On May 22, 2023, the Federal Trade Commission (FTC) obtained a Proposed Stipulated Order to resolve alleged violations by Edmodo, LLC (Edmodo), an educational technology company, of the Children’s Online Privacy Protection Act (“COPPA”), 15 USC §§ 6502(c) and 6505(d), and the COPPA Rule, 16 CFR Part 312, promulgated thereunder, and Section 5 of the FTC Act, 15 USC § 45(a) and (n). The parties stipulated to the payment of a $6 million civil penalty, but payment will be suspended due to Edmodo’s inability to pay.
Edmodo is headquartered in San Mateo, California, but during the FTC investigation, it suspended operations in the United States. Between 2018 and September 2022, Edmodo provided a free online platform where teachers could create a virtual classroom, share materials, record student assessments, and communicate directly with pupils and parents. Edmodo also offered a similar subscription-based service to schools and school districts. Both services allowed Edmodo to collect personal information about students, including name, birthdate, grade in school, email address, IP address, device type, browser, operating system and geographic location.
Per the Complaint – filed on behalf of the FTC by the Department of Justice in the Northern District of California on May 22, 2023 – Edmodo used personal information it collected about students via its online educational platforms to serve contextual advertising to children under the age of 13, and it knowingly allowed third-party advertisers to collect persistent identifiers such as IP addresses from students without first obtaining verifiable parental consent, in violation of the COPPA Rule. In addition, Edmodo retained children’s information “indefinitely” – at least before new policies were put in place in March 2020, after which Edmodo failed to justify its new policy of retaining data for two years for inactive accounts. The COPPA Rule requires that children’s personal information be retained only as long as is reasonably necessary.
The Complaint explains that Edmodo’s terms of service suggested that schools and teachers would be responsible for obtaining parental consent; however, this reliance does not satisfy the COPPA Rule, which requires operators of online services to provide direct notice of information practices to the school or teacher, and use reasonable efforts to obtain authorization from the school on behalf of the parents. Edmodo neither provided direct notice of its information practices to the schools, nor obtained the schools’ authorization as agents on behalf of the parents or as intermediaries. Regardless, Edmodo could not have relied on the users of its products (teachers and schools) to obtain parental consent, since the company’s use of the data was commercial rather than educational.
If approved by the court, and should Edmodo resume US operations, the Proposed Stipulated Order would impose a civil penalty and prohibit Edmodo from using or disclosing information previously and unlawfully collected from children, requiring the Company destroy all such information unless verifiable consent has been given for its use and retention. The Proposed Stipulated order would further require Edmodo to make reasonable efforts to ensure parental consent going forward; post a clear and conspicuous link to an online notice of the company’s information practices; obtain consent prior to collection or use of children’s personal information; retain children’s personal information for not longer than reasonably necessary, and maintain and disseminate a retention schedule for such data; not condition a child’s participation in an activity on the provision of any more personal information than is necessary for the activity itself; and not rely on schools as intermediaries for obtaining parental consent or to authorize the collection of children’s personal information, absent a written agreement that satisfies requirements set forth in the order.
Pursuant to the proposed order, during a ten-year period Edmodo must maintain records of its compliance and accounting practices and consumer complaints, retain such records for five years, and cooperate with the FTC when asked to provide documentation of compliance.