Settlement Offers Guidance On What "Reasonable" Security Means Under COPPA

The FTC's COPPA Guidance does an admirable job explaining the basics of what a business needs to do to comply with COPPA, but is vague as to how a business must protect personal information collected from children. The COPPA Guidance requires that a company use "reasonable procedures" to protect such information from unauthorized access or use, but does not explain what "reasonable procedures" means. This is, no doubt, by design; a specific list of security measures would quickly become obsolete and unhelpful.

A recent settlement with app-maker VTech offers some insight on how FTC conceives of "reasonable" security measures. The FTC alleged that VTech had represented that data related to parents and children would be transmitted in encrypted format, when in fact such data was often not encrypted. The FTC also alleged that VTech violated COPPA by not having a COPPA-compliant privacy policy on its website that explained how it collected, used, and disclosed data