1

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

BRIAN M. BOYNTON, Principal Deputy Assistant Attorney General

ARUN G. RAO, Deputy Assistant Attorney General

AMANDA N. LISKAMM, Director

LISA K. HSIAO, Assistant Director

JAMES T. NELSON, Senior Trial Attorney

U.S. Department of Justice

Consumer Protection Branch

Civil Division

450 5th Street, N.W.

Washington, DC 20001

Telephone: (202) 616-2376

james.nelson2@usdoj.gov

ISMAIL J. RAMSEY (CABN 189820)

United States Attorney

MICHELLE LO (NYRN 4325163)

Chief, Civil Division

VIVIAN F. WANG (CABN 277577)

Assistant United States Attorney

United States Attorney’s Office 

Northern District of California

450 Golden Gate Ave. 

San Francisco, CA 94102

Telephone: (415) 436-7136

vivian.wang@usdoj.gov

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

UNITED STATES OF AMERICA, 

 Plaintiff,

v.

EDMODO, LLC, a limited liability 

corporation.

 Defendant.

Case No. 

COMPLAINT FOR PERMANENT 

INJUNCTION, CIVIL PENALTIES, AND 

OTHER EQUITABLE RELIEF

Plaintiff, the United States of America, acting upon notification and authorization to the Attorney 

General by the Federal Trade Commission (“FTC” or “Commission”), for its Complaint alleges:

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 1 of 19
2 

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1. Plaintiff brings this action under Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the 

Federal Trade Commission Act (“FTC Act”), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1), 

and Sections 1303(c) and 1306(d) of the Children’s Online Privacy Protection Act of 1998 (“COPPA”), 

15 U.S.C. §§ 6502(c) and 6505(d), to obtain monetary civil penalties, a permanent injunction, and other 

relief for Defendant’s violations of Section 5 of the FTC Act and the Commission’s Children’s Online 

Privacy Protection Rule (“Rule” or “COPPA Rule”), 16 C.F.R. Part 312. 

CASE SUMMARY

2. This matter involves Defendant’s numerous violations of the COPPA Rule. Until 2022, 

Defendant illegally collected the personal information of students in the United States under the age of 

13 covered by the Rule. Defendant did not provide direct notice of its information practices to parents, 

did not obtain parental authorization prior to collecting students’ personal information, and did not 

retain children’s personal information only as long as reasonably necessary to fulfill the purpose for 

which it was collected. In addition, by unfairly burdening schools and teachers in the United States 

with its COPPA-compliance responsibilities, Defendant also engaged in unfair practices in violation of 

Section 5 of the FTC Act.

JURISDICTION, VENUE, AND DIVISIONAL ASSIGNMENT

3. This Court has subject matter jurisdiction pursuant to 28 U.S.C. §§ 1331, 1337(a), 1345, 

and 1355, and 15 U.S.C. §§ 45(m)(1)(A) and 56(a). 

4. Venue in the Northern District of California is proper under 15 U.S.C. § 53(b) and 28 

U.S.C. §§ 1391(b)(2) and (c)(2) and 1395(a) because Defendant has its principal place of this business 

in this District, because Defendant transacted business in this District, and because a substantial part of 

the events or omissions giving rise to the claims occurred in this District.

5. Divisional assignment is proper in the San Francisco Division or the Oakland Division 

under N.D. Cal. Civil L.R. 3-2(d) because this action arises in San Mateo County. 

SECTION 5 OF THE FTC ACT

6. Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), prohibits unfair and deceptive acts or 

practices in or affecting commerce.

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 2 of 19
3 

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

THE CHILDREN’S ONLINE PRIVACY PROTECTION ACT RULE

7. Congress enacted COPPA in 1998 to protect the safety and privacy of children online by 

prohibiting the unauthorized or unnecessary collection of children’s personal information online by 

operators of Internet websites and online services. COPPA directed the Commission to promulgate a 

rule implementing COPPA. The Commission promulgated the COPPA Rule on November 3, 1999, 

under Section 1303(b) of COPPA, 15 U.S.C. § 6502(b), and Section 553 of the Administrative 

Procedure Act, 5 U.S.C. § 553. The Rule went into effect on April 21, 2000. The Commission 

promulgated revisions to the Rule that went into effect on July 1, 2013. Pursuant to Section 1303(c) of 

COPPA, 15 U.S.C. § 6502(c), and Section 18(d)(3) of the FTC Act, 15 U.S.C. § 57a(d)(3), a violation of 

the Rule constitutes an unfair or deceptive act or practice in or affecting commerce, in violation of 

Section 5(a) of the FTC Act, 15 U.S.C. § 45(a).

