1

JOINT MOTION FOR ENTRY OF PROPOSED STIPULATED ORDER

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

BRIAN M. BOYNTON, Principal Deputy Assistant Attorney General

ARUN G. RAO, Deputy Assistant Attorney General

AMANDA N. LISKAMM, Director

LISA K. HSIAO, Assistant Director

JAMES T. NELSON, Senior Trial Attorney

U.S. Department of Justice

Consumer Protection Branch

Civil Division

450 5th Street N.W.

Washington, DC 20001

Telephone: (202) 616-2376

james.nelson2@usdoj.gov

ISMAIL J. RAMSEY (CABN 189820)

United States Attorney

MICHELLE LO (NYRN 4325163)

Chief, Civil Division

VIVIAN F. WANG (CABN 277577)

Assistant United States Attorney

United States Attorney’s Office 

Northern District of California

450 Golden Gate Ave. 

San Francisco, CA 94102

Telephone: (415) 436-7136

vivian.wang@usdoj.gov

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

UNITED STATES OF AMERICA, 

 Plaintiff,

v.

EDMODO, LLC, a limited liability 

corporation.

 Defendant.

Case No. 

JOINT MOTION FOR ENTRY OF 

PROPOSED STIPULATED ORDER 

Plaintiff the United States of America and Defendant Edmodo, LLC (collectively, the “Parties”) 

have resolved all issues in this matter by the Proposed Stipulated Order for Permanent Injunction, Civil 

Penalty Judgment, and Other Relief, attached as Exhibit A, memorialized by the signatures at pages 20 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 1 of 36
through 22 ("Proposed Order"). A statement setting forth the reasons for settlement is attached as

Exhibit B.

In liglrt of this agreed-upon resolution of this action, the Parties respectf'ully request that the court

enter the Proposed Order.

3

4

5

8

9

Dated: $1tn, ZOZ:

10

11

t2

13

t4

15

16

I7

18

t9

20

2l

22

L-t

FOR DEEFENDANT:

Emily S.

Hannah

Orrick, Herrington & Sutcliffe LLP

i 152 l5th Street, NW, Washington, DC 20005

Tel (202) 339-8400

Enrai I : etabatab ai@orri ck. c onl

hlevin@orrick.com

Counsel fbr Edmodo LLC

JOINT MOTION FOR ENTRY OF PROPOSED STTPULATPO ORDEIT

CASE NO.

Respectfully submitted,

FOR THE TINITE,D STATES OF AMERICA:

BRIAN M. BO\TITON

Prirrcipal Deputy Assistant Attomey General

Civil Division

U.S. Department of Justice

ARLIN G. RAO

Deputy Assistant Attorney General

Civil Division

AMANDA N. LISKAMM

Director

LISA K. HSIAO

Assistant Director

Consurner Protection Branch

JAMES T. NELSON

Senior Trial Attorney

U.S. Department of Justice

Consumer Protection Branch

450 5th Street, NW

Sixth Floor, South

Washington, DC 20001

202-6t6-2376

Fax202 514-8742

j ames.nelson2@usdoj. gov

ISMAIL J. RAMSEY

United States Attorney

2

24

2s

26

27

28

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 2 of 36
3 

JOINT MOTION FOR ENTRY OF PROPOSED STIPULATED ORDER

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

____________________________ 

VIVIAN F. WANG 

 Assistant United States Attorney

Northern District of California

450 Golden Gate Avenue 

San Francisco, CA 94102 

Telephone: (415) 436-7134 

vivian.wang@usdoj.gov 

Of Counsel: 

 

 BENJAMIN WISEMAN

Acting Associate Director

Division of Privacy and Identity

Protection

 TIFFANY GEORGE

Acting Assistant Director

 Division of Privacy and Identity

 Protection

 GORANA NESKOVIC

Attorney

Division of Privacy and Identity

Protection

Federal Trade Commission

600 Pennsylvania Avenue, N.W. 

 (202) 326-2322 (voice) 

 (202) 326-3062 (fax) 

 PEDER MAGEE

Attorney

 Division of Privacy and Identity Protection 

 Federal Trade Commission

 600 Pennsylvania Avenue, N.W. 

 (202) 326-3538 (voice) 

 (202) 326-3062 (fax) 

 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 3 of 36
Exhibit A

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 4 of 36
1

[PROPOSED] STIPULATED ORDER

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

BRIAN M. BOYNTON, Principal Deputy Assistant Attorney General

ARUN G. RAO, Deputy Assistant Attorney General

AMANDA N. LISKAMM, Director

LISA K. HSIAO, Assistant Director

JAMES T. NELSON, Senior Trial Attorney

U.S. Department of Justice

Consumer Protection Branch

Civil Division

450 5th Street N.W.

Washington, DC 20001

Telephone: (202) 616-2376

james.nelson2@usdoj.gov

ISMAIL J. RAMSEY (CABN 189820)

United States Attorney

MICHELLE LO (NYRN 4325163)

Chief, Civil Division

VIVIAN F. WANG (CABN 277577)

Assistant United States Attorney

United States Attorney’s Office 

Northern District of California

450 Golden Gate Ave. 

San Francisco, CA 94102

Telephone: (415) 436-7136

vivian.wang@usdoj.gov

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

UNITED STATES OF AMERICA, 

 Plaintiff,

v.

EDMODO, LLC, a limited liability 

corporation.

 Defendant.

Case No. 

[PROPOSED] STIPULATED 

ORDER FOR PERMANENT 

INJUNCTION AND CIVIL 

PENALTY JUDGMENT

Plaintiff, the United States of America, acting upon notification and authorization to the Attorney 

General by the Federal Trade Commission (“Commission”), filed its Complaint for Permanent 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 5 of 36
2 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Injunction, Civil Penalties, and Other Equitable Relief (“Complaint”) in this matter, pursuant to Sections 

13(b) and 16(a)(1) of the Federal Trade Commission Act (“FTC Act”), 15 U.S.C. §§ 53(b) and 56(a)(1), 

Sections 1303(c) and 1306(d) of the Children’s Online Privacy Protection Act (“COPPA”), 15 U.S.C. §§ 

6502(c) and 6505(d), and the Commission’s Children’s Online Privacy Protection Rule (“COPPA 

Rule”), 16 C.F.R. Part 312 (attached as Appendix A). Defendant has waived service of the summons 

and the Complaint. The parties have been represented by the attorneys whose names appear hereafter. 

Plaintiff and Defendant stipulate to the entry of this Stipulated Order for Permanent Injunction and Civil 

Penalty Judgment (“Order”) to resolve all matters in dispute in this action between them.

THEREFORE, IT IS ORDERED as follows:

FINDINGS

 1. This Court has jurisdiction over this matter.

2. The Complaint charges that Defendant violated the COPPA Rule by failing to obtain 

Verifiable Parental Consent prior to Collecting, using, or Disclosing Personal Information of Children, 

and retaining Personal Information Collected online from Children for longer than reasonably 

necessary to fulfill the purpose for which the information was Collected. The Complaint also charges 

that Defendant violated the FTC Act by unfairly requiring Schools and teachers to comply with the 

COPPA Rule on its behalf without providing adequate information or support to meet the Rule’s 

requirements.

3. Defendant neither admits nor denies any of the allegations in the Complaint, except as 

specifically stated in this Order. Only for purposes of this action, Defendant admits the facts necessary 

to establish jurisdiction. 

4. Defendant waives any claim that it may have under the Equal Access to Justice Act, 28 

U.S.C. § 2412, concerning the prosecution of this action through the date of this Order, and agrees to 

bear its own costs and attorney fees.

5. Defendant and Plaintiff waive all rights to appeal or otherwise challenge or contest the 

validity of this Order.

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 6 of 36
3 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

DEFINITIONS

For the purpose of this Order, the following definitions apply: 

A. “Affected Work Product” means any models or algorithms developed in whole or in part using 

Personal Information Collected from Children through the Edmodo Platform without Verifiable Parental 

Consent or School Authorization. 

B. “Child” means an individual under the age of 13. 

C. “Clear and Conspicuous” means that a required disclosure is difficult to miss (i.e., is easily 

noticeable) and is easily understandable by ordinary consumers, including in all of the following 

ways:

1. In any communication that is solely visual or solely audible, the disclosure must be made 

through the same means through which the communication is presented. In any 

communication made through both visual and audible means, such as a television 

advertisement, the disclosure must be presented simultaneously in both the visual and 

audible portions of the communication even if the representation requiring the disclosure 

is made through only one means. 

2. A visual disclosure, by its size, contrast, location, the length of time it appears, and other 

characteristics, must stand out from any accompanying text or other visual elements so 

that it is easily noticed, read, and understood. 

3. An audible disclosure, including by telephone or streaming video, must be delivered in a 

volume, speed, and cadence sufficient for ordinary consumers to easily hear and 

understand it.

4. In any communication using an interactive electronic medium, such as the Internet or 

software, the disclosure must be unavoidable. 

5. The disclosure must use diction and syntax understandable to ordinary consumers and 

must appear in each language in which the representation that requires the disclosure 

appears.

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 7 of 36
4 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

6. The disclosure must comply with these requirements in each medium through which it is 

received, including all electronic devices and face-to-face communications.

7. The disclosure must not be contradicted or mitigated by, or inconsistent with, anything 

else in the communication. 

8. When the representation or sales practice targets a specific audience, such as Children, 

the elderly, or the terminally ill, “ordinary consumers” includes reasonable members of 

that group. 

D. “Collects” or “Collection” means the gathering of any Personal Information from a Child by any 

means, including but not limited to:

1. Requesting, prompting, or encouraging a Child to submit Personal Information online; 

2. Enabling a Child to make Personal Information publicly available in identifiable form; or 

3. Passive tracking of a Child online. 

E. “Defendant” means Edmodo, LLC (“Edmodo”), a Delaware limited liability company, its 

successors and assigns. 

F. “Direct Control” means the School has a means to review the Personal Information Collected 

from a Child, prevent further use or future Collection from that Child, and direct the Operator to delete a 

Child’s Personal Information.

G. “Direct Notice” means making a reasonable effort (taking into consideration available 

technology) to ensure that a Parent or School receives notice of the Operator’s practices with regard to 

the Collection, use, or Disclosure of Personal Information Collected from a Child, including notice of 

any material change in the Collection, use or Disclosure practices to which the Parent or School has 

previously consented. 

