The Children’s Online Privacy Protection Act (COPPA) is a U.S. federal law designed to protect the privacy of children under age 13. It applies to operators of websites or online services directed to children, as well as those who knowingly collect personal information from children (16 CFR Part 312).
While many organizations focus on front-end compliance obligations, COPPA also places significant emphasis on what happens to that data over time. Significantly, data deletion is a central requirement of COPPA, and it is a requirement that is overlooked at an organization’s peril.
COPPA Requirements – Deletion Is Not Optional
At its core, COPPA requires organizations to be transparent and responsible in how they handle children’s personal information. Among its requirements are:
- Providing clear notice of information practices
- Obtaining verifiable parental consent before collecting personal information from children under 13
- Ensuring parents the right to review and delete their child’s personal information
- Implementing reasonable safeguards to protect that information
These requirements are widely understood. However, one of COPPA’s most important and often overlooked mandates relates to data deletion.
Under COPPA, “Personal information collected online from a child may not be retained indefinitely.” COPPA requires organizations to delete a child’s personal information when it is no longer needed for the purpose for which it was collected (16 CFR 312.10). The Federal Trade Commission leaves little room for doubt that data deletion is central to COPPA compliance, stating unequivocally that “under COPPA, data deletion isn’t just a good idea. It’s the law.”
To comply with these obligations, organizations must establish and maintain a written data retention policy that:
- Identifies why children’s information is collected;
- Defines the business needs and purpose for retaining children’s information; and
- Specifies a timeframe for deletion of that information.
Without a strong information governance program and current retention schedule, meeting these obligations can be a challenge. Retention policies often focus heavily on how long to keep information, while giving far less attention to when and how to dispose of it.
Practical Implications for Information Governance
COPPA’s deletion mandate highlights the critical role of well-designed information governance programs. Organizations should take a proactive approach by:
- Evaluating whether COPPA applies to any part of the organization’s operations
- Reviewing existing data governance policies for alignment with COPPA requirements
- Confirming that processes exist to delete children’s personal information promptly once no longer needed
How We Can Help
Developing or updating retention and disposition programs to align with COPPA and other regulatory frameworks can be complex. If you would like assistance assessing your current practices or strengthening your compliance posture, please contact:
Tom Corey | TCorey@gunster.com
Lisa Lukaszewski | LLukaszewski@gunster.com
YES! PLEASE SIGN ME UP TO RECEIVE EMAIL ALERTS FROM OTHER GUNSTER PRACTICE AREAS.
Gunster. Florida's Law Firm for Leaders.
As a full-service law firm, Gunster provides legal counsel to leading organizations and individuals from its 13 offices statewide. Established in 1925, the firm has expanded, diversified, and evolved, but always with a singular focus: Florida and its clients’ stake in it. A magnet for business-savvy attorneys who embrace collaboration for the greatest advantage of clients, Gunster’s growth has not been at the expense of personalized service but because of it. The firm serves clients from its offices in Boca Raton, Coral Gables, Fort Lauderdale, Jacksonville, Miami, Naples, Orlando, Palm Beach, Stuart, Tallahassee, Tampa, Vero Beach, and its headquarters in West Palm Beach. With more than 320 attorneys and consultants and 300 committed support staff, Gunster is ranked among the top 200 largest law firms by the National Law Journal and has been recognized as one of the Top 100 Diverse Law Firms by Law360. More information about its practices, industries, offices, and news is available at www.gunster.com.
