Federal Trade Commission Report to Congress on 

COPPA Staffing, Enforcement and Remedies 

The joint explanatory statement accompanying the Consolidated Appropriations Act of 2022 

directed the Federal Trade Commission (FTC or Commission) to provide the Committees on 

Appropriations a report detailing the current amount of resources and personnel focused on enforcing 

the COPPA Rule; the number of investigations into violations of the COPPA Rule in the past 5 years; 

and the types of relief obtained, if any, for any completed investigations.1 The Committee also “urge[d] 

the FTC to prioritize investigations into potential violations of the Children’s Online Privacy Protection 

Act Rule (COPPA Rule) and to incorporate findings from new and recent cases relating to children’s 

privacy into its ongoing COPPA Rule review process.” 

This report addresses the resources the Commission has devoted to investigating potential 

COPPA violations and bringing enforcement actions; provides detail about the extent of the 

Commission’s investigations and related efforts with respect to children’s privacy; and describes the 

remedies obtained in the various actions. In short, the FTC dedicates approximately 9-11 full-time 

equivalents (FTEs) to the COPPA program annually, has opened 80 investigations of potential COPPA 

violations in the last 5 years, and has obtained relief including civil penalties; data and algorithm 

deletion requirements; and requirements that companies implement a comprehensive privacy program 

with biennial assessments from an independent third-party assessor. 

FTC Staffing on Children’s Privacy 

Protecting children’s privacy is, and has been, a Commission priority for decades. As the 

Commission stated in its May 2022 Policy Statement on Education Technology and the Children’s 

Online Privacy Protection Act,2 “Protecting children’s privacy online has been a priority for the 

Commission since 1998, when the Commission recommended ‘that Congress develop legislation 

1 Joint Explanatory Statement published in the Congressional Record on March 9, 2022, at H2349, 

https://www.congress.gov/117/crec/2022/03/09/168/42/CREC-2022-03-09-pt3-PgH1709.pdf, accompanying the 

Consolidated Appropriations Act, 2022, H.R. 2471 (Pub. L. 117-103), incorporated by reference House Report 117-79, 

https://www.congress.gov/117/crpt/hrpt79/CRPT-117hrpt79.pdf, at 72-73. The report language indicated that the 

“Committee is aware of the significant increase in online activity by children during the COVID 19 pandemic and is 

concerned that this may lead to a greater opportunity for bad actors to unlawfully gather and use children’s personal 

information.” 

2 The Commission unanimously approved the issuance of a policy statement focused on COPPA and educational technology 

(ed tech). Federal Trade Commission, Policy Statement of the Federal Trade Commission on Education Technology and the 

Children’s Online Privacy Protection Act, 

https://www.ftc.gov/system/files/ftc_gov/pdf/Policy%20Statement%20of%20the%20Federal%20Trade%20Commission%20 

on%20Education%20Technology.pdf. The statement was driven by the same concerns raised in the Consolidated 

Appropriations Act about an increase in online activity by children during the COVID 19 pandemic – particularly as to 

children attending school virtually. The policy statement stressed that the agency will be vigilant in enforcing COPPA’s 

protections in the ed tech context in particular, and emphasized that the Commission’s COPPA authority demands 

enforcement of meaningful substantive limitations on operators’ ability to collect, use, and retain children’s data. 

FEDERAL TRADE COMMISSION • FTC.GOV 1 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

placing parents in control of the online collection and use of personal information from their children.’”3 

The concerns that led Congress to enact COPPA – concerns that the Internet presented new risks to 

children’s safety and enabled a direct connection between marketers and children without their parents’ 

involvement or knowledge – remain salient today given the changes in technology and the marketplace 

since 1998. 

The Commission’s Bureau of Consumer Protection’s (BCP) Division of Privacy and Identity 

Protection (DPIP) is dedicated to protecting individuals’ privacy and the security of their information.4 

DPIP typically has 40 to 45 FTEs. In addition, BCP staff outside of DPIP may handle privacy- and 

security-related matters relating to COPPA, including staff from FTC regional offices as well as staff 

from BCP’s Division of Enforcement, who enforce FTC orders. While some attorneys spend a 

substantial portion of their time on COPPA-related matters, there is no discrete unit assigned to work 

exclusively on COPPA matters. We estimate that COPPA-related activity in BCP accounts for 

approximately 8 to 10 FTEs annually.5 This includes DPIP staff time; time spent by attorneys and 

investigators in FTC regional offices handling COPPA investigations (see Recolor and Explore Talent 

cases in Appendix); time spent by staff in the Division of Enforcement who ensure compliance with 