H. “Disclose” or “Disclosure” means, with respect to Personal Information:

1. The Release of Personal Information Collected by an Operator from a Child in 

identifiable form for any purpose, except where an Operator provides such information to 

a person who provides Support for the Internal Operations of the Website or Online 

Service; and

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 8 of 36
5 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

2. Making Personal Information Collected by an Operator from a Child publicly available in 

identifiable form by any means, including but not limited to a public posting through the 

Internet, or through a personal home page or screen posted on a website or online service; 

a pen pal service; an electronic mail service; a message board; or a chat room.

I. “Edmodo Platform” means any online or mobile education-related website, online service or 

application or another Website or Online Service Directed to Children, operated, offered, or controlled 

by Defendant, provided that the Edmodo Platform does not include any such education-related website 

or online service provided to foreign government customers. 

J. “Educational Purpose” means any use related to a Child’s education including, but not limited 

to, instruction in the classroom or at home, administrative activities, and collaboration between students, 

School personnel, or Parents. Educational Purpose does not include commercial purposes unrelated to 

the provision of the online service requested by the School such as advertising or building user profiles. 

K. “Internet” means collectively the myriad of computer and telecommunications facilities, 

including equipment and operating software, which comprise the interconnected world-wide network of 

networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or 

successor protocols to such protocol, to communicate information of all kinds by wire, radio, or other 

methods of transmission. 

L. “Online Contact Information” means an e-mail address or any other substantially similar 

identifier that permits direct contact with a Person online, including but not limited to, an instant 

messaging user identifier, a voice over internet protocol (VOIP) identifier, or a video chat user identifier.

M. “Operator” means any Person who operates a website located on the Internet or an online 

service and who Collects or maintains Personal Information from or about the users of or visitors to such 

website or online service, or on whose behalf such information is Collected or maintained, or offers 

products or services for sale through that website or online service, where such website or online service 

is operated for commercial purposes involving commerce among the several States or with one or more 

foreign nations; in any territory of the United States or in the District of Columbia, or between any such 

territory and another such territory or any State or foreign nation; or between the District of Columbia 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 9 of 36
6 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

and any State, territory, or foreign nation. Personal Information is Collected or maintained on behalf of 

an Operator when:

1. It is Collected or maintained by an agent or service provider of the Operator; or 

2. The Operator benefits by allowing another Person to Collect Personal Information 

directly from users of such website or online service.

N. “Parent” includes a legal guardian.

O. “Person” means any individual, partnership, corporation, trust, estate, cooperative, association, 

or other entity.

P. “Personal Information” means individually identifiable information about an individual 

Collected online, including:

1. A first and last name;

2. A home or other physical address including street name and name of a city or town; 

3. Online Contact Information; 

4. A screen or user name where it functions in the same manner as Online Contact 

Information; 

5. A telephone number;

6. A Social Security number;

7. A persistent identifier that can be used to recognize a user over time and across different 

websites or online services. Such persistent identifier includes, but is not limited to, a 

customer number held in a cookie, an Internet Protocol (IP) address, a processor or device 

serial number, or unique device identifier; 

8. A photograph, video, or audio file where such file contains a Child’s image or voice; 

9. Geolocation information sufficient to identify street name and name of a city or town; or

10. Information concerning the Child or the Parents of that Child that the Operator Collects 

online from the Child and combines with an identifier described in this definition.

Q. “Release of Personal Information” means the sharing, selling, renting, or transfer of Personal 

Information to any Third Party. 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 10 of 36
7 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

R. “School” means an institutional day or residential school, including a public school, charter 

school, or private school, that provides elementary or secondary education, as determined by State law. 

S. “School Authorization” means a School Representative authorizes an Operator to Collect 

Personal Information from a Child, on the condition that Personal Information is Collected only for an 

Educational Purpose and follows the School Representative’s receipt of Direct Notice from the 

Operator.

T. “School Representative” means a School employee who has the authority to authorize the 

Collection of Personal Information from a Child on behalf of the School.

U. “Support for the Internal Operations of the Website or Online Service” means

1. Those activities necessary to:

a. Maintain or analyze the functioning of the website or online service; 

b. Perform network communications; 

c. Authenticate users of, or personalize the content on, the website or online service; 

d. Serve contextual advertising on the website or online service or cap the frequency of 

advertising; 

e. Protect the security or integrity of the user, website, or online service;

f. Ensure legal or regulatory compliance; or 

g. Fulfill a request of a Child as permitted by Section 312.5(c)(3) and (4) of the COPPA 

Rule (attached as Appendix A);

2. So long as the information Collected for these activities listed in 1(a)-(g) is not used or 

Disclosed to contact a specific individual, including through behavioral advertising, to 

amass a profile on a specific individual, or for any other purpose. 

V. “Third Party” means any Person who is not: 

1. An Operator with respect to the Collection or maintenance of Personal Information on the 

website or online service; or

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 11 of 36
8 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

2. A Person who provides Support for the Internal Operations of the Website or Online 

Service and who does not use or Disclose information protected under this part for any 

other purpose. 

W. “Verifiable Parental Consent” means making a reasonable effort (taking into consideration 

available technology) to ensure that before Personal Information is Collected from a Child, a Parent of 

the Child:

1. Receives notice of the Operator’s Personal Information Collection, use, and Disclosure 

practices; and 

2. Authorizes any Collection, use, and/or Disclosure of the Personal Information, using a 

method reasonably calculated, in light of available technology, to ensure that the Person 

providing consent is the Child’s Parent.

X. “Website or Online Service Directed to Children” means a commercial website or online 

service, or portion thereof, that is targeted to Children. 

1. In determining whether a website or online service, or a portion thereof, is directed to 

Children, the Commission will consider its subject matter, visual content, use of animated 

characters or Child-oriented activities and incentives, music or other audio content, age of 

models, presence of Child celebrities or celebrities who appeal to Children, language or 

other characteristics of the website or online service, as well as whether advertising 

promoting or appearing on the website or online service is directed to Children. The 

Commission will also consider competent and reliable empirical evidence regarding 

audience composition and evidence regarding the intended audience. 

2. A website or online service shall be deemed directed to Children when it has actual 

knowledge that it is Collecting Personal Information directly from users of another 

Website or Online Service Directed to Children.

3. A website or online service that is directed to Children under the criteria set forth in 

paragraph (1) of this definition, but that does not target Children as its primary audience, 

shall not be deemed directed to Children if it:

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 12 of 36
9

[PROPOSED] STIPULATED ORDER

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

a. Does not Collect Personal Information from any visitor prior to Collecting age 

information; and

b. Prevents the Collection, use, or Disclosure of Personal Information from visitors 

who identify themselves as under age 13 without first complying with the notice 

and parental consent provisions of 16 C.F.R. Part 312.

4. A website or online service shall not be deemed directed to Children solely because it 

refers or links to a commercial Website or Online Service Directed to Children by using 

information location tools, including a directory, index, reference, pointer, or hypertext 

link.

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 13 of 36
10 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

ORDER

I. INJUNCTION CONCERNING COLLECTION OF PERSONAL INFORMATION 

FROM CHILDREN 

IT IS ORDERED that Defendant and Defendant’s officers, agents, employees, and attorneys, and 

all other Persons in active concert or participation with any of them, who receive actual notice of this 

Order, whether acting directly or indirectly, in connection with operating the Edmodo Platform, are 

hereby permanently restrained and enjoined from: 

A. Failing to make reasonable efforts, taking into account available technology, to ensure that a 

Parent of a Child, or a School Representative where any Personal Information Collection is for 

an Educational Purpose, receives Direct Notice of Defendant’s practices with regard to the 

Collection, use, or Disclosure of Personal Information from Children, including notice of any 

material change in the Collection, use, or Disclosure practices to which the Parent or School has 

previously consented, unless the COPPA Rule provides an exception to providing such notice; 

B. Failing to post a Clear and Conspicuous link to an online notice of its information practices with 

regard to Children on the home or landing page or screen of its website or online service, and at 

each area of the website or online service where Personal Information is Collected from 

Children, unless the COPPA Rule provides an exception to providing such notice; 

C. Failing to obtain Verifiable Parental Consent or School Authorization (in accordance with 

Provision II), before any Collection, use, or Disclosure of Personal Information from Children, 

including consent to any material change in the Collection, use, or Disclosure practices to which 

the Parent or School has previously consented, unless the COPPA Rule provides an exception to 

obtaining Verifiable Parental Consent or School Authorization; 

D. Conditioning a Child’s participation in an activity on the Child Disclosing more Personal 

Information than is reasonably necessary to participate in such activity; 

E. Retaining Personal Information Collected online from a Child for longer than reasonably 

necessary to fulfill the purpose for which the information was Collected; and

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 14 of 36
11 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

F. Violating the COPPA Rule. 

II. INJUNCTION CONCERNING USING SCHOOLS TO PROVIDE DIRECT NOTICE 

TO PARENTS OR OBTAIN VERIFIABLE PARENTAL CONSENT

IT IS FURTHER ORDERED that Defendant and Defendant’s officers, agents, employees and 

attorneys, and all other persons in active concert or participation with any of them, who receive actual 

notice of this Order, whether acting directly or indirectly, in connection with providing the Edmodo 

Platform to Schools are hereby permanently restrained and enjoined from:

A. Relying on Schools to act as intermediaries to obtain Verifiable Parental Consent on behalf of 

Defendant; and 

B. Relying on School Authorization for the Collection of Personal Information from Children 

unless they enter into a written agreement with the School or School Representative that: 

1. Provides that Personal Information can only be used for Educational Purpose(s); 

2. Describes all Personal Information that is Collected and how it will be used and 

Disclosed;

3. Provides the School a link to its online notice of information practices and recommends 

the School make it available on the School’s website; 

4. Requires a School Representative to acknowledge and agree that they have authority to 

authorize the Collection of Personal Information from Children on behalf of the School, 

along with their name and title at the School; and

5. Provides that any Personal Information Collected by Defendant is under the Direct 

Control of the School with regard to its use and maintenance. 

