Don't Forget To Hit "Delete": FTC Blog Post Clarifies COPPA Information Deletion Requirement

Most companies are familiar with the Children's Online Privacy Protection Act (COPPA) and its requirement to obtain parental consent before collecting personal information online from children under 13. Yet COPPA also includes an information deletion requirement of which companies may be unaware. On May 31, 2018, the Federal Trade Commission (FTC) published a blog post addressing this requirement, clarifying (i) when children's personal information must be deleted and (ii) how the requirement applies, as well as (iii) recommending that covered companies review their information retention policies to ensure they are in compliance.

1. COPPA's information deletion requirement. The FTC clarifies that, under Section 312.10 of COPPA, companies may retain children's personal information "for only as long as is reasonably necessary to fulfill the purpose for which the information was collected." After that, a company must use reasonable measures to ensure such