1 || BRIAN M. BOYNTON, Principal Deputy Assistant Attorney General ARUN G. RAO, Deputy Assistant Attorney General 2 || AMANDA N. LISKAMM, Director 3 LISA K. HSIAO, Assistant Director JAMES T. NELSON, Senior Trial Attorney 4 || U.S. Department of Justice Fl L E. D Consumer Protection Branch 5 || Civil Division 450 Sth Street N.W. Jun 27 2023 6 Washington, DC 20001 Telephone: (202) 616-2376 Mark B. Busby 7 james.nelson2@usdoj.gov CLERK, U.S. DISTRICT COURT 8 | ISMAIL J. RAMSEY (CABN 189820) NORTHERN DISTRICT OF CALIFORNIA United States Attorney SAN FRANCISCO 9 || MICHELLE LO (NYRN 4325163) 10 Chief, Civil Division

VIVIAN F. WANG (CABN 277577)

1] || Assistant United States Attorney United States Attorney’s Office 12 || Northern District of California 450 Golden Gate Ave. 13 || San Francisco, CA 94102 Telephone: (415) 436-7136 14]) 2. vivian.wang@usdo].gov 15 16 UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

18 19 || UNITED STATES OF AMERICA, Case No. 23-cv-2495 TSH 20 Plaintiff, [PROPOSED] STIPULATED v. ORDER FOR PERMANENT 21 INJUNCTION AND CIVIL EDMODO, LLC, a limited liability PENALTY JUDGMENT corporation. 23 Defendant. 25 26 Plaintiff, the United States of America, acting upon notification and authorization to the Attorney 27 || General by the Federal Trade Commission (“Commission”), filed its Complaint for Permanent 28 PPReEPeEsSED] STIPUT.ATED ORDER

