The Federal Trade Commission has published a new guide that seeks to make compliance with the Children’s Online Privacy Protection Act (COPPA) as easy as 1, 2, 3, 4, 5, 6. Drawing from its detailed FAQs, the FTC has developed an even more stream-lined, six-step DIY instruction manual designed for busy businesses that want a basic compliance document that can help them pinpoint areas in their data management flow that might require additional attention.

The FTC’s Six-Step Compliance Plan for Your Business describes in some detail:

  1. How to determine if your company is operating a website or online service that collects personal information from kids under 13;
  2. Whether your company has effectively posted an appropriate privacy policy;
  3. Whether your company is appropriately notifying parents directly before collecting personal information from kids under 13;
  4. How to obtain “verifiable parental consent” before collecting personal information from kids under 13;
  5. Whether your company has a system in place to honor parents’ ongoing rights with respect to the personal information collected from kids under 13; and
  6. Whether your company has implemented reasonable procedures to protect the security of kids’ personal information.

As an added bonus, the FTC has also fleshed out in a useful chart how a company can comply with the enumerated exceptions that permit a company to collect some personal information from a child under 13 with less than full-blown “verifiable parental consent.”

It is worth noting, as was identified by other commenters, that in this document, the FTC specifically calls out the applicability of COPPA in the context of “connected toys or other Internet of Things devices.” This has not been highlighted previously in the COPPA FAQs, although toys that learn, collect, and possibly share a child’s voice, photos, or other personal information are an area of high interest at the FTC.

There is interest also on Capitol Hill (at least from the Democrats) in ensuring that the FTC adequately polices this growing segment of the Internet of Things. Public interest groups have also been actively urging the Commission to be vigilant when it comes to connected toys and devices directed to children. There’s no question the Internet of Things will take center stage in the coming months at the FTC, and connected toys are in the spotlight. The Commission’s new compliance guide will be a useful tool as companies face this scrutiny.