8. The COPPA Rule applies to any operator of a commercial website or online service 

directed to children that collects, uses, and/or discloses personal information from children, and to any 

operator of a commercial website or online service that has actual knowledge that it collects, uses, 

and/or discloses personal information from children. The term “personal information” means 

“individually identifiable information about an individual collected online,” and includes, among other 

things, “first and last name,” “online contact information,” a “telephone number,” a “persistent identifier 

that can be used to recognize a user over time and across different Web sites and online services,” and a 

“photograph, video, or audio file where such file contains a child’s image or voice.” 

9. The Rule requires operators to meet specific requirements prior to collecting, using, or 

disclosing personal information from children, including but not limited to: 

a. Providing clear, understandable, and complete notice of its information practices, 

including specific disclosures directly to parents; 

b. Making reasonable efforts, taking into account available technology, to ensure that 

parents receive the direct notice; 

c. Obtaining verifiable parental consent prior to collecting, using, and/or disclosing 

personal information from children; and 

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 3 of 19
4 

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

d. Retaining personal information collected from children online only as long as is 

reasonably necessary to fulfill the purpose for which the information was collected. 

10. For purposes of this Complaint, the terms “child,” “collects,” “collection,” “disclosure,” 

“Internet,” “obtaining verifiable consent,” “online contact information,” “operator,” “parent,” “personal 

information,” and “Web site or online service directed to children” are defined as those terms are 

defined in Section 312.2 of the COPPA Rule, 16 C.F.R. § 312.2. 

DEFENDANT

11. Defendant Edmodo, LLC (“Edmodo”) is a Delaware corporation with its principal place 

of business at 777 Mariners Island Boulevard, San Mateo, California 94404. Until approximately 

September 2022, Edmodo transacted business in this District and throughout the United States, and 

Edmodo currently transacts business in this District relating to its customers in other countries. 

COMMERCE

12. At all times material to this Complaint, Defendant has maintained a substantial course of 

trade in or affecting commerce, as “commerce” is defined in Section 4 of the FTC Act, 15 U.S.C. § 44. 

DEFENDANT’S BUSINESS PRACTICES

13. Until approximately September 2022, Defendant operated and provided the Edmodo 

platform and related mobile applications (“Edmodo Platform”) to teachers, students, and parents 

throughout the United States. Defendant continues to provide the Edmodo Platform in countries outside 

the United States. The Edmodo Platform allows individual teachers to create an account, and then invite 

students and parents to join their “virtual” classroom. Edmodo features available to teachers include 

virtual class spaces to host discussions and share materials, student assessment tools such as 

assignments, quizzes, educational games and gradebooks, direct messaging to communicate privately 

with students and parents, and a calendar to organize tasks and events, among others. Teachers can 

create classes and groups to which they can invite their students, other teachers, or parents. When 

creating a class, teachers indicate the grade level of the class. 

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 4 of 19
5

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

14. In the United States, Defendant offered two versions of the Edmodo Platform to students, 

teachers, and parents—a free version (the “Free Platform”) and a subscription version (“Edmodo 

Enterprise”).

15. Students could access the Free Platform either by downloading the free “Edmodo: Your 

Online Classroom” mobile application from Apple’s App Store or Google Play, or they could register 

for the service through Defendant’s website, www.edmodo.com. 

16. Access to the Free Platform did not require any contractual arrangement on a school or 

district level—any individual teacher could register independently. Once a teacher registered for an 

account, the teacher could create a class and invite students to join Edmodo by (a) creating student 

accounts in advance, (b) inviting students to join by email, (c) sharing a unique class URL, or (d) 

sharing a unique class code. To generate the student accounts in advance, a teacher entered the 

student’s first name, last name, and email address. If invited to join by email, class URL or class code, 

students registered by providing first name, last name, and email address. Defendant also asked students 

to provide date of birth (between July-September 2020) and phone number (prior to July 2020). 

17. Once an account was created on the Free Platform, Defendant allowed students to 

provide additional information to Defendant such as school name, phone number, location, and a profile 

picture. Defendant also automatically collected certain usage and device information, including cookies, 

IP address, device type, operating system, browser type and ID, and geographic location based on IP 

address. 

18. In contrast to the Free Platform, the Edmodo Enterprise was available to schools and 

school districts that first entered into a contractual arrangement with Edmodo and paid a subscription fee 

based on the number of users expected to use the platform in that school or district. The teachers then 

created student accounts in a manner similar to the Free Platform, and Edmodo collected the same 

personal information from students. 