FTC orders relating to COPPA; and time spent by forensic accountants who assess companies’ 

arguments regarding inability to pay a civil penalty. In addition to BCP staff time, Bureau of Economics 

staff working on COPPA investigations – for example, to assist in analyzing data and in calculating civil 

penalties – likely account for an additional FTE. These estimates do not include time spent by the 

Bureau Director, Commissioners, BCP front office staff or attorney advisors at the Commission level 

who advise the Bureau Director or Commissioners on matters, or other FTC staff such as technologists 

in the Chief Technologist’s Office or Office of General Counsel staff. 

3 Id. at n.3 and accompanying text (citing Federal Trade Commission, Privacy Online: A Report to Congress, at 42 (June 

1998)). The Commission’s actions to protect children’s privacy online predated the COPPA Rule, which was promulgated in 

November 1999. See Complaint, In re Liberty Fin. Cos., FTC File No. 982-3522 (Aug. 12, 1999) (alleging that website 

operator falsely represented that personal information collected from children in a survey would be maintained anonymously 

and that participants would be sent an e-mail newsletter and prizes); Complaint, In re GeoCities, FTC File No. 982-3015 

(Feb. 5, 1999) (alleging that website operator misrepresented which entity collected and maintained personal identifying 

information collected from children). 

4 See, e.g., Federal Trade Commission, FTC Report to Congress on Privacy and Data Security, 

https://www.ftc.gov/system/files/documents/reports/ftc-report-congress-privacysecurity/report_to_congress_on_privacy_and_data_security_2021.pdf. 

5 This estimate includes other COPPA-related activities in addition to enforcement. In the last five years those activities 

include the ongoing COPPA regulatory rule review initiated in 2019; two public workshops, one in 2019 in conjunction with 

the regulatory review and one in 2017 with the Department of Education relating to ed tech; a study under the agency’s 

Section 6(b) authority relating to social media and video streaming companies’ practices, including how their practices affect 

children and teens; oversight of the statutorily-established Safe Harbor programs charged with ensuring that participating 

companies comply with COPPA, such as reviewing the programs’ annual reports (one program withdrew in 2021 after FTC 

staff indicated that it planned to recommend that the Commission revoke its approval of the program); providing information 

to help parents and children understand and exercise their privacy rights as well as information on how companies can 

comply with COPPA; maintaining a hotline through which consumers or covered operators can contact staff with questions 

about the Rule; and maintaining up-to-date FAQs to assist parents in understanding the Rule and to help businesses comply. 

FEDERAL TRADE COMMISSION • FTC.GOV 2 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

FTC Enforcement -- Investigations, Cases, and 

Remedies 

With respect to investigations, during the period from May 1, 2017 to May 1, 2022, the 

Commission had 80 formal6 investigations open involving possible violations of COPPA. This total 

includes investigations relating solely to COPPA as well as investigations where compliance with 

COPPA was a component of a broader investigation potentially involving violations of other laws. 

During this five-year time period,7 the Commission announced 11 cases that related to COPPA.8 The 

Commission also sent warning letters to three companies that were potentially violating the COPPA 

Rule.9 

The relief obtained in each of these 11 cases is summarized in the appendix.10 Since the COPPA 

Rule was promulgated, the Commission’s remedies have typically included relief such as a civil penalty, 

injunctions against future violations, and data deletion requirements. In the last five years the 

Commission has obtained a number of new remedies designed to ensure that children’s information is 

fully protected. For example, the order in WW International (Weight Watchers)/Kurbo requires the 

companies to maintain a retention schedule for the Kurbo program – which schedule must be made 

public – setting forth the purpose for which information is collected, the specific business need for 

retaining it, and a set time frame and set of criteria for deleting it. Further, it sets out a substantive limit 

6 A formal investigation is opened at the point staff decides to seek a civil investigative demand. The count of formal 

investigations thus does not include instances where FTC staff looked into a possible COPPA violation and decided, after an 

initial investigation, not to investigate the matter further by issuing a civil investigative demand, or where FTC staff 

monitoring order compliance probed into the COPPA compliance of a company under order. In addition to the 80 

investigations, Commission staff opened four enforcement-related projects relating to COPPA. Each of these involved 

identifying and evaluating multiple possible investigative targets. Some of the 80 investigations grew out of these projects. 

