In response to recent changes in technology, the FTC has just released an updated compliance plan along with a new guide to assist companies with their COPPA compliance programs. One notable change: enforcing IOT connectivity. Despite the fact that the maximum penalties have recently increased from 16,000 to 40,000, as COPPANow has calculated, the average fine actually remains fairly low (around $2 in fact). Still, compliance should be a primary concern for any/all companies that collect any information from children under the age of 13. Fines may be fairly low now but the severity of the fines themselves are unpredictable and can always grow. Companies most commonly subject to COPPA enforcement includes software developers, mobile app developers, online media, social media platforms, manufacturers with IOT capabilities, websites, educational institutions and more. As the FTC's guide above highlights, the new compliance rule can be broken down into the following privacy controls: parental consent, parental verification, compliant privacy policies, opting procedures and security controls.  

From a cyber insurance standpoint, companies hoping to afford themselves coverage for any resulting proceedings/fines should perform careful reviews of the “regulatory defense” insuring clause – as we had recently discussed here. 3^rd party mobile app and software developers may also be able to locate coverage under their Tech E&O policies. Additionally companies can explore their D&O policies for potential coverage barring any 1) cyber-related exclusions 2) professional-services exclusion or 3) bodily injury exclusions (which generally exclude claims related to “invasion of privacy”).