19. As described in further detail below, until approximately September 2022, both the Free 

Platform and Edmodo Enterprise collected personal information from student users in the United States 

without informed parental consent. Additionally, between at least 2018 and September 2022, Defendant 

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 5 of 19
6 

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

collected personal information from users in the United States in the form of persistent identifiers from 

students’ devices and used that personal information to serve contextual advertising to students via the 

Free Platform, including students under 13. Between at least 2018 and September 2022, Defendant 

allowed its third-party advertising partners to collect persistent identifiers in the form of IP addresses 

from student users in the United States, enabling advertisers to identify the device on which to serve the 

contextual ad. 

DEFENDANT IS SUBJECT TO THE COPPA RULE

20. Defendant is subject to the COPPA Rule because: (1) both the free and enterprise 

versions of the Edmodo Platform are directed to children under 13; and (2) Defendant has actual 

knowledge that children under 13 used both versions of the platform, including children under 13 in the 

United States. 

21. First, the Edmodo Platform is an online service directed to children that was available in 

the United States until approximately September 2022. Defendant directed and actively marketed the 

Edmodo Platform to elementary and middle schools in the United States, including schools that teach 

children under the age of 13. Students as young as kindergarten age could be invited to create accounts 

on Defendant’s platform, and Defendant itself estimated that, in the United States, around 600,000 

students under the age of 13 used the Edmodo Platform in 2020 alone. Defendant intended that children 

in the United States under the age of 13 use its Edmodo Platform and such children did, in fact, use these 

services. Therefore, under the Rule, the Edmodo Platform is a web site or online service directed to 

children. 

22. Second, Defendant had actual knowledge that children in the United States under the age 

of 13 used the Edmodo Platform. Defendant collected dates of birth from students during the sign-up 

process and was therefore able to identify students who are under the age of 13. Moreover, when 

creating a class on the Edmodo Platform, teachers provided the grade level of the class. Based on the 

grade level entered by teachers during the sign-up process, Defendant could identify which classes in the 

United States contained children under the age of 13. Therefore, under the Rule, Defendant had actual 

knowledge that children under 13 used the Edmodo Platform. 

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 6 of 19
7 

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

DEFENDANT VIOLATED COPPA BY FAILING TO OBTAIN VERIFIABLE PARENTAL 

CONSENT

23. The COPPA Rule requires covered operators, such as Defendant, to obtain verifiable 

parental consent before collecting, using, or disclosing personal information from children. Obtaining 

verifiable parental consent includes making “any reasonable effort (taking into consideration available 

technology) to ensure that before personal information is collected from a child, a parent of the child: 

(1) receives notice of the operator’s personal information collection, use, and disclosure practices; and 

(2) authorizes any collection, use, and/or disclosure of the personal information.” 16 C.F.R. § 312.2. 

24. The Commission’s 1999 COPPA Rule Statement of Basis and Purpose (“COPPA 

SBP”) explains that the Rule allows schools to (1) serve as the parents’ agents in the notice and 

consent process by consenting on behalf of parents, or (2) act as intermediaries between operators and 

parents to obtain consent directly from parents. 64 Fed. Reg. 59888, 59903 (Nov. 3, 1999). 

25. However, the COPPA SBP also states that before an operator may rely on schoolfacilitated authorization to collect personal information from children, it must first “provide notice to 

the school of the operator’s collection, use and disclosure practices.” 64 Fed. Reg. 59888, 59903 

(Nov. 3, 1999). 

26. In this case, and as described more fully below, Defendant’s terms of service (“Terms 

of Service”) suggested that schools and teachers were responsible for obtaining the verifiable parental 

consent required by the COPPA Rule. Defendant’s purported reliance on teachers and schools to 

obtain parental consent, whether by regarding the teachers and schools as (1) agents authorizing 

collection on behalf of parents, or (2) intermediaries to obtain consent from parents, violated the 

COPPA Rule. 

27. In the first scenario, Defendant could not rely on schools and teachers to provide 

authorization as agents of parents for two reasons. First, Defendant never provided the schools or 

teachers with direct notice of its practices, thereby preventing the schools from providing authorization 

on behalf of parents. Second, a school’s or teacher’s ability to serve as the parent’s agent is limited to 

the educational context. 64 Fed. Reg. 59888, 59903 (Nov. 3, 1999). Defendant could not rely on 

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 7 of 19
8

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

schools or teachers to serve as a parent’s agent because Defendant used children’s personal 

information for a non-educational purpose (advertising).

