Does the Children’s Online Privacy Protection Act [1], work? One of the ways to try to answer this question is the number of cases. There are less than 40 in total since the act was passed more than a decade ago. In other words, less than 4 enforcements on average per year.
Beyond just the number of enforcements, there is also the question of sanctions i.e. how damaging it is to a company in terms of fines to be enforced. The original maximum civil penalty per violation (e.g. a single data collection event on a single user) was $16,000, but it was recently raised to $40,000 [2] by the FTC. This sure sounds nice on paper, but the keyword, as we will find out below, is ‘maximum’. The actual penalties end up being a far cry from the promise.
Using the 15 enforcements where number of violations is published, which total in 103,272,600 violations, the average per violation fine is $8,760,000. This means the average fine per violation is $0.08. This is including the most recent InMobi case estimated at 100,000,000 violations, when the filings suggest there was multiple times more [3]. If we exclude this as anomaly, the remaining 14 cases yield 3,272,600 violations and fines of $7,810,000 and a $2.36 per violation fine. This is still 8,000 times less than the $16,000 per violation stipulated in COPPA.
The maximum cost-per-violation is $266 for 3,000 violations, and the only significant case in terms of the stated violations, the cost-per-violation is $0.01. Even the maximum is still over 50 times smaller than the stated $16,000 and well over 100 times smaller than the current $40,000 maximum fine per violation. In short summary, the closest anyone ever got to the maximum is 2% of it.
A Comprehensive List of COPPA Enforcements
|
year |
fine |
reach |
cost per |
|
|
InMobi |
2016 |
950,000 |
100,000,000 |
0.01 |
|
Viacom |
2016 |
500,000 |
na |
na |
|
Mattel |
2016 |
250,000 |
na |
na |
|
JumpStart |
2016 |
85,000 |
na |
na |
|
LAI Systems |
2015 |
65,000 |
na |
na |
|
Retro Systems |
2015 |
300,000 |
na |
na |
|
TinyCo, Inc |
2014 |
300,000 |
na |
na |
|
Yelp Inc |
2014 |
450,000 |
na |
na |
|
Path, Inc |
2013 |
800,000 |
3,000 |
266.67 |
|
Artist Arena, LLC |
2012 |
1,000,000 |
75,000 |
13.33 |
|
RockYou, Inc |
2012 |
250,000 |
79,000 |
3.16 |
|
SkidleKids |
2011 |
100,000 |
5,600 |
17.86 |
|
W3 Innovations |
2011 |
50,000 |
50,000 |
1.00 |
|
Playdom, Inc. |
2011 |
3,000,000 |
1,224,000 |
2.45 |
|
Iconix Brand Group, Inc. |
2009 |
250,000 |
1,000 |
250.00 |
|
Sony BMG Music Entertainment |
2008 |
1,000,000 |
30,000 |
33.33 |
|
Industrious Kid, Inc. and Jeanette Symons |
2008 |
130,000 |
10,500 |
12.38 |
|
Imbee |
2008 |
130,000 |
10,500 |
12.38 |
|
Xanga.com, Inc. |
2006 |
1,000,000 |
1,700,000 |
0.59 |
|
UMG Recordings, Inc. |
2004 |
400,000 |
na |
na |
|
Bonzi Software, Inc. |
2004 |
75,000 |
na |
na |
|
Mrs. Fields Famous Brands, Inc. |
2003 |
100,000 |
84,000 |
1.19 |
|
Hershey Foods Corporation |
2003 |
85,000 |
na |
na |
|
Ohio Art Company |
2002 |
35,000 |
na |
na |
|
American Pop Corn Company |
2002 |
10,000 |
na |
na |
|
Frank, Lisa, Inc. |
2001 |
30,000 |
na |
na |
|
Looksmart, Ltd |
2001 |
25,000 |
na |
na |
|
Monarch Services, Inc., et al. |
2001 |
25,000 |
na |
na |
|
Bigmailbox.Com, Inc., et al. |
2001 |
30,000 |
na |
na |
|
Girls Life Inc |
2001 |
25,000 |
na |
na |
|
Nolan Quan |
2001 |
25,000 |
na |
na |
|
Toysmart.com, LLC |
2000 |
35,000 |
na |
na |
References
[1] https://en.wikipedia.org/wiki/Children%27s_Online_Privacy_Protection_Act
[2] https://www.wsgr.com/WSGR/Display.aspx?SectionName=publications/PDFSearch/wsgralert-ftc-violations.htm
[3] https://www.ftc.gov/news-events/press-releases/2016/06/mobile-advertising-network-inmobi-settles-ftc-charges-it-tracked