Provided, however, Defendant may Collect Personal Information from Children if Defendant 

provides Direct Notice to Parents and Parents provide Verifiable Parental Consent. 

III. DATA MINIMIZATION REQUIREMENT 

IT IS FURTHER ORDERED that Defendant and Defendant’s officers, agents, employees and 

attorneys, and all other persons in active concert or participation with any of them, who receive actual 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 15 of 36
12 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

notice of this Order, whether acting directly or indirectly, in connection with offering the Edmodo 

Platform, are hereby permanently restrained and enjoined from Collecting more Personal Information 

than reasonably necessary for the Child to participate in any activity offered on any such website or 

online service. 

IV. INJUNCTION CONCERNING USE OF PREVIOUSLY COLLECTED PERSONAL 

INFORMATION 

IT IS FURTHER ORDERED that Defendant, Defendant’s officers, agents, employees, and 

attorneys, and all other Persons in active concert or participation with any of them, who receive actual 

notice of this Order, whether acting directly or indirectly, in connection with providing the Edmodo 

Platform to Schools are ordered to:

A. Refrain from Disclosing, using, or benefitting from Personal Information Collected from 

Children that Defendant collected through the Edmodo Platform prior to entry of this Order 

unless Verifiable Parental Consent or School Authorization is obtained as outlined in Provisions 

I and II; 

B. Within sixty (60) days of entry of this Order, destroy all Personal Information Collected through 

the Edmodo Platform by Defendant from accounts that have not, by that date, provided 

Verifiable Parental Consent or School Authorization as described in Provisions I and II; 

C. Within ninety (90) days of entry of this Order, provide a written statement to the Commission, 

sworn under penalty of perjury, that (1) describes the process through which Defendant provided 

Direct Notice and sought Verifiable Parental Consent or School Authorization for the accounts 

through which Personal Information is Collected through the Edmodo Platform; (2) identifies the 

total number of accounts for which Direct Notice was provided, as well as the number of 

accounts that: 

(i) provided Verifiable Parental Consent;

(ii) provided School Authorization;

(iii) affirmatively declined to provide Verifiable Parental Consent or School 

Authorization; 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 16 of 36
13 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

(iv) did not respond; 

(v) Parents or Schools requested be deleted after receiving the Direct Notice provided for 

under sub-provision IV.B; and 

(vi) that were the subject of additional questions to Defendant by Parents or Schools; and 

(3) confirms all Personal Information Collected from Children through the Edmodo Platform 

related to accounts for which Verifiable Parental Consent or School Authorization was not 

received has been destroyed; 

D. Within ninety (90) days of entry of this Order, delete or destroy any Affected Work Product, and 

provide a written statement to the Commission, sworn under penalty of perjury, confirming such 

deletion or destruction. Any Affected Work Product, or Personal Information that Defendant is 

otherwise required to delete or destroy pursuant to this provision may be retained, and may be 

disclosed, as requested by a government agency or otherwise required by law, regulation, court 

order, or other legal obligation, including as required by rules applicable to the safeguarding of 

evidence in pending litigation. In each written statement to the Commission required by this 

provision, Defendant shall describe in detail any relevant information that Defendant retains on 

any of these bases and the specific government agency, law, regulation, court order, or other 

legal obligation that prohibits Defendant from deleting or destroying such information. Within 

thirty (30) days after the obligation to retain the information has ended, Defendant shall provide 

an additional written statement to the Commission, sworn under penalty of perjury, confirming 

that Defendant has deleted or destroyed such information; and 

E. Maintain and adhere to a retention schedule for Children’s Personal Information Collected 

through the Edmodo Platform, setting forth the purpose for which the information is Collected, 

the specific business need for retaining such Personal Information, and a set time frame and set 

of criteria for deletion of such information which may not exceed one (1) year after the

termination of the agreement with the School (unless the School affirmatively requests a 

different time period), or, with respect to Children’s Personal Information that is not Collected 

under the Direct Control of a School, may not exceed one (1) year after the generation of the data 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 17 of 36
14 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

(unless the Parent, after receiving notice of the impending deletion from Defendant, affirmatively 

requests that Defendant retain a Child’s data for longer), and make such information about the 

retention schedule publicly available on Defendant’s website and in the Direct Notice. 

V. MONETARY JUDGMENT FOR CIVIL PENALTY 

IT IS FURTHER ORDERED that: 

A. Judgment in the amount of $6 million ($6,000,000) is entered in favor of Plaintiff against 

Defendant, as a civil penalty. 

B. The judgment is suspended subject to the Subsections below. 

C. The Plaintiff’s agreement to the suspension of the judgment is expressly premised upon the 

truthfulness, accuracy, and completeness of Defendant’s sworn financial statements and related 

documents (collectively, “Financial Attestations”) submitted to the Commission, namely: 

 1. the Financial Statement of Corporate Defendant, Edmodo, LLC, signed by General 

Counsel, Susan Shinoff, and all supporting documents. 

D. The suspension of the judgment will be lifted as to Defendant if, upon motion by Plaintiff, the 

Court finds that Defendant failed to disclose any material asset, materially misstated the value of 

any asset, or made any other material misstatement or omission in the Financial Attestations. 

E. If the suspension of the judgment is lifted, the judgment becomes immediately due as to 

Defendant in the amount specified in Subsection A of this Section (which the parties stipulate 

only for purposes of this Section represents the amount of civil penalty for the violations alleged 

in the Complaint), less any payment previously made pursuant to this Section, plus interest 

computed from the date of entry of this Order. 

VI. ADDITIONAL MONETARY PROVISIONS 

IT IS FURTHER ORDERED that: 

A. Defendant relinquishes dominion and all legal and equitable right, title, and interest in all assets 

transferred pursuant to this Order and may not seek the return of any assets. 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 18 of 36
15 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

B. The facts alleged in the Complaint will be taken as true, without further proof, in any subsequent 

civil litigation by or on behalf of the Commission, including in a proceeding to enforce its rights 

to any payment or monetary judgment pursuant to this Order. 

C. Defendant acknowledges that its Taxpayer Identification Numbers, which Defendant must 

submit to the Commission, may be used for collecting and reporting on any delinquent amount 

arising out of this Order, in accordance with 31 U.S.C. § 7701. 

VII. ORDER ACKNOWLEDGMENTS

IT IS FURTHER ORDERED that Defendant obtains acknowledgments of receipt of this Order:

A. Defendant, within seven (7) days of entry of this Order, must submit to the Commission an 

acknowledgment of receipt of this Order sworn under penalty of perjury.

B. For five (5) years after entry of this Order, Defendant, for any business that Defendant is the 

majority owner of, or controls directly or indirectly, must deliver a copy of this Order to: (1) all 

principals, officers, directors, managers, and members; (2) all employees having managerial 

responsibilities relating to the subject matter of the Order, and all agents and representatives who 

participate in conduct related to the subject matter of the Order; and (3) any business entity 

resulting from any change in structure as set forth in Section VIII (Compliance Reporting). 

Delivery must occur within seven (7) days of entry of this Order for current personnel and 

entities. To all others, delivery must occur before they assume their responsibilities. 

C. From each individual or entity to which Defendant delivered a copy of this Order, Defendant 

must obtain, within thirty (30) days, a signed and dated acknowledgment of receipt of this Order. 

VIII. COMPLIANCE REPORTING

IT IS FURTHER ORDERED that Defendant makes timely submissions to the Commission: 

A. One year after entry of this Order, Defendant must submit a compliance report, sworn under 

penalty of perjury, in which Defendant must: (a) identify the primary physical, postal, email 

address, and telephone number, as designated points of contact, which representatives of the 

Commission and Plaintiff may use to communicate with Defendant; (b) identify all businesses 

owned or controlled by Defendant by all of their names, telephone numbers, and physical, postal, 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 19 of 36
16 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

email, and Internet addresses; (c) describe the activities of each business, including the goods 

and services offered, the means of advertising, marketing, and sales; (d) describe in detail 

whether and how Defendant is in compliance with each Section of this Order; (e) provide a copy 

of each different version of any privacy notice posted on each Website or Online Service 

Directed to Children operated by Defendant or sent to Parents of Children that register on each 

website or online service; (f) provide a statement setting forth in detail the methods used to 

obtain Verifiable Parental Consent or School Authorization prior to any Collection, use, and/or 

Disclosure of Personal Information from Children by the Edmodo Platform; (g) provide a 

statement setting forth in detail the means provided for Parents to review the Personal 

Information Collected from their Children and to refuse to permit its further use or maintenance 

by the Edmodo Platform; and (h) provide a copy of each Order Acknowledgment obtained 

pursuant to this Order, unless previously submitted to the Commission. 

B. For ten (10) years after entry of this Order, Defendant must submit a compliance notice, sworn 

under penalty of perjury, within fourteen (14) days of any change in: (a) any designated point of 

contact; or (b) the structure of Defendant or any entity that Defendant has any ownership interest 

in or control directly or indirectly that may affect compliance obligations arising under this 

Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or 

affiliate that engages in any acts or practices subject to this Order.

C. Defendant must submit to the Commission notice of the filing of any bankruptcy petition, 

insolvency proceeding, or similar proceeding by or against Defendant within fourteen (14) days 

of its filing.

D. Any submission to the Commission required by this Order to be sworn under penalty of perjury 

must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: “I declare 

under penalty of perjury under the laws of the United States of America that the foregoing is true 

and correct. Executed on: _____” and supplying the date, signatory’s full name, title (if 

applicable), and signature.

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 20 of 36
17 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

E. Unless otherwise directed by a Commission representative in writing, all submissions to the 

Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by overnight 

courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of 

Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, 

DC 20580. The subject line must begin: United States v. Edmodo, LLC. 

