Enforcement Policy Statement Regarding the Applicability 

of the COPPA Rule to the Collection and Use of Voice Recordings 

On November 3, 1999, the Federal Trade Commission (“FTC” or “Commission”) issued 

its Children’s Online Privacy Protection Rule (“COPPA Rule” or “Rule”). The Rule implements 

the Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501–6505, and requires, among 

other things, operators of commercial websites or online services directed to children, and 

operators with actual knowledge they are collecting personal information from children, to 

provide notice of their information practices to parents and to obtain verifiable parental consent 

before collecting a child’s personal information. The Rule defined “personal information” to 

include data such as name, address, and social security number. 

In 2013, the FTC amended the COPPA Rule and added several new types of data to the 

definition of personal information, including a photograph, video, or audio file that contains a 

child’s image or voice.1 Discussing the 2013 amendments, the Commission explained that “the 

very personal nature” of such files supported the Commission’s finding that they met the 

standard for personal information set forth in the COPPA statute because they “permit the 

physical or online contacting of a specific individual.” 78 Fed. Reg. 3972, 3982 (Jan. 17, 2013). 

Therefore, under the amended Rule, a covered operator must provide notice and obtain verifiable 

parental consent before it collects any of these types of personal information from a child. The 

Commission’s rationale in amending the Rule was to keep pace with changes to technology, 

children’s increased use of mobile devices, and the development of new business models that did 

not exist when the Commission issued the Rule in 1999. 

Since amending the Rule, the Commission has received inquiries from a number of 

companies about whether the practice of collecting audio files that contain a child’s voice, 

immediately converting the audio to text, and deleting the file containing the voice recording 

triggers COPPA’s requirements. In particular, these companies have requested that collection of 

audio files in connection with a search or similar function be exempted from COPPA’s verifiable 

parental consent requirement when the audio file is briefly maintained in order to fulfill the 

request and then deleted almost instantaneously. 

In relevant part, the Rule defines “collects or collection” to mean: 

the gathering of any personal information from a child by any means, including but not 

limited to: 

(1) Requesting, prompting, or encouraging a child to submit personal information online; 

(2) Enabling a child to make personal information publicly available in identifiable form. 

An operator shall not be considered to have collected personal information under this 

paragraph if it takes reasonable steps to delete all or virtually all personal information 

1

 The prior definition included photographs only when combined with additional information that would allow 

physical or online contacting of the child. 

1 
 

 

from a child’s postings before they are made public and also to delete such information 

from its records . . . .2 

The Commission views the collection from a child of an audio file when the voice is 

being used solely as a replacement for written words, such as to convert voice to text in order to 

perform a search, as falling into the first prong of the definition of “collection” because the 

operator is “requesting, prompting, or encouraging” the child to submit personal information. 

Because this practice falls into the first category of “collection,” the Rule does not provide a 

mechanism for the operator to avoid being deemed to have collected the personal information by 

deleting it. In other words, as soon as the operator gathers the audio file, it has collected it for 

purposes of the COPPA Rule regardless of how long the operator maintains possession of it. 

The second prong of the definition is meant to address the inadvertent collection of personal 

information, such as information that might be collected incidentally in an open text field, which 

is why the Rule specifically allows an operator to be deemed not to have collected the personal 

information if it takes reasonable measures to delete the information. 

Nevertheless, the Commission recognizes the value of using voice as a replacement for 

written words in performing search and other functions on internet-connected devices. Verbal 

commands may be a necessity for certain consumers, including children who have not yet 

learned to write, or the disabled. In addition, when the operator only uses the audio file as a 

replacement for written words, such as to effectuate an instruction or request, and only maintains 

the file long enough to complete that purpose and then immediately deletes it, there is little risk 

the audio file will be used to contact an individual child. 

As such, when a covered operator collects an audio file containing a child’s voice solely 

as a replacement for written words, such as to perform a search or fulfill a verbal instruction or 

request, but only maintains the file for the brief time necessary for that purpose, the FTC would 

not take an enforcement action against the operator on the basis that the operator collected the 

audio file without first obtaining verifiable parental consent. Such an operator, however, must 

provide the notice required by the COPPA Rule, including clear notice of its collection and use 

of audio files and its deletion policy, in its privacy policy. 

There are important limitations on this non-enforcement policy. First, this nonenforcement policy is not applicable when the operator requests information via voice that 

otherwise would be considered personal information under the Rule, such as name, for example. 

Second, as noted above, an operator must provide clear notice of its collection and use of the 

audio files and its deletion policy in its privacy policy. Otherwise, parents may have no way to 

know prior to download or purchase whether audio files are being collected, and if they later 

learn that audio files are being collected, they would have no reason to know that the files are 

being collected only for a limited purpose and immediately destroyed. Third, the operator may 

not make any other use of the audio file in the brief period before the file is destroyed — for 

example, for behavioral targeting or profiling purposes, for identification purposes through voice 

recognition, or for posting, selling, or otherwise sharing the file with third parties. Finally, this 

policy does not affect the operator’s COPPA compliance requirements in any other respect. For 

2

 The third prong of the definition relates to passive tracking of a child online and is not relevant to this discussion. 

2 
example, the operator must provide notice and obtain verifiable parental consent if types of 

personal information other than audio files are also collected. 

3