COPPA: When persistence doesn’t pay

[Commentary] Some operators of websites and online services directed at children would do well to learn a lesson that youngsters often know: ask permission before using something that’s not yours. For a quick primer, companies may want to check out two settlements that the Federal Trade Commission announced with the operators of mobile apps for children. The settlements provide for civil penalties totaling $360,000 against the operators, who the FTC charged violated the Children’s Online Privacy Protection Act (COPPA) Rule by letting third-party advertising networks use their apps to collect children’s personal information without their parents’ knowledge or consent.

What kind of personal information were the apps collecting? That’s where it gets really interesting. According to the FTC, the apps collected “persistent identifiers,” or data that can be used to recognize a user -- in this case, a child -- over time and across different websites. Advertisers use identifiers to track online behavior and target their ads based on what the users’ behavior reveals about them. The FTC said the app operators allowed the advertising networks to collect persistent identifiers from children using their apps so that advertisers could serve targeted advertising.