IX. RECORDKEEPING

IT IS FURTHER ORDERED that Defendant must create certain records for ten (10) years after 

entry of the Order, and retain each such record for five (5) years. Specifically, for any business that 

Defendant is a majority owner of, or controls directly or indirectly, other than those providing products 

or services solely to foreign government customers, Defendant must create and retain the following 

records: 

A. Accounting records showing the revenues from all goods or services sold; 

B. All personnel records showing, for each person providing services, whether as an employee or 

otherwise, that person’s: name, addresses, telephone numbers, job title or position, dates of 

service, and (if applicable) the reason for termination;

C. All records necessary to demonstrate full compliance with each provision of this Order, 

including all submissions to the Commission; 

D. Copies of all consumer complaints relating to Defendant’s Collection of Personal Information, 

whether received directly or indirectly, such as through a Third Party, and any response; 

E. All records demonstrating the steps Defendant has taken to obtain Verifiable Parental Consent or 

School Authorization, as applicable, for each Child user; and 

F. A copy of each materially different form, page, or screen created, maintained, or otherwise 

provided by Defendant through which Defendant Collects Personal Information, and a copy of 

each materially different document containing any representation regarding Defendant’s 

Collection, use, and Disclosure practices pertaining to Personal Information. Each webpage 

copy shall be accompanied by the URL of the webpage where the material was posted online. 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 21 of 36
18 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Electronic copies shall include all text and graphics files, audio scripts, and other computer files 

used in presenting information on the Internet. 

X. COMPLIANCE MONITORING

IT IS FURTHER ORDERED that, for the purpose of monitoring Defendant’s compliance with 

this Order, including the Financial Attestations upon which the judgment was suspended: 

A. Within fourteen (14) days of receipt of a written request from a representative of the 

Commission or Plaintiff, Defendant must: submit additional compliance reports or other 

requested information, which must be sworn under penalty of perjury; appear for depositions; 

and produce documents for inspection and copying. The Commission and Plaintiff are also 

authorized to obtain discovery, without further leave of court, using any of the procedures 

prescribed by Federal Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 

34, 36, 45, and 69. 

B. For matters concerning this Order, the Commission and Plaintiff are authorized to communicate 

directly with Defendant. Defendant must permit representatives of the Commission and Plaintiff

to interview any employee or other Person affiliated with Defendant who has agreed to such an 

interview. The Person interviewed may have counsel present.

C. The Commission and Plaintiff may use all other lawful means, including posing, through its 

representatives, as consumers, suppliers, or other individuals or entities, to Defendant or any 

individual or entity affiliated with Defendant, without the necessity of identification or prior 

notice. Nothing in this Order limits the Commission’s lawful use of compulsory process, 

pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49 and 57b-1. 

///

///

///

///

///

///

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 22 of 36
19 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

VIII. RETENTION OF JURISDICTION

IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for purposes of 

construction, modification, and enforcement of this Order.

SO ORDERED this day of , 2023. 

________________________________ 

UNITED STATES DISTRICT JUDGE

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 23 of 36
Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 24 of 36
21 

[PROPOSED] STIPULATED ORDER

CASE NO. 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

OF COUNSEL

FOR THE FEDERAL TRADE COMMISSION:

 BENJAMIN WISEMAN

Acting Associate Director

Division of Privacy and Identity Protection 

TIFFANY GEORGE

Acting Assistant Director

Division of Privacy and Identity Protection 

______________________ 

GORANA NESKOVIC

Attorney

Division of Privacy and Identity Protection

Federal Trade Commission

600 Pennsylvania Avenue NW 

Mail Stop CC-8232 

Washington, DC 20580 

(202) 326-2322 

gneskovic@ftc.gov 

______________________ 

PEDER MAGEE

Attorney

Division of Privacy and Identity Protection 

Federal Trade Commission

600 Pennsylvania Avenue NW 

Mail Stop CC-8232 

Washington, DC 20580 

(202) 326-3538 

pmagee@ftc.gov 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 25 of 36
1

2

3

4

5

6

7

o()

9

l0

l1

I'

13

t4

15

t6

t'l

l8

19

20

2t

1')

23

24

25

26

27

28

tsOR DEFENDANT:

Ernily

H

Orlick, & Sutolifl'e LLP

i 152 I 5ilt Street, NW, Washingtorr, DC 20005

Tel: (202) 339-8400

Ertrall : etabatabai(@orriclr,corn

hlevin@orrick.corn

Cotmsel Jd' Et{nrodo Lt.C

DEFENDANT:

Clrief Executive Offrcer'

llclutodo LLC

[PRoPosED ] STTPUT,ATED otrDEIt

CASENo.

Date: {'11-Zi

Vincent P, Riera

22

ftilz7

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 26 of 36
Appendix A 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 27 of 36
4008 Federal Register / Vol. 78, No. 12 / Thursday, January 17, 2013 / Rules and Regulations 

396Cf. Civil Division of the United States 

Attorney’s Office for the District of Columbia, 

United States Attorney’s Office, District of 

Columbia, Laffey Matrix B 2003-2013, available at 

http://www.justice.gov/usao/dc/divisions/ 

Laffey_Matrix_2003-2013.pdf (updated ‘‘Laffey 

Matrix’’ for calculating ‘‘reasonable’’ attorneys fees 

in suits in which fee shifting is authorized can be 

evidence of prevailing market rates for litigation 

counsel in the Washington, DC area; rates in table 

range from $245 per hour for most junior associates 

to $505 per hour for most senior partners). 

397Toy Industry Association (comment 89, 2012 

SNPRM), at 18. 

398Based on Commission staff’s experience with 

previously approved safe harbor programs, staff 

anticipates that most of the legal tasks associated 

with safe harbor programs will be performed by inhouse counsel. Cf. Toy Industry Association 

(comment 89, 2012 SNPRM), at 19 (regional BLS 

statistics for lawyer wages can support estimates of 

the level of in-house legal support likely to be 

required on an ongoing basis). Moreover, no 

comments were received in response to the 

February 9, 2011 and May 31, 2011 Federal 

Register notices (76 FR at 7211 and 76 FR at 31334, 

respectively, available at http://www.gpo.gov/fdsys/ 

pkg/FR-2011-02-09/pdf/2011-2904.pdf and http:// 

www.gpo.gov/fdsys/pkg/FR-2011-05-31/pdf/2011- 

13357.pdf), which assumed a labor rate of $150 per 

hour for lawyers or similar professionals to prepare 

and submit a new safe harbor application. Nor was 

that challenged in the comments responding to the 

2011 NPRM. 

399See Bureau of Labor Statistics National 

Compensation Survey: Occupational Earnings in 

the United States, 2010, at Table 3, available at 

http://www.bls.gov/ncs/ocs/sp/nctb1477.pdf. This 

rate has not been contested. 

400NCTA commented that the Commission failed 

to consider costs ‘‘related to redeveloping childdirected Web sites’’ that operators would be 

‘‘forced’’ to incur as a result of the proposed Rule 

amendments, including for ‘‘new equipment and 

software required by the expanded regulatory 

regime.’’ NCTA (comment 113, 2011 NPRM), at 23. 

Similarly, TIA commented that the proposed Rule 

amendments would entail ‘‘increased monetary 

costs with respect to technology acquisition and 

implementation * * *.’’ Toy Industry Association 

(comment 163, 2011 NPRM), at 17. These 

comments, however, do not specify projected costs 

or which Rule amendments would entail the 

asserted costs. 

average firm-wide billing rate (partners 

and associates) in 2011 was $403, the 

average partner rate was $482, and the 

average associate rate was $303. 

The Commission believes it 

reasonable to assume that the workload 

among law firm partners and associates 

for COPPA compliance questions could 

be competently addressed and 

efficiently distributed among attorneys 

at varying levels of seniority, but would 

be weighted most heavily to more junior 

attorneys. Thus, assuming an 

apportionment of two-thirds of such 

work is done by associates, and onethird by partners, a weighted average 

tied to the average firm-wide associate 

and average firm-wide partner rates, 

respectively, in the National Law 

Journal 2011 survey would be about 

$365 per hour. The Commission 

believes that this rate B which is very 

near the mean of TIA’s stated range of 

purported hourly rates that its members 

typically pay to engage counsel for 

COPPA compliance questions B is an 

appropriate measure to calculate the 

cost of legal assistance for operators to 

comply with the final Rule 

amendments.396

TIA also states that the 2012 SNPRM 

estimate of $42 per hour for technical 

support is too low, and that engaging 

expert technical personnel can, on 

average, involve hourly costs that range 

from $72 to $108.397 Similar to TIA’s 

hours estimate, discussed above, the 

Commission believes that TIA’s estimate 

may have been based on implementing 

requirements that, ultimately, the 

Commission has determined not to 

adopt. For example, technical personnel 

will not need to ‘‘ensure’’ the security 

procedures of third parties; operators 

that have been eligible to use email plus 

for parental consents will not be 

required to implement new systems to 

replace it. It is unclear whether TIA’s 

estimate for technical support is based 

on the types of disclosure-related tasks 

that the final Rule amendments would 

actually require, other tasks that the 

final Rule amendments would not 

require, or non-disclosure tasks not 

covered by the PRA. Moreover, unlike 

its estimate for lawyer assistance, TIA’s 

estimates for technical labor are not 

accompanied by an adequate 

explanation of why estimates for 

technical support drawn from BLS 

statistics are not an appropriate basis for 

the FTC’s PRA analysis. Accordingly, 

the Commission believes it is reasonable 

to retain the 2012 SNPRM estimate of 

$42 per hour for technical assistance 

based on BLS data. 

Thus, for the 180 new operators per 

year not previously accounted for under 

the FTC’s currently cleared estimates, 

10,800 cumulative disclosure hours 

would be composed of 9,000 hours of 

legal assistance and 1,800 hours of 

technical support. Applied to hourly 

rates of $365 and $42, respectively, 

associated labor costs for the 180 new 

operators potentially subject to the 

proposed amendments would be 

$3,360,600 (i.e., $3,285,000 for legal 

support plus $75,600 for technical 

support). 

Similarly, for the estimated 2,910 

existing operators covered by the final 

Rule amendments, 58,200 cumulative 

disclosure hours would consist of 

48,500 hours of legal assistance and 

9,700 hours for technical support. 

Applied at hourly rates of $365 and $42, 

respectively, associated labor costs 

would total $18,109,900 (i.e., 

$17,702,500 for legal support plus 

$407,400 for technical support). 

Cumulatively, estimated labor costs for 

new and existing operators subject to 

the final Rule amendments is 

$21,470,500. 

(2) Reporting 

The Commission staff assumes that 

the tasks to prepare augmented safe 

harbor program applications occasioned 

by the final Rule amendments will be 

performed primarily by lawyers, at a 

mean labor rate of $180 an hour.398

Thus, applied to an assumed industry 

total of 120 hours per year for this task, 

incremental associated yearly labor 

costs would total $21,600. 

