FTC Announces COPPA Settlement Against Ed Tech Provider Including Strict Data Minimization and Data Retention Requirements

On May 22 the Federal Trade Commission ("FTC") announced a $6 million settlement with Edmodo, an ed tech provider, for violations of the COPPA Rule and Section 5 of the FTC Act. The FTC described this settlement as the first FTC order that will prohibit an ed tech provider from requiring students to provide more personal data than necessary to participate in online activities. The settlement is consistent with the FTC's policy statement on ed tech issued last May (see our summary of the policy statement here).

The complaint alleges that Edmodo violated COPPA by failing to provide notice and obtain verifiable parental consent before collecting personal information from children under the age of 13. Specifically, the complaint alleges that Edmodo's reliance on schools and teachers to provide verifiable parental consent as agents of parents was not permissible because (1) Edmodo did not provide the required direct notice of its practices as to the collection, use, or disclosure of personal information from children and (2) Edmodo's used student's personal information for contextual advertising which exceeds the limited educational context for which school and teachers may provide consent. The complaint also alleges that Edmodo failed to inform teachers and sole of its reliance on them as intermediaries to provide notice and obtain authorization from parents and failed to make reasonable efforts to ensure parents received notice and provided authorization.

In addition to violating COPPA's notice and consent provisions, the complaint alleges Edmodo collected more personal information from children than necessary to participate in educational activities and retained children's personal information longer than reasonably necessary.

Beyond COPPA, the complaint includes allegations that Edmodo violated Section 5 by telling schools and teachers that they were "solely" responsible for COPPA compliance while providing allegedly "confusing and inaccurate information" about obtaining consent under COPPA, thus unfairly burdening teachers and schools with Edmodo's own COPPA compliance responsibilities. According to the FTC's press release, this is the first time the FTC has used Section 5 to allege an unfair trade practice in the context of an ed tech operator's interaction with schools.

The proposed order includes the following relief:

• Edmodo is prohibited from (1) relying on schools to act as intermediaries to obtain verifiable parental consent on behalf of Edmodo, or (2) relying on school authorization for collecting personal information from children unless Edmodo enters into a written agreement with the school that includes the following: limits use of personal information to educational purposes only, describes all personal information collected from students and how it will be used and disclosed, provides the school a link to the online notice and recommends the school make it available on the school's website, requires a school representative to acknowledge and agree that they have the authority to provide consent, and states that any personal information collected by Edmodo is under the direct control of the school with regard to use and maintenance.
• Edmodo may not collect more personal information than reasonably necessary for the child to participate in the online service.
• Edmodo must destroy all personal information collected prior to the entry of the order for which Edmodo does not receive verifiable parental consent or school authorization within 60 days.
• Edmodo must maintain and adhere to a data retention schedule with a maximum retention period of one year.
• Edmodo must destroy any models or algorithms developed in whole or in part using personal information collected from children without verifiable parental consent.

The order also defines an "educational purpose" to be "any use related to a child's education including, but not limited to, instruction in the classroom or at home, administrative activities, and collaboration between students, school personnel, or parents." Notably, the definition of an educational purpose does not include "commercial purposes unrelated to the provision of the online service requested by the school such as advertising or building user profiles."