1 Injunction, Civil Penalties, and Other Equitable Relief (“Complaint”) in this matter, pursuant to Sections 2 13(b) and 16(a)(1) of the Federal Trade Commission Act (“FTC Act”), 15 U.S.C. §§ 53(b) and 56(a)(1), 3 Sections 1303(c) and 1306(d) of the Children’s Online Privacy Protection Act (“COPPA”), 15 U.S.C. §§ 4 6502(c) and 6505(d), and the Commission’s Children’s Online Privacy Protection Rule (“COPPA 5 Rule”), 16 C.F.R. Part 312 (attached as Appendix A). Defendant has waived service of the summons 6 and the Complaint. The parties have been represented by the attorneys whose names appear hereafter. 7 Plaintiff and Defendant stipulate to the entry of this Stipulated Order for Permanent Injunction and Civil 8 Penalty Judgment (“Order”) to resolve all matters in dispute in this action between them. 9 THEREFORE, IT IS ORDERED as follows: 10 FINDINGS 11 1. This Court has jurisdiction over this matter. 12 2. The Complaint charges that Defendant violated the COPPA Rule by failing to obtain 13 Verifiable Parental Consent prior to Collecting, using, or Disclosing Personal Information of Children, 14 and retaining Personal Information Collected online from Children for longer than reasonably 15 necessary to fulfill the purpose for which the information was Collected. The Complaint also charges 16 that Defendant violated the FTC Act by unfairly requiring Schools and teachers to comply with the 17 COPPA Rule on its behalf without providing adequate information or support to meet the Rule’s 18 requirements. 19 3. Defendant neither admits nor denies any of the allegations in the Complaint, except as 20 specifically stated in this Order. Only for purposes of this action, Defendant admits the facts necessary 21 to establish jurisdiction. 22 4. Defendant waives any claim that it may have under the Equal Access to Justice Act, 28 23 U.S.C. § 2412, concerning the prosecution of this action through the date of this Order, and agrees to 24 bear its own costs and attorney fees. 25 5. Defendant and Plaintiff waive all rights to appeal or otherwise challenge or contest the 26 validity of this Order. 27 1 DEFINITIONS 2 For the purpose of this Order, the following definitions apply: 3 A. “Affected Work Product” means any models or algorithms developed in whole or in part using 4 Personal Information Collected from Children through the Edmodo Platform without Verifiable Parental 5 Consent or School Authorization. 6 B. “Child” means an individual under the age of 13. 7 C. “Clear and Conspicuous” means that a required disclosure is difficult to miss (i.e., is easily 8 noticeable) and is easily understandable by ordinary consumers, including in all of the following 9 ways: 10 1. In any communication that is solely visual or solely audible, the disclosure must be made 11 through the same means through which the communication is presented. In any 12 communication made through both visual and audible means, such as a television 13 advertisement, the disclosure must be presented simultaneously in both the visual and 14 audible portions of the communication even if the representation requiring the disclosure 15 is made through only one means. 16 2. A visual disclosure, by its size, contrast, location, the length of time it appears, and other 17 characteristics, must stand out from any accompanying text or other visual elements so 18 that it is easily noticed, read, and understood. 19 3. An audible disclosure, including by telephone or streaming video, must be delivered in a 20 volume, speed, and cadence sufficient for ordinary consumers to easily hear and 21 understand it. 22 4. In any communication using an interactive electronic medium, such as the Internet or 23 software, the disclosure must be unavoidable. 24 5. The disclosure must use diction and syntax understandable to ordinary consumers and 25 must appear in each language in which the representation that requires the disclosure 26 appears. 27 1 6. The disclosure must comply with these requirements in each medium through which it is 2 received, including all electronic devices and face-to-face communications. 3 7. The disclosure must not be contradicted or mitigated by, or inconsistent with, anything 4 else in the communication. 5 8. When the representation or sales practice targets a specific audience, such as Children, 6 the elderly, or the terminally ill, “ordinary consumers” includes reasonable members of 7 that group. 8 D. “Collects” or “Collection” means the gathering of any Personal Information from a Child by any 9 means, including but not limited to: 10 1. Requesting, prompting, or encouraging a Child to submit Personal Information online; 11 2. Enabling a Child to make Personal Information publicly available in identifiable form; or 12 3. Passive tracking of a Child online. 13 E. “Defendant” means Edmodo, LLC (“Edmodo”), a Delaware limited liability company, its 14 successors and assigns. 15 F. “Direct Control” means the School has a means to review the Personal Information Collected 16 from a Child, prevent further use or future Collection from that Child, and direct the Operator to delete a 17 Child’s Personal Information. 18 G. “Direct Notice” means making a reasonable effort (taking into consideration available 19 technology) to ensure that a Parent or School receives notice of the Operator’s practices with regard to 20 the Collection, use, or Disclosure of Personal Information Collected from a Child, including notice of 21 any material change in the Collection, use or Disclosure practices to which the Parent or School has 22 previously consented. 23 H. “Disclose” or “Disclosure” means, with respect to Personal Information: 24 1. The Release of Personal Information Collected by an Operator from a Child in 25 identifiable form for any purpose, except where an Operator provides such information to 26 a person who provides Support for the Internal Operations of the Website or Online 27 Service; and 1 2. Making Personal Information Collected by an Operator from a Child publicly available in 2 identifiable form by any means, including but not limited to a public posting through the 3 Internet, or through a personal home page or screen posted on a website or online service; 4 a pen pal service; an electronic mail service; a message board; or a chat room. 5 I. “Edmodo Platform” means any online or mobile education-related website, online service or 6 application or another Website or Online Service Directed to Children, operated, offered, or controlled 7 by Defendant, provided that the Edmodo Platform does not include any such education-related website 8 or online service provided to foreign government customers. 