28. In the second scenario, Defendant could not rely on schools and teachers to be 

intermediaries to obtain consent from parents because Defendant failed to adequately inform schools 

and teachers of their role as intermediaries, failed to provide them with the information necessary for 

them to act as intermediaries, and failed to monitor whether parents ultimately actually provided 

verifiable consent. 

I. SCENARIO I: DEFENDANT IMPROPERLY RELIED ON SCHOOLS OR 

TEACHERS AS AGENTS CONSENTING ON BEHALF OF PARENTS. 

29. In order to obtain verifiable parental consent in this scenario, an operator must (1) 

provide a direct notice of its information practices to the school or teacher, and (2) use “reasonable 

efforts” to obtain authorization from the school on behalf of the parent. 16 C.F.R. § 312.5(b)(1). 

Defendant failed to provide schools and teachers the required direct notice and also failed to obtain 

authorization from the school on behalf of the parent for both the Free Platform and Edmodo 

Enterprise. As a result, Defendant collected children’s personal information in violation of the 

COPPA Rule. 

A. Defendant Failed to Provide Direct Notice of its Information Practices or Obtain 

Authorization from Schools and Teachers on Behalf of Parents.

30. The COPPA Rule requirement to provide a direct notice of information practices means 

specifying the collection, use, and disclosure practices prior to collecting information from children. 

Such notice must be clearly and understandably written, must be complete, and must contain no 

unrelated, confusing, or contradictory materials. Further, the operator must make reasonable efforts, 

taking into account available technology, to ensure that a parent of a child (or school in appropriate 

circumstances) receives the direct notice. 

31. On the Free Platform, Defendant did not provide direct notice of Defendant’s 

information collection, use, and disclosure practices, as required by the COPPA Rule, during the user 

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 8 of 19
9

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

sign-up process or by another means. The limited documents Defendant included during the user signup process do not satisfy the COPPA Rule’s direct notice requirements. 

32. Specifically, during the sign-up process for the teacher account on the Free Platform, 

the registration screen was silent with respect to Defendant’s personal information collection, use, and 

disclosure practices and instead merely stated in small print at the bottom, “By signing up, you agree 

to our Terms of Service and Privacy Policy.” 

33. Further, neither the Terms of Service nor Defendant’s privacy policy (“Privacy Policy”) 

satisfied the COPPA Rule’s direct notice requirements. First, teachers were not required to click on 

the linked documents or review them before creating an account and using Edmodo. Therefore, 

Defendant failed to make reasonable efforts to ensure the teacher actually received the notice. Second, 

even if such a review were required, these documents contained a host of information unrelated to 

Defendant’s collection, use, or disclosure of personal information of children using the Edmodo 

Platform, including information about international legal agreements, intellectual property, and 

publishers of third-party content, among others. This was a clear violation of 16 C.F.R. § 312.4(a), 

which requires that the direct notice be “clearly and understandably written [and] complete, and 

[contain] no unrelated, confusing, or contradictory materials.” By including such extraneous 

information, Defendant failed to provide proper direct notice under the COPPA Rule. 

34. Further, Defendant’s Privacy Policy could not serve dual functions as direct notice and 

online notice. The COPPA Rule requires both a direct notice and an online notice. Indeed, the Rule 

distinguishes between the two required notices and elaborates on the requirements for each. 16 C.F.R. 

§ 312.4(d) (“In addition to the direct notice to the parent, an operator must post a prominent and 

clearly labeled link to an online notice of its information practices with regard to children . . .”). To 

the extent Defendant relied on its Privacy Policy to comply with the requirements of a 312.4(d) online 

notice, the same document could not also serve as a direct notice under 312.4(b). 

35. Defendant also did not provide direct notice of its information collection, use, and 

disclosure practices with respect to the Edmodo Enterprise service as required by the COPPA Rule. At 

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 9 of 19
10

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

no point in the contract process for schools to gain access to Edmodo Enterprise did Defendant provide 

schools in the United States with a direct notice. 

36. In addition, as with the Free Platform, the online sign-up process for Edmodo Enterprise 

also failed to inform schools of Defendant’s data collection, use, and disclosure practices, and therefore 

failed to satisfy the COPPA Rule’s direct notice requirement. 

37. Because Defendant did not provide teachers or schools in the United States direct notice 

of its information collection, use, and disclosure practices as required by the COPPA Rule, teachers and 

schools did not have the information necessary to provide authorization on behalf of students’ parents. 

