FTC Issues Policy Statement on COPPA and Voice Recordings
Time 2 Minute Read

On October 23, 2017, the Federal Trade Commission issued a policy enforcement statement providing additional guidance on the applicability of the Children’s Online Privacy Protection Rule (“COPPA Rule”) to the collection of children’s audio voice recordings. The FTC previously updated the COPPA Rule in 2013, adding voice recordings to the definition of personal information, which led to questions about how the COPPA Rule would be enforced against organizations who collect a child’s voice recording for the sole purpose of issuing a command or request.

In the policy statement, the FTC reiterated the COPPA Rule’s requirement that websites and online services directed at children obtain verifiable parental consent before collecting an audio recording of the voice of a child under age 13. The policy statement clarifies that the FTC will not pursue enforcement action against a website operator for not obtaining this consent before collecting a voice recording when (1) the voice recording is collected solely to replace written words (e.g., to perform a search), and (2) the recording is held for a brief period of time and only for that purpose. The FTC clarified that (1) the policy does not apply where the website operator requests personal information (e.g., name) via voice recording; (2) the website operator must provide clear notice of its collection and use of voice recordings, and its deletion policy, in its privacy policy; and (3) the website operator may not use the audio file for any other purpose before its destruction. Website operators must continue to comply with COPPA’s requirements in all other respects.

  • Partner

    Maeve’s practice focuses on privacy and cybersecurity law. Maeve regularly advises clients across various industry sectors on developing or enhancing existing global privacy compliance and records management programs to ...

You May Also Be Interested In

Time 3 Minute Read

On March 20, 2026, Oklahoma Governor Kevin Stitt signed SB 546 into law, enacting the Oklahoma Consumer Data Privacy Act, which will take effect on January 1, 2027.

Time 2 Minute Read

On March 23, 2026, the UK Information Commissioner's Office released new guidance clarifying the use of the new recognized legitimate interest lawful basis for processing personal information under UK data protection law.

Time 1 Minute Read

The California Consumer Privacy Act continues to drive significant enforcement activity—particularly when minors’ data is involved. In a recent action, the California Privacy Protection Agency imposed a $1.1 million fine on youth sports platform PlayOn Sports for alleged violations involving student data and inadequate opt-out mechanisms. The case highlights growing regulatory scrutiny around how companies collect, share, and provide transparency about personal information—especially when schools and students are involved. 

Time 2 Minute Read

On March 5, 2026, the California Privacy Protection Agency announced that the agency had reached a settlement with Ford Motor Company resolving an enforcement action against the company that alleged noncompliance with the California Consumer Privacy Act’s opt-out of sale/sharing rights.

Search

Subscribe Arrow

Recent Posts

Categories

Tags

Authors

Archives

Jump to Page