9 J. “Educational Purpose” means any use related to a Child’s education including, but not limited 10 to, instruction in the classroom or at home, administrative activities, and collaboration between students, 11 School personnel, or Parents. Educational Purpose does not include commercial purposes unrelated to 12 the provision of the online service requested by the School such as advertising or building user profiles. 13 K. “Internet” means collectively the myriad of computer and telecommunications facilities, 14 including equipment and operating software, which comprise the interconnected world-wide network of 15 networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or 16 successor protocols to such protocol, to communicate information of all kinds by wire, radio, or other 17 methods of transmission. 18 L. “Online Contact Information” means an e-mail address or any other substantially similar 19 identifier that permits direct contact with a Person online, including but not limited to, an instant 20 messaging user identifier, a voice over internet protocol (VOIP) identifier, or a video chat user identifier. 21 M. “Operator” means any Person who operates a website located on the Internet or an online 22 service and who Collects or maintains Personal Information from or about the users of or visitors to such 23 website or online service, or on whose behalf such information is Collected or maintained, or offers 24 products or services for sale through that website or online service, where such website or online service 25 is operated for commercial purposes involving commerce among the several States or with one or more 26 foreign nations; in any territory of the United States or in the District of Columbia, or between any such 27 territory and another such territory or any State or foreign nation; or between the District of Columbia 1 and any State, territory, or foreign nation. Personal Information is Collected or maintained on behalf of 2 an Operator when: 3 1. It is Collected or maintained by an agent or service provider of the Operator; or 4 2. The Operator benefits by allowing another Person to Collect Personal Information 5 directly from users of such website or online service. 6 N. “Parent” includes a legal guardian. 7 O. “Person” means any individual, partnership, corporation, trust, estate, cooperative, association, 8 or other entity. 9 P. “Personal Information” means individually identifiable information about an individual 10 Collected online, including: 11 1. A first and last name; 12 2. A home or other physical address including street name and name of a city or town; 13 3. Online Contact Information; 14 4. A screen or user name where it functions in the same manner as Online Contact 15 Information; 16 5. A telephone number; 17 6. A Social Security number; 18 7. A persistent identifier that can be used to recognize a user over time and across different 19 websites or online services. Such persistent identifier includes, but is not limited to, a 20 customer number held in a cookie, an Internet Protocol (IP) address, a processor or device 21 serial number, or unique device identifier; 22 8. A photograph, video, or audio file where such file contains a Child’s image or voice; 23 9. Geolocation information sufficient to identify street name and name of a city or town; or 24 10. Information concerning the Child or the Parents of that Child that the Operator Collects 25 online from the Child and combines with an identifier described in this definition. 26 Q. “Release of Personal Information” means the sharing, selling, renting, or transfer of Personal 27 Information to any Third Party. 1 R. “School” means an institutional day or residential school, including a public school, charter 2 school, or private school, that provides elementary or secondary education, as determined by State law. 3 S. “School Authorization” means a School Representative authorizes an Operator to Collect 4 Personal Information from a Child, on the condition that Personal Information is Collected only for an 5 Educational Purpose and follows the School Representative’s receipt of Direct Notice from the 6 Operator. 7 T. “School Representative” means a School employee who has the authority to authorize the 8 Collection of Personal Information from a Child on behalf of the School. 9 U. “Support for the Internal Operations of the Website or Online Service” means 10 1. Those activities necessary to: 11 a. Maintain or analyze the functioning of the website or online service; 12 b. Perform network communications; 13 c. Authenticate users of, or personalize the content on, the website or online service; 14 d. Serve contextual advertising on the website or online service or cap the frequency of 15 advertising; 16 e. Protect the security or integrity of the user, website, or online service; 17 f. Ensure legal or regulatory compliance; or 18 g. Fulfill a request of a Child as permitted by Section 312.5(c)(3) and (4) of the COPPA 19 Rule (attached as Appendix A); 20 2. So long as the information Collected for these activities listed in 1(a)-(g) is not used or 21 Disclosed to contact a specific individual, including through behavioral advertising, to 22 amass a profile on a specific individual, or for any other purpose. 23 V. “Third Party” means any Person who is not: 24 1. An Operator with respect to the Collection or maintenance of Personal Information on the 25 website or online service; or 26 27 1 2. A Person who provides Support for the Internal Operations of the Website or Online 2 Service and who does not use or Disclose information protected under this part for any 3 other purpose. 