7 As the five-year period ended on April 30, 2022, many of these investigations are still active. 

8 Ten cases involved alleged violations of the COPPA Rule; one involved a company’s allegedly deceptive claims that it was 

a member of an FTC-approved COPPA Safe Harbor program. All of these matters were resolved through consent orders or 

consent agreements. 

9 See App Stores Remove Three Dating Apps After FTC Warns Operator about Potential COPPA, FTC Act Violations, 

https://www.ftc.gov/news-events/news/press-releases/2019/05/app-stores-remove-three-dating-apps-after-ftc-warns-operatorabout-potential-coppa-ftc-act; FTC Warns Gator Group, Tinitell that Online Services Might Violate COPPA, 

https://www.ftc.gov/news-events/news/press-releases/2018/04/ftc-warns-gator-group-tinitell-online-services-might-violatecoppa. 

10 Links to each case are provided in the appendix. The provisions required in the orders have been summarized and 

condensed in this appendix, and the summaries thus do not include every requirement in the orders. For example, orders 

relating to violations of COPPA include a provision enjoining the defendant(s) from violating COPPA. Orders requiring 

companies to implement a comprehensive data security or privacy program, such as OpenX, VTech, i-Dressup, and Retina-X, 

include related requirements such as provisions requiring the companies to obtain biennial independent assessments of such 

program, cooperate with such assessor, and annually certify compliance. Orders alleging that companies engaged in 

deceptive conduct violating Section 5 of the FTC Act include a provision enjoining misrepresentations. Each order also 

includes standard provisions related to compliance reporting, recordkeeping, and monitoring. Such provisions enable the 

Commission to monitor and enforce compliance with the orders for the 20-year term of the orders. 

FEDERAL TRADE COMMISSION • FTC.GOV 3 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

on the retention of such data, a maximum retention period of one year after the last instance of a user 

using the service. The order also requires the companies to destroy any models or algorithms developed 

using personal information collected from children. The order in Google/YouTube requires the 

companies to develop, implement, and maintain a system for third parties who post content on YouTube 

to designate whether their content is directed to children. Once so designated, defendants must treat the 

content accordingly – for example, by not serving behaviorally targeted ads to those viewing the 

content. In OpenX, the Commission required the ad platform to delete all “ad request data” it collected 

to serve targeted ads, and to implement a comprehensive privacy program to ensure it complies with 

COPPA. This program includes a number of specific requirements to ensure that violations do not recur 

in future; for example, the company must re-review apps on its ad exchange on a periodic basis to 

identify additional child-directed apps and ban them, and must keep track of which apps and websites 

have been banned or removed from its exchange. OpenX also must provide notice about its practices to 

all of its demand-side partners. In Recolor, the order requires the defendants to offer current paid 

subscribers of the Recolor app a refund if they were under the age of 18 when they signed up for the 

app. They also have to notify users of the app about the alleged COPPA Rule violations and the steps 

that users can take in response to the settlement. 

In addition to these types of remedies, in the last five years, the Commission has obtained larger 

civil penalties than it had previously. In six of the 10 cases alleging violations of COPPA, the 

Commission obtained a civil penalty of at least $1.5 million.11 This includes the largest civil penalty 

ever obtained for a violation of COPPA, $170 million, in the Google/YouTube matter – one of the 

largest civil penalties ever obtained, worldwide, for a privacy violation.12 

Conclusion 

Children’s privacy is a priority for the Commission. The Commission has worked vigorously to 

enforce COPPA by investigating potential violations and bringing enforcement actions when violations 

are found. The Commission makes every effort to use its resources efficiently: as noted in recent 

testimony, “for FY 2021, every $1 of the FTC’s cost returned an estimated $36 in FTC-provided 

benefits to consumers.”13 With more resources, however, the FTC could do more. 

11 The Commission does not have authority to penalize violations of Section 5 of the FTC Act. Note that in some cases, a 

portion of the civil penalty was suspended due to inability to pay. 

12 See https://www.ftc.gov/news-events/news/press-releases/2019/09/google-youtube-will-pay-record-170-million-allegedviolations-childrens-privacy-law. The Commission brought this action together with the New York Attorney General. Of the 

$170 million total penalty, $136 million was paid to the Commission, the balance to the New York Attorney General. 