B. Schools and Teachers Could Not Act As Agents for Parents to Authorize Defendant’s 

Use of Children’s Personal Information for Non-Educational Commercial Purposes.

38. Additionally, even if Defendant had given proper notice to teachers and schools,

Defendant could not rely on schools or teachers as agents to provide authorization on behalf of parents, 

because Defendant used students’ information to serve contextual advertising, a commercial purpose 

unrelated to an educational service. Where an operator engages in such non-educational commercial 

uses, it must obtain consent directly from the parents. 

39. Indeed, Defendant collected personal information in the form of persistent identifiers 

such as device IDs, cookies, and IP addresses from users of the Free Platform, including children under 

the age of 13, in order to serve them ads. In addition to collecting personal information and serving ads 

itself, Defendant also enabled third-party ad networks to collect persistent identifiers on its behalf in 

order to serve advertising to Defendant’s users on the Free Platform. 

40. The Commission’s COPPA SBP does not contemplate the use of students’ information 

for a commercial purpose because schools and teachers do not have the authority to consent in such a 

circumstance—the school’s authority to provide consent on behalf of parents for the collection of 

children’s personal information is limited to the educational context, which the Commission’s guidance 

has made clear to operators for many years.

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 10 of 19
11

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

41. Therefore, given that Defendant used students’ personal information for non-educational 

commercial purposes (i.e., to serve contextual advertising), it could not rely on schools or teachers to 

authorize collection on behalf of parents. 

II. SCENARIO II: DEFENDANT UNREASONABLY RELIED ON SCHOOLS OR 

TEACHERS TO ACT AS AN INTERMEDIARY TO PROVIDE NOTICE TO, AND 

OBTAIN CONSENT FROM, PARENTS.

42. In addition to relying on teachers and schools to provide authorization on behalf of

parents, Defendant also claims that it relied on teachers and schools to act as intermediaries to obtain 

consent from parents for both the Free Platform and Edmodo Enterprise. 

43. The Rule provides that an operator must “make reasonable efforts, taking into account 

available technology, to ensure that a parent of a child receives direct notice” of Defendant’s 

information collection, use, and disclosure practices. 16 C.F.R. §312.4(b). In any event, where an 

operator relies on an intermediary, the sole responsibility for COPPA compliance remains with the 

operator.

44. Defendant’s purported use of schools and teachers as intermediaries for the notice and 

authorization mechanism under the Rule fails to satisfy this standard because Defendant failed to inform 

teachers and schools about their role and expected duties as intermediaries. Because of its failure to 

provide such information, Defendant necessarily failed to take reasonable steps to ensure that parents, 

through schools and teachers, would receive notice of Edmodo’s information collection practices, and 

authorize them. Further, Defendant failed to supervise or even monitor whether schools were in fact 

providing parents with notice and obtaining parents’ authorization.

A. Defendant Failed to Inform Teachers and Schools about Their Role as Intermediaries.

45. First, Defendant failed to adequately inform teachers and schools of Defendant’s reliance 

on them to provide notice to and obtain authorization from parents of children using the Edmodo 

Platform. As stated above, any teacher in the United States was able to sign up for the Free Platform 

independently and without prior approval of the teacher’s school or school district. Throughout the 

sign-up process, Defendant failed to explain that teachers or schools were required to undertake the 

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 11 of 19
12

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

responsibility for ensuring that parents receive the required notice of the platform’s information 

practices and authorize the collection of their children’s personal information. Indeed, Defendant did 

not provide the teacher or school with the requisite information needed to provide the notice of its 

information practices, as required by the COPPA Rule. 

46. As discussed above, the sign-up process for a teacher account on the Free Platform 

provided minimal information to the teacher, and merely included a small link to Defendant’s Privacy 

Policy and Terms of Service. The teacher was not required to click on the Terms of Service or Privacy 

Policy in order to sign up. Defendant’s Privacy Policy said nothing about the expectation that teachers 

would provide notice to and obtain authorization from parents, and the Terms of Service language 

purporting to convey to teachers and schools their responsibility to provide notice and obtain 

authorization from parents did not satisfy the Rule’s requirements. 