4 W. “Verifiable Parental Consent” means making a reasonable effort (taking into consideration 5 available technology) to ensure that before Personal Information is Collected from a Child, a Parent of 6 the Child: 7 1. Receives notice of the Operator’s Personal Information Collection, use, and Disclosure 8 practices; and 9 2. Authorizes any Collection, use, and/or Disclosure of the Personal Information, using a 10 method reasonably calculated, in light of available technology, to ensure that the Person 11 providing consent is the Child’s Parent. 12 X. “Website or Online Service Directed to Children” means a commercial website or online 13 service, or portion thereof, that is targeted to Children. 14 1. In determining whether a website or online service, or a portion thereof, is directed to 15 Children, the Commission will consider its subject matter, visual content, use of animated 16 characters or Child-oriented activities and incentives, music or other audio content, age of 17 models, presence of Child celebrities or celebrities who appeal to Children, language or 18 other characteristics of the website or online service, as well as whether advertising 19 promoting or appearing on the website or online service is directed to Children. The 20 Commission will also consider competent and reliable empirical evidence regarding 21 audience composition and evidence regarding the intended audience. 22 2. A website or online service shall be deemed directed to Children when it has actual 23 knowledge that it is Collecting Personal Information directly from users of another 24 Website or Online Service Directed to Children. 25 3. A website or online service that is directed to Children under the criteria set forth in 26 paragraph (1) of this definition, but that does not target Children as its primary audience, 27 shall not be deemed directed to Children if it: 1 a. Does not Collect Personal Information from any visitor prior to Collecting age 2 information; and 3 b. Prevents the Collection, use, or Disclosure of Personal Information from visitors 4 who identify themselves as under age 13 without first complying with the notice 5 and parental consent provisions of 16 C.F.R. Part 312. 6 4. A website or online service shall not be deemed directed to Children solely because it 7 refers or links to a commercial Website or Online Service Directed to Children by using 8 information location tools, including a directory, index, reference, pointer, or hypertext 9 link. 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 1 ORDER 2 I. INJUNCTION CONCERNING COLLECTION OF PERSONAL INFORMATION 3 FROM CHILDREN 4 5 IT IS ORDERED that Defendant and Defendant’s officers, agents, employees, and attorneys, and 6 all other Persons in active concert or participation with any of them, who receive actual notice of this 7 Order, whether acting directly or indirectly, in connection with operating the Edmodo Platform, are 8 hereby permanently restrained and enjoined from: 9 A. Failing to make reasonable efforts, taking into account available technology, to ensure that a 10 Parent of a Child, or a School Representative where any Personal Information Collection is for 11 an Educational Purpose, receives Direct Notice of Defendant’s practices with regard to the 12 Collection, use, or Disclosure of Personal Information from Children, including notice of any 13 material change in the Collection, use, or Disclosure practices to which the Parent or School has 14 previously consented, unless the COPPA Rule provides an exception to providing such notice; 15 B. Failing to post a Clear and Conspicuous link to an online notice of its information practices with 16 regard to Children on the home or landing page or screen of its website or online service, and at 17 each area of the website or online service where Personal Information is Collected from 18 Children, unless the COPPA Rule provides an exception to providing such notice; 19 C. Failing to obtain Verifiable Parental Consent or School Authorization (in accordance with 20 Provision II), before any Collection, use, or Disclosure of Personal Information from Children, 21 including consent to any material change in the Collection, use, or Disclosure practices to which 22 the Parent or School has previously consented, unless the COPPA Rule provides an exception to 23 obtaining Verifiable Parental Consent or School Authorization; 24 D. Conditioning a Child’s participation in an activity on the Child Disclosing more Personal 25 Information than is reasonably necessary to participate in such activity; 26 E. Retaining Personal Information Collected online from a Child for longer than reasonably 27 necessary to fulfill the purpose for which the information was Collected; and 1 F. Violating the COPPA Rule. 2 II. INJUNCTION CONCERNING USING SCHOOLS TO PROVIDE DIRECT NOTICE 3 TO PARENTS OR OBTAIN VERIFIABLE PARENTAL CONSENT 4 5 IT IS FURTHER ORDERED that Defendant and Defendant’s officers, agents, employees and 6 attorneys, and all other persons in active concert or participation with any of them, who receive actual 7 notice of this Order, whether acting directly or indirectly, in connection with providing the Edmodo 8 Platform to Schools are hereby permanently restrained and enjoined from: 9 A. Relying on Schools to act as intermediaries to obtain Verifiable Parental Consent on behalf of 10 Defendant; and 11 B. Relying on School Authorization for the Collection of Personal Information from Children 12 unless they enter into a written agreement with the School or School Representative that: 13 1. Provides that Personal Information can only be used for Educational Purpose(s); 14 2. Describes all Personal Information that is Collected and how it will be used and 15 Disclosed; 16 3. Provides the School a link to its online notice of information practices and recommends 17 the School make it available on the School’s website; 18 4. Requires a School Representative to acknowledge and agree that they have authority to 19 authorize the Collection of Personal Information from Children on behalf of the School, 20 along with their name and title at the School; and 21 5. Provides that any Personal Information Collected by Defendant is under the Direct 22 Control of the School with regard to its use and maintenance. 23 Provided, however, Defendant may Collect Personal Information from Children if Defendant 24 provides Direct Notice to Parents and Parents provide Verifiable Parental Consent. 25

