Hunton Retail Law Resource

The California Consumer Privacy Act continues to drive significant enforcement activity—particularly when minors’ data is involved. In a recent action, the California Privacy Protection Agency imposed a $1.1 million fine on youth sports platform PlayOn Sports for alleged violations involving student data and inadequate opt-out mechanisms. The case highlights growing regulatory scrutiny around how companies collect, share, and provide transparency about personal information—especially when schools and students are involved. 

The FTC announced the issuance of an updated children’s privacy rule (COPPA), more than five years after initiating a rule review. The Commission vote on the Rule was 5-0, with various Commissioners filing separate statements. The Final Rule, which will be published in the Federal Register shortly, contains several significant changes, but also stops short of the version proposed by the FTC in January of 2024. The Rule will go into effect 60 days after its publication in the Federal Register; most covered entities will have one year after publication to comply.

On Friday, August 2, 2024, the United States sued ByteDance, TikTok, and its affiliates for violating the Children’s Online Privacy Protection Act of 1998 (“COPPA”) and the Children’s Online Privacy Protection Rule (“COPPA Rule”). In its complaint, the Department of Justice alleges TikTok collected, stored, and processed vast amounts of data from millions of child users of its popular social media app.

The Children’s Advertising Review Unit (CARU) of BBB National Programs issued a new compliance warning aimed at addressing the use of artificial intelligence (AI) in advertisements and data collection efforts targeted at children. The warning emphasizes that CARU will “strictly enforce” its Advertising and Privacy Guidelines for advertisers, brands, influencers and manufacturers that utilize AI in marketing and data collection involving children. The warning specifically highlights CARU’s concerns about the risks of AI in connection with the susceptibility of children to marketing that fails to distinguish between what is real and what is not.

BBB National Programs’ Children’s Advertising Review Unit (CARU) has released new Guardrails for Child-Directed Advertising and Privacy in the Metaverse. As explained in a BBB press release, the Guardrails are intended to provide companies with best practices as they navigate the complexities of engaging with children in metaverse experiences. The Guardrails offer “actionable recommendations” on developing metaverse experiences directed to children, complying with existing advertising and privacy law, and engaging responsibly with children online. These guidelines build on earlier CARU guidance regarding metaverse activities.