47. It is only if a teacher or school clicked on the Terms of Service link and scrolled down to 

a paragraph buried on the bottom of the second page that she would learn that Defendant intended for 

the teacher or school to be solely responsible for complying with the COPPA Rule. Specifically, 

Defendant’s Terms of Service stated: 

If you are a school, district, or teacher, you represent and warrant that you are solely responsible 

for complying with COPPA, meaning that you must obtain advance written consent from all 

parents or guardians whose children under 13 will be accessing the Services. . . . When obtaining 

consent, you must provide parents and guardians with our Privacy Policy; you can find a sample 

permission slip here [NO LINK PROVIDED]. You must keep all consents on file and provide 

them to us if we request them. For more information on COPPA, please click here [NO LINK 

PROVIDED]. If you are a teacher, you represent and warrant that you have permission and 

authorization from your school and/or district to use the Services as part of your curriculum, and 

for purposes of COPPA compliance, you represent and warrant that you are entering into these 

Terms on behalf of your school and/or district.

48. As an initial matter, the statement in Defendant’s Terms of Service is nonsensical and 

misleading. Schools or teachers could never be “solely responsible” for complying with the COPPA

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 12 of 19
13

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Rule given the Rule’s other requirements, including data security, online notice, and data retention 

limitations.

49. Moreover, the applicable statement in Defendant’s Terms of Service failed to provide the 

necessary information for teachers and schools to comply with the Rule. For example, it failed to 

inform teachers and schools that, as part of complying with the Rule, operators must provide parents 

with direct notice of their information collection, use, and disclosure practices related to children. The 

provision tells teachers and schools to share Defendant’s Privacy Policy, but this Privacy Policy is 

insufficient to meet the Rule’s notice requirement for the reasons set forth in Paragraphs 33-34. The 

Terms of Service provision also did not provide information about appropriate mechanisms for 

obtaining parental authorization that would meet the Rule’s requirements. And although the above 

Terms of Service provision claimed to link to something that would provide additional information 

about the Rule, no such link actually existed.

50. Similarly, Defendant also burdened schools using Edmodo Enterprise with COPPA 

compliance while failing to provide sufficient information on how to comply. For example, the 

contractual arrangement through which a school purchased access to Edmodo Enterprise only briefly 

mentioned consent in an exhibit attached to the contract, which merely stated that “Customer represents 

and warrants that it has the authority and consent (if required) to authorize Edmodo [to] receive, process, 

load and use personal data from [users].” Another section referenced Defendant’s Terms of Service and 

Privacy Policy and stated “Customer acknowledges that Edmodo shall require individual users to agree 

to and accept Edmodo Terms of Service . . . and Edmodo’s Privacy Policy.” As with the Free Platform, 

a school or teacher was not required to review the Terms of Service or Privacy Policy prior to using 

Edmodo Enterprise, and those documents do not comply with the Rule in any event. 

B. Defendant Failed to Make Reasonable Efforts to Ensure That Parents Received 

Notice and Provided Authorization. 

51. In addition to failing to adequately inform schools and teachers about the COPPA Rule’s 

notice and consent process, Defendant’s purported reliance on schools and teachers to obtain consent 

from parents was not reasonable because Defendant did nothing to follow up with the school or 

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 13 of 19
14 

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

teachers to determine whether they, in fact, provided the necessary notice and obtained verifiable 

parental consent. 

52. Given the inadequate instructions and lack of compliance assistance from Defendant, 

even when schools or teachers did understand they were to provide notice to and obtain authorization 

from parents, some schools and teachers failed to provide parents with accurate information about 

Defendant’s practices, thereby preventing parents from granting valid authorization under the Rule. For 

example, some schools incorrectly asserted to parents that the Edmodo Platform contained no 

advertisements, and some failed to identify what personal information Defendant collected and how that 

personal information was used, while other schools did not mention anything about Defendant’s data 

collection practices and merely directed the parents to the company’s Terms of Service and Privacy 

Policy, neither of which, as noted above, meet the Rule’s requirements. 

53. As a result of these deficiencies, Defendant failed to ensure its reliance on schools to 

obtain consent from parents met the requirements of the Rule. Indeed, Defendant ignored an essential 

aspect of COPPA compliance: operators alone, and not schools, teachers, or any other third party, are 

ultimately responsible for complying with the COPPA Rule. Defendant made no reasonable effort, as 

required by the Rule, to ensure that the schools or teachers to which it attempted to delegate its COPPA 

compliance responsibilities instituted a parental consent mechanism that complied with the Rule. 

Defendant’s failure to provide compliance assistance to schools and teachers, and its further failure to 

verify that schools and teachers actually obtained verifiable parental consent, were unreasonable, 

violated the Rule, and led to illegal information collection from children.