III. DATA MINIMIZATION REQUIREMENT

26 IT IS FURTHER ORDERED that Defendant and Defendant’s officers, agents, employees and 27 attorneys, and all other persons in active concert or participation with any of them, who receive actual 1 notice of this Order, whether acting directly or indirectly, in connection with offering the Edmodo 2 Platform, are hereby permanently restrained and enjoined from Collecting more Personal Information 3 than reasonably necessary for the Child to participate in any activity offered on any such website or 4 online service. 5 IV. INJUNCTION CONCERNING USE OF PREVIOUSLY COLLECTED PERSONAL 6 INFORMATION 7 IT IS FURTHER ORDERED that Defendant, Defendant’s officers, agents, employees, and 8 attorneys, and all other Persons in active concert or participation with any of them, who receive actual 9 notice of this Order, whether acting directly or indirectly, in connection with providing the Edmodo 10 Platform to Schools are ordered to: 11 A. Refrain from Disclosing, using, or benefitting from Personal Information Collected from 12 Children that Defendant collected through the Edmodo Platform prior to entry of this Order 13 unless Verifiable Parental Consent or School Authorization is obtained as outlined in Provisions 14 I and II; 15 B. Within sixty (60) days of entry of this Order, destroy all Personal Information Collected through 16 the Edmodo Platform by Defendant from accounts that have not, by that date, provided 17 Verifiable Parental Consent or School Authorization as described in Provisions I and II; 18 C. Within ninety (90) days of entry of this Order, provide a written statement to the Commission, 19 sworn under penalty of perjury, that (1) describes the process through which Defendant provided 20 Direct Notice and sought Verifiable Parental Consent or School Authorization for the accounts 21 through which Personal Information is Collected through the Edmodo Platform; (2) identifies the 22 total number of accounts for which Direct Notice was provided, as well as the number of 23 accounts that: 24 (i) provided Verifiable Parental Consent; 25 (ii)provided School Authorization; 26 (iii) affirmatively declined to provide Verifiable Parental Consent or School 27 Authorization; 1 (iv)did not respond; 2 (v) Parents or Schools requested be deleted after receiving the Direct Notice provided for 3 under sub-provision IV.B; and 4 (vi) that were the subject of additional questions to Defendant by Parents or Schools; and 5 (3) confirms all Personal Information Collected from Children through the Edmodo Platform 6 related to accounts for which Verifiable Parental Consent or School Authorization was not 7 received has been destroyed; 8 D. Within ninety (90) days of entry of this Order, delete or destroy any Affected Work Product, and 9 provide a written statement to the Commission, sworn under penalty of perjury, confirming such 10 deletion or destruction. Any Affected Work Product, or Personal Information that Defendant is 11 otherwise required to delete or destroy pursuant to this provision may be retained, and may be 12 disclosed, as requested by a government agency or otherwise required by law, regulation, court 13 order, or other legal obligation, including as required by rules applicable to the safeguarding of 14 evidence in pending litigation. In each written statement to the Commission required by this 15 provision, Defendant shall describe in detail any relevant information that Defendant retains on 16 any of these bases and the specific government agency, law, regulation, court order, or other 17 legal obligation that prohibits Defendant from deleting or destroying such information. Within 18 thirty (30) days after the obligation to retain the information has ended, Defendant shall provide 19 an additional written statement to the Commission, sworn under penalty of perjury, confirming 20 that Defendant has deleted or destroyed such information; and 21 E. Maintain and adhere to a retention schedule for Children’s Personal Information Collected 22 through the Edmodo Platform, setting forth the purpose for which the information is Collected, 23 the specific business need for retaining such Personal Information, and a set time frame and set 24 of criteria for deletion of such information which may not exceed one (1) year after the 25 termination of the agreement with the School (unless the School affirmatively requests a 26 different time period), or, with respect to Children’s Personal Information that is not Collected 27 under the Direct Control of a School, may not exceed one (1) year after the generation of the data 1 (unless the Parent, after receiving notice of the impending deletion from Defendant, affirmatively 2 requests that Defendant retain a Child’s data for longer), and make such information about the 3 retention schedule publicly available on Defendant’s website and in the Direct Notice. 4 V. MONETARY JUDGMENT FOR CIVIL PENALTY 5 IT IS FURTHER ORDERED that: 6 A. Judgment in the amount of $6 million ($6,000,000) is entered in favor of Plaintiff against 7 Defendant, as a civil penalty. 