The Commission staff assumes 

periodic reports will be prepared by 

compliance officers, at a labor rate of 

$28 per hour.399 Applied to an assumed 

industry total of 600 hours per year for 

this task, associated yearly labor costs 

would be $16,800. 

Cumulatively, labor costs for the 

above-noted reporting requirements 

total approximately $38,400 per year. 

G. Non-Labor/Capital Costs 

Because both operators and safe 

harbor programs will already be 

equipped with the computer equipment 

and software necessary to comply with 

the Rule’s new notice requirements, the 

final Rule amendments should not 

impose any additional capital or other 

non-labor costs.400

List of Subjects in 16 CFR Part 312 

Children, Communications, Consumer 

protection, Electronic mail, Email, 

Internet, Online service, Privacy, Record 

retention, Safety, science and 

technology, Trade practices, Web site, 

Youth. 

■ Accordingly, for the reasons stated 

above, the Federal Trade Commission 

revises part 312 of Title 16 of the Code 

of Federal Regulations to read as 

follows: 

PART 312—CHILDREN’S ONLINE 

PRIVACY PROTECTION RULE 

Sec. 

312.1 Scope of regulations in this part. 

312.2 Definitions. 

312.3 Regulation of unfair or deceptive acts 

or practices in connection with the 

collection, use, and/or disclosure of 

personal information from and about 

children on the Internet. 

312.4 Notice. 

312.5 Parental consent. 

312.6 Right of parent to review personal 

information provided by a child. 

312.7 Prohibition against conditioning a 

child’s participation on collection of 

personal information. 


pmangrum on DSK3VPTVN1PROD with 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 28 of 36
Federal Register / Vol. 78, No. 12 / Thursday, January 17, 2013 / Rules and Regulations 4009 

312.8 Confidentiality, security, and 

integrity of personal information 

collected from children. 

312.9 Enforcement. 

312.10 Data retention and deletion 

requirements. 

312.11 Safe harbor programs. 

312.12 Voluntary Commission Approval 

Processes. 

312.13 Severability. 

Authority: 15 U.S.C. 6501–6508. 

§ 312.1 Scope of regulations in this part. 

This part implements the Children’s 

Online Privacy Protection Act of 1998, 

(15 U.S.C. 6501, et seq.,) which 

prohibits unfair or deceptive acts or 

practices in connection with the 

collection, use, and/or disclosure of 

personal information from and about 

children on the Internet. 

§ 312.2 Definitions. 

Child means an individual under the 

age of 13. 

Collects or collection means the 

gathering of any personal information 

from a child by any means, including 

but not limited to: 

(1) Requesting, prompting, or 

encouraging a child to submit personal 

information online; 

(2) Enabling a child to make personal 

information publicly available in 

identifiable form. An operator shall not 

be considered to have collected personal 

information under this paragraph if it 

takes reasonable measures to delete all 

or virtually all personal information 

from a child’s postings before they are 

made public and also to delete such 

information from its records; or 

(3) Passive tracking of a child online. 

Commission means the Federal Trade 

Commission. 

Delete means to remove personal 

information such that it is not 

maintained in retrievable form and 

cannot be retrieved in the normal course 

of business. 

Disclose or disclosure means, with 

respect to personal information: 

(1) The release of personal 

information collected by an operator 

from a child in identifiable form for any 

purpose, except where an operator 

provides such information to a person 

who provides support for the internal 

operations of the Web site or online 

service; and 

(2) Making personal information 

collected by an operator from a child 

publicly available in identifiable form 

by any means, including but not limited 

to a public posting through the Internet, 

or through a personal home page or 

screen posted on a Web site or online 

service; a pen pal service; an electronic 

mail service; a message board; or a chat 

room. 

Federal agency means an agency, as 

that term is defined in Section 551(1) of 

title 5, United States Code. 

Internet means collectively the 

myriad of computer and 

telecommunications facilities, including 

equipment and operating software, 

which comprise the interconnected 

world-wide network of networks that 

employ the Transmission Control 

Protocol/Internet Protocol, or any 

predecessor or successor protocols to 

such protocol, to communicate 

information of all kinds by wire, radio, 

or other methods of transmission. 

Obtaining verifiable consent means 

making any reasonable effort (taking 

into consideration available technology) 

to ensure that before personal 

information is collected from a child, a 

parent of the child: 

(1) Receives notice of the operator’s 

personal information collection, use, 

and disclosure practices; and 

(2) Authorizes any collection, use, 

and/or disclosure of the personal 

information. 

Online contact information means an 

email address or any other substantially 

similar identifier that permits direct 

contact with a person online, including 

but not limited to, an instant messaging 

user identifier, a voice over internet 

protocol (VOIP) identifier, or a video 

chat user identifier. 

Operator means any person who 

operates a Web site located on the 

Internet or an online service and who 

collects or maintains personal 

information from or about the users of 

or visitors to such Web site or online 

service, or on whose behalf such 

information is collected or maintained, 

or offers products or services for sale 

through that Web site or online service, 

where such Web site or online service 

is operated for commercial purposes 

involving commerce among the several 

States or with 1 or more foreign nations; 

in any territory of the United States or 

in the District of Columbia, or between 

any such territory and another such 

territory or any State or foreign nation; 

or between the District of Columbia and 

any State, territory, or foreign nation. 

This definition does not include any 

nonprofit entity that would otherwise be 

exempt from coverage under Section 5 

of the Federal Trade Commission Act 

(15 U.S.C. 45). Personal information is 

collected or maintained on behalf of an 

operator when: 

(1) It is collected or maintained by an 

agent or service provider of the operator; 

or 

(2) The operator benefits by allowing 

another person to collect personal 

information directly from users of such 

Web site or online service. 

Parent includes a legal guardian. 

Person means any individual, 

partnership, corporation, trust, estate, 

cooperative, association, or other entity. 

Personal information means 

individually identifiable information 

about an individual collected online, 

including: 

(1) A first and last name; 

(2) A home or other physical address 

including street name and name of a 

city or town; 

(3) Online contact information as 

defined in this section; 

(4) A screen or user name where it 

functions in the same manner as online 

contact information, as defined in this 

section; 

(5) A telephone number; 

(6) A Social Security number; 

(7) A persistent identifier that can be 

used to recognize a user over time and 

across different Web sites or online 

services. Such persistent identifier 

includes, but is not limited to, a 

customer number held in a cookie, an 

Internet Protocol (IP) address, a 

processor or device serial number, or 

unique device identifier; 

(8) A photograph, video, or audio file 

where such file contains a child’s image 

or voice; 

(9) Geolocation information sufficient 

to identify street name and name of a 

city or town; or 

(10) Information concerning the child 

or the parents of that child that the 

operator collects online from the child 

and combines with an identifier 

described in this definition. 

Release of personal information 

means the sharing, selling, renting, or 

transfer of personal information to any 

third party. 

Support for the internal operations of 

the Web site or online service means: 

(1) Those activities necessary to: 

(i) Maintain or analyze the 

functioning of the Web site or online 

service; 

(ii) Perform network communications; 

(iii) Authenticate users of, or 

personalize the content on, the Web site 

or online service; 

(iv) Serve contextual advertising on 

the Web site or online service or cap the 

frequency of advertising; 

(v) Protect the security or integrity of 

the user, Web site, or online service; 

(vi) Ensure legal or regulatory 

compliance; or 

(vii) Fulfill a request of a child as 

permitted by § 312.5(c)(3) and (4); 

(2) So long as The information 

collected for the activities listed in 

paragraphs (1)(i)–(vii) of this definition 

is not used or disclosed to contact a 

specific individual, including through 

behavioral advertising, to amass a 


pmangrum on DSK3VPTVN1PROD with 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 29 of 36
4010 Federal Register / Vol. 78, No. 12 / Thursday, January 17, 2013 / Rules and Regulations 

profile on a specific individual, or for 

any other purpose. 

Third party means any person who is 

not: 

(1) An operator with respect to the 

collection or maintenance of personal 

information on the Web site or online 

service; or 

(2) A person who provides support for 

the internal operations of the Web site 

or online service and who does not use 

or disclose information protected under 

this part for any other purpose. 

Web site or online service directed to 

children means a commercial Web site 

or online service, or portion thereof, that 

is targeted to children. 

(1) In determining whether a Web site 

or online service, or a portion thereof, 

is directed to children, the Commission 

will consider its subject matter, visual 

content, use of animated characters or 

child-oriented activities and incentives, 

music or other audio content, age of 

models, presence of child celebrities or 

celebrities who appeal to children, 

language or other characteristics of the 

Web site or online service, as well as 

whether advertising promoting or 

appearing on the Web site or online 

service is directed to children. The 

Commission will also consider 

competent and reliable empirical 

evidence regarding audience 

composition, and evidence regarding 

the intended audience. 

(2) A Web site or online service shall 

be deemed directed to children when it 

has actual knowledge that it is 

collecting personal information directly 

from users of another Web site or online 

service directed to children. 

(3) A Web site or online service that 

is directed to children under the criteria 

set forth in paragraph (1) of this 

definition, but that does not target 

children as its primary audience, shall 

not be deemed directed to children if it: 

(i) Does not collect personal 

information from any visitor prior to 

collecting age information; and 

(ii) Prevents the collection, use, or 

disclosure of personal information from 

visitors who identify themselves as 

under age 13 without first complying 

with the notice and parental consent 

provisions of this part. 

(4) A Web site or online service shall 

not be deemed directed to children 

solely because it refers or links to a 

commercial Web site or online service 

directed to children by using 

information location tools, including a 

directory, index, reference, pointer, or 

hypertext link. 

§ 312.3 Regulation of unfair or deceptive 

acts or practices in connection with the 

collection, use, and/or disclosure of 

personal information from and about 

children on the Internet. 

General requirements. It shall be 

unlawful for any operator of a Web site 

or online service directed to children, or 

any operator that has actual knowledge 

that it is collecting or maintaining 

personal information from a child, to 

collect personal information from a 

child in a manner that violates the 

regulations prescribed under this part. 