13 Testimony of FTC Chair Lina M. Khan Before the House Appropriations Subcommittee on Financial Services and General 

Government (May 18, 2022) at 3, 

https://www.ftc.gov/system/files/ftc_gov/pdf/Testimony%20of%20Chair%20Lina%20M.%20Khan%20Before%20the%20H 

ouse%20Appropriations%20Subcommittee%20on%20Financial%20Services%20and%20General%20Government%20-%20f 

inal.pdf; id. (“Throughout FY 2021, the FTC saved consumers an estimated $2.4 billion through its merger and nonmerger 

competition law enforcement actions and an estimated $1.5 billion through its consumer protection law enforcement 

actions.”). 

FEDERAL TRADE COMMISSION • FTC.GOV 4 
 

 

 

 

 

 

 

 

 

 

 

 

Appendix 

This appendix includes a brief summary of the remedies obtained in the 11 actions identified 

previously that were announced in the May 2017-May 2022 time frame, in reverse chronological order. 

2022: 

U.S. v. Kurbo, Inc. and WW International, Inc.:

14 

The settlement order requires WW International (formerly known as Weight Watchers) and 

Kurbo to delete personal information illegally collected from children under the age of 13. It also 

requires that the companies destroy any algorithms or work product derived from the data collected from 

children in violation of COPPA, and pay a $1.5 million civil penalty. The companies are also prohibited 

from retaining data collected in the future from children under 13 for more than a year after the last time 

a child uses the Kurbo by WW service. 

2021: 

U.S. v Kuuhuub Inc., Kuu Hubb Oy, and RecolorOy:

15 

Under the settlement order, the companies must delete all the personal information they collected 

from children under 13 unless they obtain parental consent, and must offer current paid subscribers of 

the Recolor app a refund if they were under the age of 18 when they signed up for the app. The 

companies must notify users of the app about the alleged COPPA rule violation and the steps that users 

can take in response to the settlement. The order also includes a $3 million civil penalty, which will be 

suspended upon payment of $100,000 due to the companies’ inability to pay the full amount 

U.S. v. OpenX Technologies, Inc.:

16 

The order requires the company to pay $2 million of a total civil penalty of $7.5 million, with the 

balance suspended. In addition, the order requires OpenX to delete all ad request data it collected to 

serve targeted ads. The company must implement a comprehensive privacy program to ensure it 

complies with COPPA and stops the collection and retention of personal data of children under 

13. Since 2019, when requiring a company to implement a comprehensive privacy and/or security 

program, the Commission has typically included specific requirements to supplement the more processbased fundamental elements of those programs.17 In the OpenX case, those requirements included 

14 https://www.ftc.gov/system/files/ftc_gov/pdf/wwkurbostipulatedorder.pdf. 

15 https://www.ftc.gov/system/files/documents/cases/1823184recolorstipulatedorder.pdf. 

16 https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc. 

17 See, e.g., https://www.ftc.gov/business-guidance/blog/2019/06/data-security-settlement-service-provider-includes-updatedorder-provisions. 

FEDERAL TRADE COMMISSION • FTC.GOV A-1 
 

 

 

 

 

 

 

 

 

 

building infrastructure to comply with COPPA, new training programs for employees on data security, 

privacy, and how to identify child-directed sites, and additional reviews of certain apps. 

The order also requires the company to provide a prescribed notice to demand-side partners in 

the ad ecosystem, and places restrictions on the company’s collection of location information (for 

example, to ensure that the consumer has provided affirmative express consent for the collection of 

location information through the company’s software development kit). 

2020: 

U.S. v. HyperBeard, Inc.:

18 

As part of the settlement, the defendants are required to notify and obtain verifiable consent from 

parents for any child-directed app or website they offer that collects personal information from children 

under 13. They are also prohibited from using or benefitting from personal data they previously 

collected from children under 13 in violation of COPPA and must destroy that data. The settlement 

includes a $4 million penalty, suspended upon payment of $150,000 by HyperBeard due to its inability 

to pay the full amount. The full amount will be due if either the company or the CEO are found to have 

misrepresented their finances. 

Miniclip S.A.:

19 

Miniclip is prohibited from misrepresenting its participation or certification in any privacy or 

security program sponsored by a government or any self-regulatory organization, including the 

Children’s Advertising Review Unit’s COPPA Safe Harbor program. 

/ / / 

18 https://www.ftc.gov/system/files/documents/cases/192_3109_hyperbeard_-_proposed_stipulated_order.pdf. 