8 B. The judgment is suspended subject to the Subsections below. 9 C. The Plaintiff’s agreement to the suspension of the judgment is expressly premised upon the 10 truthfulness, accuracy, and completeness of Defendant’s sworn financial statements and related 11 documents (collectively, “Financial Attestations”) submitted to the Commission, namely: 12 1. the Financial Statement of Corporate Defendant, Edmodo, LLC, signed by General 13 Counsel, Susan Shinoff, and all supporting documents. 14 D. The suspension of the judgment will be lifted as to Defendant if, upon motion by Plaintiff, the 15 Court finds that Defendant failed to disclose any material asset, materially misstated the value of 16 any asset, or made any other material misstatement or omission in the Financial Attestations. 17 E. If the suspension of the judgment is lifted, the judgment becomes immediately due as to 18 Defendant in the amount specified in Subsection A of this Section (which the parties stipulate 19 only for purposes of this Section represents the amount of civil penalty for the violations alleged 20 in the Complaint), less any payment previously made pursuant to this Section, plus interest 21 computed from the date of entry of this Order. 22 VI. ADDITIONAL MONETARY PROVISIONS 23 IT IS FURTHER ORDERED that: 24 A. Defendant relinquishes dominion and all legal and equitable right, title, and interest in all assets 25 transferred pursuant to this Order and may not seek the return of any assets. 26 27 1 B. The facts alleged in the Complaint will be taken as true, without further proof, in any subsequent 2 civil litigation by or on behalf of the Commission, including in a proceeding to enforce its rights 3 to any payment or monetary judgment pursuant to this Order. 4 C. Defendant acknowledges that its Taxpayer Identification Numbers, which Defendant must 5 submit to the Commission, may be used for collecting and reporting on any delinquent amount 6 arising out of this Order, in accordance with 31 U.S.C. § 7701. 7 VII. ORDER ACKNOWLEDGMENTS 8 IT IS FURTHER ORDERED that Defendant obtains acknowledgments of receipt of this Order: 9 A. Defendant, within seven (7) days of entry of this Order, must submit to the Commission an 10 acknowledgment of receipt of this Order sworn under penalty of perjury. 11 B. For five (5) years after entry of this Order, Defendant, for any business that Defendant is the 12 majority owner of, or controls directly or indirectly, must deliver a copy of this Order to: (1) all 13 principals, officers, directors, managers, and members; (2) all employees having managerial 14 responsibilities relating to the subject matter of the Order, and all agents and representatives who 15 participate in conduct related to the subject matter of the Order; and (3) any business entity 16 resulting from any change in structure as set forth in Section VIII (Compliance Reporting). 17 Delivery must occur within seven (7) days of entry of this Order for current personnel and 18 entities. To all others, delivery must occur before they assume their responsibilities. 19 C. From each individual or entity to which Defendant delivered a copy of this Order, Defendant 20 must obtain, within thirty (30) days, a signed and dated acknowledgment of receipt of this Order. 21 VIII. COMPLIANCE REPORTING 22 IT IS FURTHER ORDERED that Defendant makes timely submissions to the Commission: 23 A. One year after entry of this Order, Defendant must submit a compliance report, sworn under 24 penalty of perjury, in which Defendant must: (a) identify the primary physical, postal, email 25 address, and telephone number, as designated points of contact, which representatives of the 26 Commission and Plaintiff may use to communicate with Defendant; (b) identify all businesses 27 owned or controlled by Defendant by all of their names, telephone numbers, and physical, postal, 1 email, and Internet addresses; (c) describe the activities of each business, including the goods 2 and services offered, the means of advertising, marketing, and sales; (d) describe in detail 3 whether and how Defendant is in compliance with each Section of this Order; (e) provide a copy 4 of each different version of any privacy notice posted on each Website or Online Service 5 Directed to Children operated by Defendant or sent to Parents of Children that register on each 6 website or online service; (f) provide a statement setting forth in detail the methods used to 7 obtain Verifiable Parental Consent or School Authorization prior to any Collection, use, and/or 8 Disclosure of Personal Information from Children by the Edmodo Platform; (g) provide a 9 statement setting forth in detail the means provided for Parents to review the Personal 10 Information Collected from their Children and to refuse to permit its further use or maintenance 11 by the Edmodo Platform; and (h) provide a copy of each Order Acknowledgment obtained 12 pursuant to this Order, unless previously submitted to the Commission. 