Generally, under this part, an operator 

must: 

(a) Provide notice on the Web site or 

online service of what information it 

collects from children, how it uses such 

information, and its disclosure practices 

for such information (§ 312.4(b)); 

(b) Obtain verifiable parental consent 

prior to any collection, use, and/or 

disclosure of personal information from 

children (§ 312.5); 

(c) Provide a reasonable means for a 

parent to review the personal 

information collected from a child and 

to refuse to permit its further use or 

maintenance (§ 312.6); 

(d) Not condition a child’s 

participation in a game, the offering of 

a prize, or another activity on the child 

disclosing more personal information 

than is reasonably necessary to 

participate in such activity (§ 312.7); 

and 

(e) Establish and maintain reasonable 

procedures to protect the 

confidentiality, security, and integrity of 

personal information collected from 

children (§ 312.8). 

§ 312.4 Notice. 

(a) General principles of notice. It 

shall be the obligation of the operator to 

provide notice and obtain verifiable 

parental consent prior to collecting, 

using, or disclosing personal 

information from children. Such notice 

must be clearly and understandably 

written, complete, and must contain no 

unrelated, confusing, or contradictory 

materials. 

(b) Direct notice to the parent. An 

operator must make reasonable efforts, 

taking into account available 

technology, to ensure that a parent of a 

child receives direct notice of the 

operator’s practices with regard to the 

collection, use, or disclosure of personal 

information from children, including 

notice of any material change in the 

collection, use, or disclosure practices 

to which the parent has previously 

consented. 

(c) Content of the direct notice to the 

parent—(1) Content of the direct notice 

to the parent under § 312.5(c)(1) (Notice 

to Obtain Parent’s Affirmative Consent 

to the Collection, Use, or Disclosure of 

a Child’s Personal Information). This 

direct notice shall set forth: 

(i) That the operator has collected the 

parent’s online contact information from 

the child, and, if such is the case, the 

name of the child or the parent, in order 

to obtain the parent’s consent; 

(ii) That the parent’s consent is 

required for the collection, use, or 

disclosure of such information, and that 

the operator will not collect, use, or 

disclose any personal information from 

the child if the parent does not provide 

such consent; 

(iii) The additional items of personal 

information the operator intends to 

collect from the child, or the potential 

opportunities for the disclosure of 

personal information, should the parent 

provide consent; 

(iv) A hyperlink to the operator’s 

online notice of its information 

practices required under paragraph (d) 

of this section; 

(v) The means by which the parent 

can provide verifiable consent to the 

collection, use, and disclosure of the 

information; and 

(vi) That if the parent does not 

provide consent within a reasonable 

time from the date the direct notice was 

sent, the operator will delete the 

parent’s online contact information from 

its records. 

(2) Content of the direct notice to the 

parent under § 312.5(c)(2) (Voluntary 

Notice to Parent of a Child’s Online 

Activities Not Involving the Collection, 

Use or Disclosure of Personal 

Information). Where an operator 

chooses to notify a parent of a child’s 

participation in a Web site or online 

service, and where such site or service 

does not collect any personal 

information other than the parent’s 

online contact information, the direct 

notice shall set forth: 

(i) That the operator has collected the 

parent’s online contact information from 

the child in order to provide notice to, 

and subsequently update the parent 

about, a child’s participation in a Web 

site or online service that does not 

otherwise collect, use, or disclose 

children’s personal information; 

(ii) That the parent’s online contact 

information will not be used or 

disclosed for any other purpose; 

(iii) That the parent may refuse to 

permit the child’s participation in the 

Web site or online service and may 

require the deletion of the parent’s 

online contact information, and how the 

parent can do so; and 

(iv) A hyperlink to the operator’s 

online notice of its information 


pmangrum on DSK3VPTVN1PROD with 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 30 of 36
Federal Register / Vol. 78, No. 12 / Thursday, January 17, 2013 / Rules and Regulations 4011 

practices required under paragraph (d) 

of this section. 

(3) Content of the direct notice to the 

parent under § 312.5(c)(4) (Notice to a 

Parent of Operator’s Intent to 

Communicate with the Child Multiple 

Times). This direct notice shall set forth: 

(i) That the operator has collected the 

child’s online contact information from 

the child in order to provide multiple 

online communications to the child; 

(ii) That the operator has collected the 

parent’s online contact information from 

the child in order to notify the parent 

that the child has registered to receive 

multiple online communications from 

the operator; 

(iii) That the online contact 

information collected from the child 

will not be used for any other purpose, 

disclosed, or combined with any other 

information collected from the child; 

(iv) That the parent may refuse to 

permit further contact with the child 

and require the deletion of the parent’s 

and child’s online contact information, 

and how the parent can do so; 

(v) That if the parent fails to respond 

to this direct notice, the operator may 

use the online contact information 

collected from the child for the purpose 

stated in the direct notice; and 

(vi) A hyperlink to the operator’s 

online notice of its information 

practices required under paragraph (d) 

of this section. 

(4) Content of the direct notice to the 

parent required under § 312.5(c)(5) 

(Notice to a Parent In Order to Protect 

a Child’s Safety). This direct notice shall 

set forth: 

(i) That the operator has collected the 

name and the online contact 

information of the child and the parent 

in order to protect the safety of a child; 

(ii) That the information will not be 

used or disclosed for any purpose 

unrelated to the child’s safety; 

(iii) That the parent may refuse to 

permit the use, and require the deletion, 

of the information collected, and how 

the parent can do so; 

(iv) That if the parent fails to respond 

to this direct notice, the operator may 

use the information for the purpose 

stated in the direct notice; and 

(v) A hyperlink to the operator’s 

online notice of its information 

practices required under paragraph (d) 

of this section. 

(d) Notice on the Web site or online 

service. In addition to the direct notice 

to the parent, an operator must post a 

prominent and clearly labeled link to an 

online notice of its information 

practices with regard to children on the 

home or landing page or screen of its 

Web site or online service, and, at each 

area of the Web site or online service 

where personal information is collected 

from children. The link must be in close 

proximity to the requests for 

information in each such area. An 

operator of a general audience Web site 

or online service that has a separate 

children’s area must post a link to a 

notice of its information practices with 

regard to children on the home or 

landing page or screen of the children’s 

area. To be complete, the online notice 

of the Web site or online service’s 

information practices must state the 

following: 

(1) The name, address, telephone 

number, and email address of all 

operators collecting or maintaining 

personal information from children 

through the Web site or online service. 

Provided that: The operators of a Web 

site or online service may list the name, 

address, phone number, and email 

address of one operator who will 

respond to all inquiries from parents 

concerning the operators’ privacy 

policies and use of children’s 

information, as long as the names of all 

the operators collecting or maintaining 

personal information from children 

through the Web site or online service 

are also listed in the notice; 

(2) A description of what information 

the operator collects from children, 

including whether the Web site or 

online service enables a child to make 

personal information publicly available; 

how the operator uses such information; 

and, the operator’s disclosure practices 

for such information; and 

(3) That the parent can review or have 

deleted the child’s personal 

information, and refuse to permit 

further collection or use of the child’s 

information, and state the procedures 

for doing so. 

§ 312.5 Parental consent. 

(a) General requirements. (1) An 

operator is required to obtain verifiable 

parental consent before any collection, 

use, or disclosure of personal 

information from children, including 

consent to any material change in the 

collection, use, or disclosure practices 

to which the parent has previously 

consented. 

(2) An operator must give the parent 

the option to consent to the collection 

and use of the child’s personal 

information without consenting to 

disclosure of his or her personal 

information to third parties. 

(b) Methods for verifiable parental 

consent. (1) An operator must make 

reasonable efforts to obtain verifiable 

parental consent, taking into 

consideration available technology. Any 

method to obtain verifiable parental 

consent must be reasonably calculated, 

in light of available technology, to 

ensure that the person providing 

consent is the child’s parent. (2) 

Existing methods to obtain verifiable 

parental consent that satisfy the 

requirements of this paragraph include: 

(i) Providing a consent form to be 

signed by the parent and returned to the 

operator by postal mail, facsimile, or 

electronic scan; 

(ii) Requiring a parent, in connection 

with a monetary transaction, to use a 

credit card, debit card, or other online 

payment system that provides 

notification of each discrete transaction 

to the primary account holder; 

(iii) Having a parent call a toll-free 

telephone number staffed by trained 

personnel; 

(iv) Having a parent connect to 

trained personnel via video-conference; 

(v) Verifying a parent’s identity by 

checking a form of government-issued 

identification against databases of such 

information, where the parent’s 

identification is deleted by the operator 

from its records promptly after such 

verification is complete; or 

(vi) Provided that, an operator that 

does not ‘‘disclose’’ (as defined by 

§ 312.2) children’s personal information, 

may use an email coupled with 

additional steps to provide assurances 

that the person providing the consent is 

the parent. Such additional steps 

include: Sending a confirmatory email 

to the parent following receipt of 

consent, or obtaining a postal address or 

telephone number from the parent and 

confirming the parent’s consent by letter 

or telephone call. An operator that uses 

this method must provide notice that 

the parent can revoke any consent given 

in response to the earlier email. 

(3) Safe harbor approval of parental 

consent methods. A safe harbor program 

approved by the Commission under 

§ 312.11 may approve its member 

operators’ use of a parental consent 

method not currently enumerated in 

paragraph (b)(2) of this section where 

the safe harbor program determines that 

such parental consent method meets the 

requirements of paragraph (b)(1) of this 

section. 