19 https://www.ftc.gov/system/files/documents/cases/1923129c4722minicliporder.pdf. This case does not involve allegations 

that the company violated the COPPA Rule. The FTC alleged that Miniclip S.A., a Swiss-based company that makes mobile 

and online digital games, falsely claimed from 2015 through mid-2019 that it was a current member of the Children’s 

Advertising Review Unit’s COPPA Safe Harbor program even though that program had terminated Miniclip’s membership 

in 2015. 

FEDERAL TRADE COMMISSION • FTC.GOV A-2 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

2019: 

FTC v. YouTube and Google:

20 

The $170 million judgment represents the largest civil penalty amount ever obtained for a 

violation of COPPA. In addition to the monetary penalty, the settlement required Google and YouTube 

to develop, implement, and maintain a system that permits channel owners – posters of content on 

YouTube – to identify their child-directed content on the YouTube platform so that Google and 

YouTube can ensure the companies are complying with COPPA. In addition, the companies must notify 

channel owners that their child-directed content may be subject to the COPPA Rule’s obligations and 

provide annual training about complying with COPPA for employees who deal with YouTube channel 

owners. The settlement requires the companies to provide notice about their data collection practices 

and obtain verifiable parental consent before collecting personal information from children. 

U.S. v. Musical.ly (currently known as TikTok):

21 

The company paid $5.7 million to settle charges that it violated COPPA. The settlement also 

requires the company to comply with COPPA and to destroy personal information collected or, if 

operating as a mixed audience site employing an age gate to identify users who are children under the 

age of 13, to take other measures to protect such children such as providing notice and obtaining 

verifiable parental consent or making the children’s videos inaccessible to others and ensuring that their 

usernames cannot be used to contact them. 

U.S. v. Unixiz, Inc., d/b/a i-Dressup.com:

22 

As part of the settlement, i-Dressup and its owners agreed to pay $35,000 in civil penalties and 

are prohibited from violating COPPA. In addition, they are barred from selling, sharing, or collecting 

any personal information until they implement a comprehensive data security program to protect the 

information and obtain independent biennial assessments of this program. 

In the Matter of Retina-X:

23 

Under the settlement, Retina-X and its owner are prohibited from promoting, selling, or 

distributing apps that monitor consumers’ mobile devices unless they take certain steps to ensure the 

apps will be used only for legitimate purposes. They also are prohibited from promoting, selling, or 

distributing any monitoring app that requires users to circumvent a device’s security protections to 

install the app, without ensuring the app will be used for legitimate purposes. Other provisions of the 

settlement require that the defendants delete the data they collected from the stalking apps, comply with 

the COPPA Rule, and implement a comprehensive information security program designed to protect the 

20 https://www.ftc.gov/system/files/documents/cases/172_3083_youtube_coppa_consent_order_signed.pdf. 

21 https://www.ftc.gov/system/files/documents/cases/musical.ly_proposed_order_ecf_2-27-19.pdf. 

22 https://www.ftc.gov/system/files/documents/cases/i-dressup_stipulated_order_ecf_4-24-19.pdf. 

23 https://www.ftc.gov/system/files/documents/cases/1723118retinaxorder_0.pdf. 

FEDERAL TRADE COMMISSION • FTC.GOV A-3 
 

 

 

 

 

 

personal information they collect. Finally, the order requires defendants to report certain information to 

the Commission in the wake of a covered incident (such as a breach). 

2018: 

U.S. v. VTech Electronics Limited and VTech Electronics North America, LLC:24 

The settlement order requires VTech to pay a civil penalty of $650,000. In addition, the order 

prohibits VTech from violating COPPA in the future and from misrepresenting its security and privacy 

practices. VTech also must implement a comprehensive data security program. 

U.S. v. Prime Sites, Inc. d/b/a Explore Talent:

25 

As part of the settlement, the defendant agreed to pay a $500,000 civil penalty, suspended upon 

payment of $235,000. In addition, the company is required to comply with COPPA requirements in the 

future and to delete the information it previously collected from children. 

24 https://www.ftc.gov/system/files/documents/cases/vtech_file_stamped_stip_order_1-8-18.pdf. 

25 https://www.ftc.gov/system/files/documents/cases/1623218exploretalentorder.pdf. 

FEDERAL TRADE COMMISSION • FTC.GOV A-4