13 B. For ten (10) years after entry of this Order, Defendant must submit a compliance notice, sworn 14 under penalty of perjury, within fourteen (14) days of any change in: (a) any designated point of 15 contact; or (b) the structure of Defendant or any entity that Defendant has any ownership interest 16 in or control directly or indirectly that may affect compliance obligations arising under this 17 Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or 18 affiliate that engages in any acts or practices subject to this Order. 19 C. Defendant must submit to the Commission notice of the filing of any bankruptcy petition, 20 insolvency proceeding, or similar proceeding by or against Defendant within fourteen (14) days 21 of its filing. 22 D. Any submission to the Commission required by this Order to be sworn under penalty of perjury 23 must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: “I declare 24 under penalty of perjury under the laws of the United States of America that the foregoing is true 25 and correct. Executed on: _____” and supplying the date, signatory’s full name, title (if 26 applicable), and signature. 27 1 E. Unless otherwise directed by a Commission representative in writing, all submissions to the 2 Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by overnight 3 courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of 4 Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, 5 DC 20580. The subject line must begin: United States v. Edmodo, LLC. 6 IX. RECORDKEEPING 7 IT IS FURTHER ORDERED that Defendant must create certain records for ten (10) years after 8 entry of the Order, and retain each such record for five (5) years. Specifically, for any business that 9 Defendant is a majority owner of, or controls directly or indirectly, other than those providing products 10 or services solely to foreign government customers, Defendant must create and retain the following 11 records: 12 A. Accounting records showing the revenues from all goods or services sold; 13 B. All personnel records showing, for each person providing services, whether as an employee or 14 otherwise, that person’s: name, addresses, telephone numbers, job title or position, dates of 15 service, and (if applicable) the reason for termination; 16 C. All records necessary to demonstrate full compliance with each provision of this Order, 17 including all submissions to the Commission; 18 D. Copies of all consumer complaints relating to Defendant’s Collection of Personal Information, 19 whether received directly or indirectly, such as through a Third Party, and any response; 20 E. All records demonstrating the steps Defendant has taken to obtain Verifiable Parental Consent or 21 School Authorization, as applicable, for each Child user; and 22 F. A copy of each materially different form, page, or screen created, maintained, or otherwise 23 provided by Defendant through which Defendant Collects Personal Information, and a copy of 24 each materially different document containing any representation regarding Defendant’s 25 Collection, use, and Disclosure practices pertaining to Personal Information. Each webpage 26 copy shall be accompanied by the URL of the webpage where the material was posted online. 27 1 Electronic copies shall include all text and graphics files, audio scripts, and other computer files 2 used in presenting information on the Internet. 3 X. COMPLIANCE MONITORING 4 IT IS FURTHER ORDERED that, for the purpose of monitoring Defendant’s compliance with 5 this Order, including the Financial Attestations upon which the judgment was suspended: 6 A. Within fourteen (14) days of receipt of a written request from a representative of the 7 Commission or Plaintiff, Defendant must: submit additional compliance reports or other 8 requested information, which must be sworn under penalty of perjury; appear for depositions; 9 and produce documents for inspection and copying. The Commission and Plaintiff are also 10 authorized to obtain discovery, without further leave of court, using any of the procedures 11 prescribed by Federal Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 12 34, 36, 45, and 69. 13 B. For matters concerning this Order, the Commission and Plaintiff are authorized to communicate 14 directly with Defendant. Defendant must permit representatives of the Commission and Plaintiff 15 to interview any employee or other Person affiliated with Defendant who has agreed to such an 16 interview. The Person interviewed may have counsel present. 17 C. The Commission and Plaintiff may use all other lawful means, including posing, through its 18 representatives, as consumers, suppliers, or other individuals or entities, to Defendant or any 19 individual or entity affiliated with Defendant, without the necessity of identification or prior 20 notice. Nothing in this Order limits the Commission’s lawful use of compulsory process, 21 pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49 and 57b-1. 22 /// 23 /// 24 /// 25 /// 26 /// 27 /// 1 VII. RETENTION OF JURISDICTION 2 IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for purposes of 3 || construction, modification, and enforcement of this Order. 4 ; ORDERED this 27thay of _ June 2023.

