On May 22, 2023, the Federal Trade Commission (FTC) obtained an order against Edmodo Inc., an educational technology platform for students K through 12, for allegedly violating the federal Children’s Online Privacy Protection Act (COPPA). The FTC alleged that Edmodo collected personal data from children under age of 13 without obtaining verified parental consent and used children’s data for advertising purposes. In its complaint, the FTC further alleged that Edmodo relied on schools and teachers to both notify parents and authorize the use of students’ personal information, thus unlawfully passing its COPPA compliance obligations downstream.

The proposed order prohibits Edmodo from collecting personal information from students beyond what is necessary to participate in its online educational activities and further prohibits the use of children’s personal information for commercial activity such as a profiling and other advertising purposes. The order also includes a $6 million civil penalty. However, the civil penalty has been suspended due to Edmodo’s inability to pay.

Perhaps most notably, the proposed order also requires Edmodo to delete what it defines as “Affected Work Product,” referring to models or algorithms developed using personal information collected unlawfully from students.

This action signals that the FTC is continuing to closely monitoring and track businesses' data privacy practices, particularly those that involve children’s personal information. The proposed order also reiterates that businesses are responsible for its data handling, emphasizing that businesses must obtain verifiable consent from parents or guardians before collecting personal information from children.

In its business blog covering this action, the FTC urged companies to reread the FTC Ed Tech Policy Statement, which was released May 19, 2022. The Ed Tech Policy notes that ed tech companies “cannot stop students from engaging in an ed tech activity if they do not provide information beyond what is reasonably needed to administer the students’ participation.”

Further, the Ed Tech Policy gives a clear warning: “Going forward, the Commission will closely scrutinize the providers of these services and will not hesitate to act where providers fail to meet their legal obligations with respect to children’s privacy.”