(c) Exceptions to prior parental 

consent. Verifiable parental consent is 

required prior to any collection, use, or 

disclosure of personal information from 

a child except as set forth in this 

paragraph: 

(1) Where the sole purpose of 

collecting the name or online contact 

information of the parent or child is to 

provide notice and obtain parental 

consent under § 312.4(c)(1). If the 

operator has not obtained parental 

consent after a reasonable time from the 

date of the information collection, the 


pmangrum on DSK3VPTVN1PROD with 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 31 of 36
4012 Federal Register / Vol. 78, No. 12 / Thursday, January 17, 2013 / Rules and Regulations 

operator must delete such information 

from its records; 

(2) Where the purpose of collecting a 

parent’s online contact information is to 

provide voluntary notice to, and 

subsequently update the parent about, 

the child’s participation in a Web site or 

online service that does not otherwise 

collect, use, or disclose children’s 

personal information. In such cases, the 

parent’s online contact information may 

not be used or disclosed for any other 

purpose. In such cases, the operator 

must make reasonable efforts, taking 

into consideration available technology, 

to ensure that the parent receives notice 

as described in § 312.4(c)(2); 

(3) Where the sole purpose of 

collecting online contact information 

from a child is to respond directly on a 

one-time basis to a specific request from 

the child, and where such information 

is not used to re-contact the child or for 

any other purpose, is not disclosed, and 

is deleted by the operator from its 

records promptly after responding to the 

child’s request; 

(4) Where the purpose of collecting a 

child’s and a parent’s online contact 

information is to respond directly more 

than once to the child’s specific request, 

and where such information is not used 

for any other purpose, disclosed, or 

combined with any other information 

collected from the child. In such cases, 

the operator must make reasonable 

efforts, taking into consideration 

available technology, to ensure that the 

parent receives notice as described in 

§ 312.4(c)(3). An operator will not be 

deemed to have made reasonable efforts 

to ensure that a parent receives notice 

where the notice to the parent was 

unable to be delivered; 

(5) Where the purpose of collecting a 

child’s and a parent’s name and online 

contact information, is to protect the 

safety of a child, and where such 

information is not used or disclosed for 

any purpose unrelated to the child’s 

safety. In such cases, the operator must 

make reasonable efforts, taking into 

consideration available technology, to 

provide a parent with notice as 

described in § 312.4(c)(4); 

(6) Where the purpose of collecting a 

child’s name and online contact 

information is to: 

(i) Protect the security or integrity of 

its Web site or online service; 

(ii) Take precautions against liability; 

(iii) Respond to judicial process; or 

(iv) To the extent permitted under 

other provisions of law, to provide 

information to law enforcement 

agencies or for an investigation on a 

matter related to public safety; and 

where such information is not be used 

for any other purpose; 

(7) Where an operator collects a 

persistent identifier and no other 

personal information and such identifier 

is used for the sole purpose of providing 

support for the internal operations of 

the Web site or online service. In such 

case, there also shall be no obligation to 

provide notice under § 312.4; or 

(8) Where an operator covered under 

paragraph (2) of the definition of Web 

site or online service directed to 

children in § 312.2 collects a persistent 

identifier and no other personal 

information from a user who 

affirmatively interacts with the operator 

and whose previous registration with 

that operator indicates that such user is 

not a child. In such case, there also shall 

be no obligation to provide notice under 

§ 312.4. 

§ 312.6 Right of parent to review personal 

information provided by a child. 

(a) Upon request of a parent whose 

child has provided personal information 

to a Web site or online service, the 

operator of that Web site or online 

service is required to provide to that 

parent the following: 

(1) A description of the specific types 

or categories of personal information 

collected from children by the operator, 

such as name, address, telephone 

number, email address, hobbies, and 

extracurricular activities; 

(2) The opportunity at any time to 

refuse to permit the operator’s further 

use or future online collection of 

personal information from that child, 

and to direct the operator to delete the 

child’s personal information; and 

(3) Notwithstanding any other 

provision of law, a means of reviewing 

any personal information collected from 

the child. The means employed by the 

operator to carry out this provision 

must: 

(i) Ensure that the requestor is a 

parent of that child, taking into account 

available technology; and 

(ii) Not be unduly burdensome to the 

parent. 

(b) Neither an operator nor the 

operator’s agent shall be held liable 

under any Federal or State law for any 

disclosure made in good faith and 

following reasonable procedures in 

responding to a request for disclosure of 

personal information under this section. 

(c) Subject to the limitations set forth 

in § 312.7, an operator may terminate 

any service provided to a child whose 

parent has refused, under paragraph 

(a)(2) of this section, to permit the 

operator’s further use or collection of 

personal information from his or her 

child or has directed the operator to 

delete the child’s personal information. 

§ 312.7 Prohibition against conditioning a 

child’s participation on collection of 

personal information. 

An operator is prohibited from 

conditioning a child’s participation in a 

game, the offering of a prize, or another 

activity on the child’s disclosing more 

personal information than is reasonably 

necessary to participate in such activity. 

§ 312.8 Confidentiality, security, and 

integrity of personal information collected 

from children. 

The operator must establish and 

maintain reasonable procedures to 

protect the confidentiality, security, and 

integrity of personal information 

collected from children. The operator 

must also take reasonable steps to 

release children’s personal information 

only to service providers and third 

parties who are capable of maintaining 

the confidentiality, security and 

integrity of such information, and who 

provide assurances that they will 

maintain the information in such a 

manner. 

§ 312.9 Enforcement. 

Subject to sections 6503 and 6505 of 

the Children’s Online Privacy Protection 

Act of 1998, a violation of a regulation 

prescribed under section 6502 (a) of this 

Act shall be treated as a violation of a 

rule defining an unfair or deceptive act 

or practice prescribed under section 

18(a)(1)(B) of the Federal Trade 

Commission Act (15 U.S.C. 

57a(a)(1)(B)). 

§ 312.10 Data retention and deletion 

requirements. 

An operator of a Web site or online 

service shall retain personal information 

collected online from a child for only as 

long as is reasonably necessary to fulfill 

the purpose for which the information 

was collected. The operator must delete 

such information using reasonable 

measures to protect against 

unauthorized access to, or use of, the 

information in connection with its 

deletion. 

§ 312.11 Safe harbor programs. 

(a) In general. Industry groups or 

other persons may apply to the 

Commission for approval of selfregulatory program guidelines (‘‘safe 

harbor programs’’). The application 

shall be filed with the Commission’s 

Office of the Secretary. The Commission 

will publish in the Federal Register a 

document seeking public comment on 

the application. The Commission shall 

issue a written determination within 

180 days of the filing of the application. 

(b) Criteria for approval of selfregulatory program guidelines. Proposed 

safe harbor programs must demonstrate 


pmangrum on DSK3VPTVN1PROD with 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 32 of 36
Federal Register / Vol. 78, No. 12 / Thursday, January 17, 2013 / Rules and Regulations 4013 

that they meet the following 

performance standards: 

(1) Program requirements that ensure 

operators subject to the self-regulatory 

program guidelines (‘‘subject 

operators’’) provide substantially the 

same or greater protections for children 

as those contained in §§ 312.2 through 

312.8, and 312.10. 

(2) An effective, mandatory 

mechanism for the independent 

assessment of subject operators’ 

compliance with the self-regulatory 

program guidelines. At a minimum, this 

mechanism must include a 

comprehensive review by the safe 

harbor program, to be conducted not 

less than annually, of each subject 

operator’s information policies, 

practices, and representations. The 

assessment mechanism required under 

this paragraph can be provided by an 

independent enforcement program, such 

as a seal program. 

(3) Disciplinary actions for subject 

operators’ non-compliance with selfregulatory program guidelines. This 

performance standard may be satisfied 

by: 

(i) Mandatory, public reporting of any 

action taken against subject operators by 

the industry group issuing the selfregulatory guidelines; 

(ii) Consumer redress; 

(iii) Voluntary payments to the United 

States Treasury in connection with an 

industry-directed program for violators 

of the self-regulatory guidelines; 

(iv) Referral to the Commission of 

operators who engage in a pattern or 

practice of violating the self-regulatory 

guidelines; or 

(v) Any other equally effective action. 

(c) Request for Commission approval 

of self-regulatory program guidelines. A 

proposed safe harbor program’s request 

for approval shall be accompanied by 

the following: 

(1) A detailed explanation of the 

applicant’s business model, and the 

technological capabilities and 

mechanisms that will be used for initial 

and continuing assessment of subject 

operators’ fitness for membership in the 

safe harbor program; 

(2) A copy of the full text of the 

guidelines for which approval is sought 

and any accompanying commentary; 

(3) A comparison of each provision of 

§§ 312.2 through 312.8, and 312.10 with 

the corresponding provisions of the 

guidelines; and 

(4) A statement explaining: 

(i) How the self-regulatory program 

guidelines, including the applicable 

assessment mechanisms, meet the 

requirements of this part; and 

(ii) How the assessment mechanisms 

and compliance consequences required 

under paragraphs (b)(2) and (b)(3) 

provide effective enforcement of the 

requirements of this part. 

(d) Reporting and recordkeeping 

requirements. Approved safe harbor 

programs shall: 

(1) By July 1, 2014, and annually 

thereafter, submit a report to the 

Commission containing, at a minimum, 

an aggregated summary of the results of 

the independent assessments conducted 

under paragraph (b)(2) of this section, a 

description of any disciplinary action 

taken against any subject operator under 

paragraph (b)(3) of this section, and a 

description of any approvals of member 

operators’ use of a parental consent 

mechanism, pursuant to § 312.5(b)(4); 

(2) Promptly respond to Commission 

requests for additional information; and 

(3) Maintain for a period not less than 

three years, and upon request make 

available to the Commission for 

inspection and copying: 

(i) Consumer complaints alleging 

violations of the guidelines by subject 

operators; 

(ii) Records of disciplinary actions 

taken against subject operators; and 

(iii) Results of the independent 

assessments of subject operators’ 

compliance required under paragraph 

(b)(2) of this section. 

(e) Post-approval modifications to 

self-regulatory program guidelines. 

Approved safe harbor programs must 

submit proposed changes to their 

guidelines for review and approval by 

the Commission in the manner required 

for initial approval of guidelines under 

paragraph (c)(2) of this section. The 

statement required under paragraph 

(c)(4) of this section must describe how 

the proposed changes affect existing 

provisions of the guidelines. 

(f) Revocation of approval of selfregulatory program guidelines. The 

Commission reserves the right to revoke 

any approval granted under this section 

if at any time it determines that the 

approved self-regulatory program 

guidelines or their implementation do 

not meet the requirements of this part. 

Safe harbor programs that were 

approved prior to the publication of the 

Final Rule amendments must, by March 

1, 2013, submit proposed modifications 

to their guidelines that would bring 

them into compliance with such 

amendments, or their approval shall be 

revoked. 