DEFENDANT’S PERSONAL INFORMATION RETENTION PRACTICES

VIOLATED THE COPPA RULE

54. In addition to requiring Defendant to provide direct notice and obtain parental 

authorization, the COPPA Rule also requires that operators retain children’s personal information only 

as long as is reasonably necessary to fulfill the purpose for which it was collected. 16 C.F.R. § 

312.10. Defendant’s data retention policies clearly violated the Rule. Indeed, Defendant did not even 

develop a data retention and destruction policy before March 2020. Until that time, Defendant 

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 14 of 19
15 

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

retained personal information collected online from children indefinitely and had amassed 

approximately 36 million student accounts, of which only one million were actively using the platform 

in 2020. 

55. In March 2020, Defendant finally instituted a policy pursuant to which it deletes 

student accounts that have been inactive for two years. However, Defendant failed to justify its 

maintenance of student information for two years after the account has become inactive by 

establishing that it was “reasonably necessary to fulfill the purpose for which [the personal 

information] was collected.” The Defendant thereby violated the COPPA Rule’s provisions related to 

data retention.

DEFENDANT UNFAIRLY BURDENED TEACHERS AND SCHOOLS WITH ITS COPPA 

COMPLIANCE RESPONSIBILITIES

56. Acts or practices are unfair under Section 5 of the FTC Act if they cause or are likely to 

cause substantial injury to consumers that consumers cannot reasonably avoid themselves and that is not 

outweighed by countervailing benefits to consumers or competition. 15 U.S.C. § 45(n). 

57. Defendant’s attempts to outsource its legally-mandated responsibility for COPPA 

compliance onto schools and teachers, many of which are under-resourced and lack knowledge about 

the COPPA Rule, while giving them confusing and inaccurate information about providing notice and 

obtaining verifiable parental consent, caused substantial injury to consumers, namely schools, teachers, 

and children that used the Edmodo Platform. To the extent schools and teachers even knew about 

Defendant’s attempt to rely on them to provide notice to, and obtain consent from, parents, such 

educators were forced to unnecessarily expend valuable resources in trying to understand and comply 

with the Rule as a result of Defendant’s failure to provide them with adequate information. Children 

were injured as such wasted resources were not used for educational purposes, as well as by the fact that 

their personal information was illegally collected. 

58. Schools, teachers, and children were unable to avoid such harm because Defendant failed 

to provide them with essential information about the Edmodo Platform’s information collection 

practices. 

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 15 of 19
16 

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

59. Finally, Defendant’s actions provided no countervailing benefit to consumers or 

competition. Defendant’s attempt to shift its COPPA responsibilities to schools and teachers provided 

no benefits to children or parents, and prevented schools and parents from making informed choices 

about children’s and students’ privacy. 

* * * 

60. Based on the facts and violations of law alleged in this Complaint, Plaintiff has reason to 

believe that Defendant has violated, and is violating or is about to violate laws enforced by the 

Commission because, among other things, Defendant stopped the violative conduct only after it was 

under investigation. 

VIOLATION OF THE COPPA RULE

COUNT I

61. The allegations in paragraphs 1 through 60 are incorporated as if set forth herein.

62. Defendant has been an operator of a website or online service directed to children as 

defined by the COPPA Rule, 16 C.F.R. § 312.2. 

63. Defendant collected and used, with actual knowledge, personal information from children 

under the age of 13. 

64. In numerous instances, in connection with operating an online service, Defendant 

collected or used personal information from children younger than the age of 13 in violation of the Rule, 

including by: 

a. Failing to provide direct notice to parents of Defendant’s practices with regard to the 

collection, use, or disclosure of personal information from children, in violation of 

Section 312.4(a) and (c) of the Rule, 16 C.F.R. § 312.4(a); 

b. Failing to make reasonable efforts, taking into account available technology, to ensure 

that a parent receives the direct notice to be able to provide informed consent, in violation 

of Section 312.4(b)-(c) of the Rule, 16 C.F.R. § 312.4(b)-(c);

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 16 of 19
17 

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

c. Failing to obtain verifiable parental consent before any collection, use, or disclosure of 

personal information from children, in violation of Section 312.5(a)(1) of the Rule, 16 

C.F.R. § 312.5(a)(1); and 

d. Retaining personal information collected online from children for longer than reasonably 

necessary to fulfill the purpose for which the information was collected, in violation of 

Section 312.10 of the Rule, 16 C.F.R. § 312.10. 

