arm of the children’s advertising industry, tasked with promoting truth in children’s advertising by reviewing and evaluating child-directed ads in all media to ensure they are truthful, accurate and appropriate. CARU also monitors online privacy practices as they affect children. Before there was any legislation on the matter, CARU monitored a burgeoning Internet and observed how children’s privacy and sa...

After Review, CARU Finds Snapchat Compliant with COPPA

In a recent decision, CARU found Snap Inc.’s (Snap) Snapchat app to be compliant with both the CARU Guidelines and the Children's Online Privacy Protection Act (COPPA).  “The company goes beyond minimal procedures to prevent under-age use” CARU stated. CARU determined that Snapchat is an app directed to a general audience, not intended for use by children. In reaching this conclusion, CARU considered that Snap’s Terms of Service clearly prohibit users under 13 years of age and makes no effort to market the app to children or provide them with an appealing user experience.  With that understanding, Snapchat is permitted under the Guidelines and Children’s Online Privacy Protection Act (“COPPA”) to age-gate and block children under 13 from using its services, which it does. CARU then examined whether Snapchat does so effectively. CARU observed that Snapchat utilizes age-gates and many safeguards to ensure that if children manage to breach the existing age-...

i-Dressup Shuts Down in Wake of Privacy Breach and COPPA Violation

I-Dressup, a fashion-themed social website for teens, has completely shut down as part of a settlement with the New Jersey Department of Consumer Affairs, following a massive privacy breach and violations of the federal Children's Online Privacy Protection Act (COPPA) and New Jersey state law. In September 2016, a hacker sent 2.2 million i-Dressup account credentials to technology blog Arstechnica as well as to haveibeenpwned.com, a searchable online database of data breaches. Responding to the news, New Jersey investigators discovered that 2,519 of the compromised accounts belonged to New Jersey children below age 13. I-Dressup, allegedly aware that it had child users, had violated COPPA by failing to obtain verifiable parental consent prior to collecting and processing personal information from the children, including first and last names and email addresses. In a consent decree with the New Jersey Attorney General Gurbir Gerwal, parent company...