(g) Operators’ participation in a safe 

harbor program. An operator will be 

deemed to be in compliance with the 

requirements of §§ 312.2 through 312.8, 

and 312.10 if that operator complies 

with Commission-approved safe harbor 

program guidelines. In considering 

whether to initiate an investigation or 

bring an enforcement action against a 

subject operator for violations of this 

part, the Commission will take into 

account the history of the subject 

operator’s participation in the safe 

harbor program, whether the subject 

operator has taken action to remedy 

such non-compliance, and whether the 

operator’s non-compliance resulted in 

any one of the disciplinary actions set 

forth in paragraph (b)(3). 

§ 312.12 Voluntary Commission Approval 

Processes. 

(a) Parental consent methods. An 

interested party may file a written 

request for Commission approval of 

parental consent methods not currently 

enumerated in § 312.5(b). To be 

considered for approval, a party must 

provide a detailed description of the 

proposed parental consent methods, 

together with an analysis of how the 

methods meet § 312.5(b)(1). The request 

shall be filed with the Commission’s 

Office of the Secretary. The Commission 

will publish in the Federal Register a 

document seeking public comment on 

the request. The Commission shall issue 

a written determination within 120 days 

of the filing of the request; and 

(b) Support for internal operations of 

the Web site or online service. An 

interested party may file a written 

request for Commission approval of 

additional activities to be included 

within the definition of support for 

internal operations. To be considered 

for approval, a party must provide a 

detailed justification why such activities 

should be deemed support for internal 

operations, and an analysis of their 

potential effects on children’s online 

privacy. The request shall be filed with 

the Commission’s Office of the 

Secretary. The Commission will publish 

in the Federal Register a document 

seeking public comment on the request. 

The Commission shall issue a written 

determination within 120 days of the 

filing of the request. 

§ 312.13 Severability. 

The provisions of this part are 

separate and severable from one 

another. If any provision is stayed or 

determined to be invalid, it is the 

Commission’s intention that the 

remaining provisions shall continue in 

effect. 


pmangrum on DSK3VPTVN1PROD with 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 33 of 36
4014 Federal Register / Vol. 78, No. 12 / Thursday, January 17, 2013 / Rules and Regulations 

401 15 U.S.C. 6501–6506. 

402COPPA, 15 U.S.C. 6501(2), defines the term 

‘‘operator’’ as ‘‘any person who operates a Web site 

located on the Internet or an online service and who 

collects or maintains personal information from or 

about users of or visitors to such Web site or online 

service, or on whose behalf such information is 

collected and maintained * * *’’ As stated in the 

Statement of Basis and Purpose for the original 

COPPA Rule, ‘‘The definition of ‘operator’ is of 

central importance because it determines who is 

covered by the Act and the Rule.’’ Children’s 

Online Privacy Protection Rule 64 FR 59888, 59891 

(Nov. 3, 1999) (final rule). 

403 15 U.S.C. 6502(a)(1). 

404 If the third-party plugs-ins are child-directed 

or have actual knowledge that they are collecting 

children’s personal information they are already 

expressly covered by the COPPA statute. Thus, as 

the SBP notes, a behavioral advertising network that 

targets children under the age of 13 is already 

deemed an operator. The amendment must 

therefore be aimed at reaching third-party plug-ins 

that are either not child-directed or do not have 

actual knowledge that they are collecting children’s 

personal information, which raises a question about 

what harm this amendment will address. For 

example, it appears that this same type of harm 

could occur through general audience Web sites 

and online services collecting and using visitors’ 

personal information without knowing whether 

some of the data is children’s personal information, 

which is a practice that COPPA and the 

amendments do not prohibit. 

405 16 CFR 312.2 (Definitions). 

406This expanded definition of operator reverses 

the Commission’s previous conclusion that the 

appropriate test for determining an entity’s status as 

an operator is to ‘‘look at the entity’s relationship 

to the data collected,’’ using factors such as ‘‘who 

owns and/or controls the information, who pays for 

its collection and maintenance, the pre-existing 

contractual relationships regarding collection and 

maintenance of the information, and the role of the 

Web site or online service in collecting and/or 

maintaining the information (i.e., whether the site 

participates in collection or is merely a conduit 

through which the information flows to another 

entity.)’’ Children’s Online Privacy Protection Rule 

64 FR 59888, 59893, 59891 (Nov. 3, 1999) (final 

rule). 

407Chevron v. Natural Resources Defense 

Council, Inc., 467 U.S. 837, 842–43 (1984) (‘‘When 

a court reviews an agency’s construction of the 

statute which it administers, it is confronted with 

two questions. First, always, is the question 

whether Congress has directly spoken to the precise 

question at issue. If the intent of Congress is clear, 

that is the end of the matter; for the court, as well 

as the agency, must give effect to the 

unambiguously expressed intent of Congress.’’). 

By direction of the Commission, 

Commissioner Rosch abstaining, and 

Commissioner Ohlhausen dissenting. 

Donald S. Clark, 

Secretary. 

Dissenting Statement of Commissioner 

Maureen K. Ohlhausen 

I voted against adopting the amendments 

to the Children’s Online Privacy Protection 

Act (COPPA) Rule because I believe a core 

provision of the amendments exceeds the 

scope of the authority granted us by Congress 

in COPPA, the statute that underlies and 

authorizes the Rule.401 Before I explain my 

concerns, I wish to commend the 

Commission staff for their careful 

consideration of the multitude of issues 

raised by the numerous comments in this 

proceeding. Much of the language of the 

amendments is designed to preserve 

flexibility for the industry while striving to 

protect children’s privacy, a goal I support 

strongly. The final proposed amendments 

largely strike the right balance between 

protecting children’s privacy online and 

avoiding undue burdens on providers of 

children’s online content and services. The 

staff’s great expertise in the area of children’s 

privacy and deep understanding of the values 

at stake in this matter have been invaluable 

in my consideration of these important 

issues. 

In COPPA Congress defined who is an 

operator and thereby set the outer boundary 

for the statute’s and the COPPA Rule’s 

reach.402 It is undisputed that COPPA places 

obligations on operators of Web sites or 

online services directed to children or 

operators with actual knowledge that they are 

collecting personal information from 

children. The statute provides, ‘‘It is 

unlawful for an operator of a Web site or 

online service directed to children, or any 

operator that has actual knowledge that it is 

collecting personal information from a child, 

to collect personal information from a child 

in a manner that violates the regulations 

prescribed [by the FTC].’’ 403

The Statement of Basis and Purpose for the 

amendments (SBP) discusses concerns that 

the current COPPA Rule may not cover childdirected Web sites or services that do not 

themselves collect children’s personal 

information but may incorporate third-party 

plug-ins that collect such information 404 for 

the plug-ins’ use but do not collect or 

maintain the information for, or share it with, 

the child-directed site or service. To address 

these concerns, the amendments add a new 

proviso to the definition of operator in the 

COPPA Rule: ‘‘Personal information is 

collected or maintained on behalf of an 

operator when: (a) it is collected or 

maintained by an agent or service provider of 

the operator; or (b) the operator benefits by 

allowing another person to collect personal 

information directly from users of such Web 

site or online service.’’ 405

The proposed amendments construe the 

term ‘‘on whose behalf such information is 

collected and maintained’’ to reach childdirected Web sites or services that merely 

derive from a third-party plug-in some kind 

of benefit, which may well be unrelated to 

the collection and use of children’s 

information (e.g., content, functionality, or 

advertising revenue). I find that this 

proviso—which would extend COPPA 

obligations to entities that do not collect 

personal information from children or have 

access to or control of such information 

collected by a third-party does not comport 

with the plain meaning of the statutory 

definition of an operator in COPPA, which 

covers only entities ‘‘on whose behalf such 

information is collected and maintained.’’ 406

In other words, I do not believe that the fact 

that a child-directed site or online service 

receives any kind of benefit from using a 

plug-in is equivalent to the collection of 

personal information by the third-party plugin on behalf of the child-directed site or 

online service. 

As the Supreme Court has directed, an 

agency ‘‘must give effect to the 

unambiguously expressed intent of 

Congress.’’ 407 Thus, regardless of the policy 

justifications offered, I cannot support 

expanding the definition of the term 

‘‘operator’’ beyond the statutory parameters 

set by Congress in COPPA. 

I therefore respectfully dissent. 

[FR Doc. 2012–31341 Filed 1–16–13; 8:45 am] 

BILLING CODE 6750–01–P 


pmangrum on DSK3VPTVN1PROD with 

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 34 of 36
Exhibit B

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 35 of 36
REASONS FOR SETTLEMENT

This statement accompanies the Stipulated Order for Permanent Injunction and Civil

Penalty Judgment (“Stipulated Order”) executed by Edmodo, LLC (“Defendant”) in settlement of

an action brought to obtain penalties and equitable relief for engaging in acts or practices in

violation of the Children’s Online Privacy Protection Act of 1998 (“COPPA”), 15 U.S.C. §§

6502(c) and 6505(d), and the Children’s Online Privacy Protection Rule (“Rule”), 16 C.F.R. Part

312, and §§ 5(a)(1), 5(m)(l)(A), 13(b), and 16(a) of the Federal Trade Commission Act (“FTC

Act”), 15 U.S.C. §§ 45(a), 45(m)(l)(A), 53(b), and 56(a). The settlement requires Defendant to

pay a civil penalty in the amount of $6 million dollars ($6,000,000), which has been suspended

due to inability to pay. The settlement also imposes robust injunctive relief.

Pursuant to Section 5(m)(3) of the FTC Act, as amended, 15 U.S.C. § 45(m)(3), the 

Commission hereby sets forth its reasons for settlement by entry of the Stipulated Order:

On the basis of the allegations contained in the attached complaint, the Commission 

believes that the $6 million civil penalty, suspended due to inability to pay, constitutes an 

appropriate amount on which to base settlement. The full penalty amount will become 

immediately due if Defendant is found to have misrepresented its finances. The civil 

penalty and provisions enjoining Defendant from violating the Rule constitute effective 

means to assure its future compliance and deter others who might violate these laws.

Additionally, with the entry of such a Stipulated Order, the time and expense of litigation 

will be avoided.

For the foregoing reasons, the Commission believes that the settlement by entry of the

attached Stipulated Order with Defendant is justified and well within the public interest.

Case 3:23-cv-02495 Document 1-1 Filed 05/22/23 Page 36 of 36