FTC Announces COPPA Policy for Voice Recordings | Practical Law

FTC Announces COPPA Policy for Voice Recordings | Practical Law

The Federal Trade Commission (FTC) has clarified in recent guidance how the Children's Online Privacy Protection Act (COPPA) applies to internet-connected device companies and other businesses that collect and use children's voice recordings, immediately convert the audio to text, and then delete the audio files.

FTC Announces COPPA Policy for Voice Recordings

Practical Law Legal Update w-011-0895 (Approx. 3 pages)

FTC Announces COPPA Policy for Voice Recordings

by Practical Law Intellectual Property & Technology
Published on 24 Oct 2017 • USA (National/Federal)
The Federal Trade Commission (FTC) has clarified in recent guidance how the Children's Online Privacy Protection Act (COPPA) applies to internet-connected device companies and other businesses that collect and use children's voice recordings, immediately convert the audio to text, and then delete the audio files.
On October 23, 2017, the FTC provided additional guidance on how the Children's Online Privacy Protection Act (COPPA) applies to businesses that collect and use audio files containing children's voices when the audio files serve solely as a replacement for written words to perform searches, for example, or otherwise instruct internet-connected devices.
COPPA requires all commercial websites and online or mobile service operators that collect, use, or disclose personal information of children under 13 to first obtain verifiable parental consent. Under COPPA, personal information includes audio files containing a child's voice.
The FTC guidance stated that it will not take enforcement action against an organization for not obtaining parental consent before collecting an audio file with a child’s voice, provided that:
  • The organization collects the audio file solely as a replacement of written words, for example, to perform a search or to fulfill a verbal instruction or request.
  • The organization holds the audio file for the brief time necessary for that purpose and then immediately deletes it.
  • The organization provides clear notice of its collection, use, and deletion policies in its privacy policy.
The FTC also stated that may still take enforcement action when:
  • An organization requests and collects voice information that would otherwise be considered personal information under COPPA including, for example, a child's name.
  • The organization fails to provide notice of its collection, use, and deletion policy for the audio files in its privacy policy.
  • The organization uses the audio file before it is destroyed, such as for:
    • behavioral targeting or profiling;
    • voice-recognition identification; or
    • posting, selling, or sharing the file with third parties.
According to the FTC, this policy does not affect other COPPA compliance requirements, including obtaining verifiable parental consent if the operator collects personal information other than this type of audio file.
Organizations subject to COPPA should examine their practice of collecting audio files containing a child's voice to ensure that they comply with the FTC guidance. Organizations should also review and if necessary update their privacy policies to confirm that they provide clear notice of their collection, use, and deletion practices for the audio files.