65. Pursuant to Section 1303(c) of COPPA, 15 U.S.C. § 6502(c), and Section 18(d)(3) of the 

FTC Act, 15 U.S.C. § 57a(d)(3), a violation of the Rule constitutes an unfair or deceptive act or practice 

in or affecting commerce, in violation of Section 5(a) of the FTC Act, 15 U.S.C. § 45(a). 

66. Defendant violated the COPPA Rule as described above with the knowledge required by 

Section 5(m)(1)(A) of the FTC Act, 15 U.S.C. § 45(m)(1)(A). 

67. Each collection, use, or disclosure of a child’s personal information in which Defendant 

has violated the Rule in one or more of the ways described above constitutes a separate violation of the 

COPPA Rule for the purpose of assessing monetary civil penalties.

68. Section 5(m)(1)(A) of the FTC Act, 15 U.S.C. § 45(m)(1)(A), as modified by Section 4 

of the Federal Civil Penalties Inflation Adjustment Act of 1990, 28 U.S.C. § 2461, the Federal Civil 

Penalties Inflation Adjustment Act Improvements Act of 2015, Public Law 114-74, sec. 701, 129 Stat. 

599 (2015), and Section 1.98(d) of the FTC’s Rules of Practice, 16 C.F.R. § 1.98(d), authorizes this 

Court to award monetary civil penalties of not more than $50,120 for each such violation of the Rule 

assessed after January 11, 2023. 

VIOLATION OF THE FTC ACT

COUNT II

69. The allegations in paragraphs 1 through 60 are incorporated as if set forth herein. 

70. In numerous instances, Defendant outsourced its duty to comply with the COPPA Rule to 

schools or teachers without providing the schools or teachers with adequate information or support to 

meet the Rule’s requirements.

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 17 of 19
18 

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

71. Defendant’s actions cause or are likely to cause substantial injury to consumers that 

consumers cannot reasonably avoid themselves and that is not outweighed by countervailing benefits to 

consumers or competition. 

72. Therefore, Defendant’s acts or practices as set forth in Paragraphs 59-60 constitute unfair 

acts or practices in violation of Section 5 of the FTC Act, 15 U.S.C. § 45(a), (n). 

PRAYER FOR RELIEF

WHEREFORE, Plaintiff, requests that the Court:

a. Enter a permanent injunction to prevent future violations of the FTC Act and the COPPA 

Rule by Defendant;

b. Award Plaintiff monetary civil penalties from Defendant for each violation of the 

COPPA Rule alleged in this Complaint; and

c. Award any additional relief as the Court determines to be just and proper. 

Dated: May 22, 2023 

FOR THE UNITED STATES OF AMERICA:

ISMAIL J. RAMSEY BRIAN M. BOYNTON

United States Attorney Principal Deputy Assistant Attorney General 

Northern District of California Civil Division

 U.S. Department of Justice 

/s/ Vivian F. Wang ARUN G. RAO

VIVIAN F. WANG Deputy Assistant Attorney General 

Assistant United States Attorney Civil Division 

United States Attorney’s Office

for the Northern District of California AMANDA N. LISKAMM 

Phone: (415) 436-7431 Director 

Fax: (415) 436-6748 

Email: vivian.wang@usdoj.gov LISA K. HSIAO

Assistant Director

Consumer Protection Branch 

 

 

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 18 of 19
19 

COMPLAINT

CASE NO.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

 /s/ James T. Nelson 

JAMES T. NELSON

Senior Trial Attorney

 U.S. Department of Justice 

Consumer Protection Branch 

 450 5th Street, NW

Sixth Floor, South 

Washington, DC 20001 

202-616-2376 

Fax: 202 514-8742 

james.nelson2@usdoj.gov 

 Of Counsel: 

 

 BENJAMIN WISEMAN

Acting Associate Director

 Division of Privacy and Identity 

 Protection

 TIFFANY GEORGE

Acting Assistant Director

 Division of Privacy and Identity 

 Protection

 GORANA NESKOVIC

 Attorney 

 Division of Privacy and Identity 

 Protection

Federal Trade Commission

600 Pennsylvania Avenue, N.W. 

 (202) 326-2322 (voice) 

 (202) 326-3062 (fax) 

 PEDER MAGEE

Attorney 

 Division of Privacy and Identity Protection 

 Federal Trade Commission

 600 Pennsylvania Avenue, N.W. 

 (202) 326-3538 (voice) 

 (202) 326-3062 (fax) 

 

Case 3:23-cv-02495 Document 1 Filed 05/22/23 Page 19 of 19