Meta Flouts the Children's Online Privacy Protection Act

A. COPPA requires Meta to obtain verifiable parental consent for Instagram and Facebook users under the age of 13.

633. COPPA prohibits social media companies like Meta from collecting personal information from children without first obtaining verifiable parental consent if: (a) the operator of the social media platform has actual knowledge that it is collecting personal information from a child; or (b) the operator’s service is directed to children. 15 U.S.C. § 6502(a)(1).

634. Meta’s operation of Instagram and Facebook is subject to COPPA’s verifiable parental consent requirement under both of the two statutory triggers: (a) Meta routinely obtains actual knowledge that users on Instagram and Facebook are under 13 years old; and (b) Meta targets children as users of Instagram and Facebook, making the Platforms directed to children. See 16 C.F.R. § 312.2.

635. The term “child” is defined by 15 U.S.C. § 6501(1) to mean an individual under the age of 13. The terms “child,” “children,” “under-13 user(s),” “U13 users,” and “child-users” herein refer to children under the age of 13.

636. “Verifiable parental consent” requires, at a minimum, providing a child’s parent with notice of Meta’s “personal information collection, use, and disclosure practices” and further requires Meta to obtain the parent’s authorization for Meta to collect, use, or disclose the child’s information. Both of these requirements must be completed before Meta may collect a child’s information. 15 U.S.C. § 6501(9).

637. Meta does not obtain—or even attempt to obtain—verifiable parental consent before collecting the personal information of children on Instagram and Facebook. “Personal information” is defined by statute and regulation to mean “individually identifiable information about an individual collected online,” including the child’s name, address, email address, personal identifiers, geolocation information, and photographs or videos of the child, among other categories of information. 15 U.S.C. § 6501(8); 16 C.F.R § 312.2. Meta collects personal information in these categories from all registered users of Instagram, including children.

638. Instead of obtaining verifiable parental consent, Meta relies on Instagram’s and Facebook’s nominal bans on under-13 users to avoid any responsibility under COPPA to its under-13 users and their parents. [Redacted] Meta is not exempt from COPPA.

639. COPPA empowers State Attorneys General to bring suit against companies that violate the verifiable parental consent requirement. COPPA permits State Attorneys General to obtain injunctive relief, damages, restitution, and other relief on behalf of residents of their States. 15 U.S.C. § 6504(a)(1).

640. COPPA also requires the FTC to promulgate regulations consistent with the statute’s verifiable parental consent requirement as well as the “actual knowledge [of a] child” and “directed to children” statutory triggers. 15 U.S.C. § 6502(b). The FTC has promulgated such regulations as the Children’s Online Privacy Protection Rule. See 16 C.F.R. § 312.1 et seq. (COPPA Rule) (last promulgated Jan. 17, 2013).

641. Under COPPA and the COPPA Rule, Meta is subject to COPPA’s “verifiable parental consent” requirement—but Meta flouts its obligations under COPPA with respect to its operation of Instagram and Facebook.