6 7 ‘N | ° 7 UNITED STATES che g MAGISTRATE JUDGE 9 10 1] 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 271! *The parties consented to magistrate judge jurisdiction pursuant to 28 U.S.C. 28 section 636(c). ECF Nos. 4, 10. PPrepesEep! STIPUT. ATED ORDER 19

] > SO STIPULATED AND AGREED: 3 || FOR PLAINTIFF UNITED STATES OF AMERICA

ISMAIL J. RAMSEY

5 United States Attorney Northern District of California ena 7 || VIVIAN F. WANG g Assistant U.S. Attorney United States Attorney’s Office g || for the Northern District of California Tel: (415) 436-7431 10 || Fax: (415) 436-6748 11 || BRIAN M. BOYNTON 12 Principal Deputy Assistant Attorney General Civil Division 13 || U.S. Department of Justice 14 || ARUN G. RAO Deputy Assistant Attorney General Civil Division

AMANDA N. LISKAMM

17 || Director Consumer Protection Branch 18 “an ae BT Ae 29 | JAMES T. NELSON Senior Trial Attorney 21 || Consumer Protection Branch U.S. Department of Justice 22! P.O. Box 386 3 Washington, DC 20044 Tel: (202) 616-2376 24 || Fax: (202) 514-8742 25 26 27 28 20 {PREPESED] STIPULATED ORDER

1 || OF COUNSEL 5 FOR THE FEDERAL TRADE COMMISSION:

; BENJAMIN WISEMAN 4 || Acting Associate Director Division of Privacy and Identity Protection 5

TIFFANY GEORGE

7 Acting Assistant Director Division of Privacy and Identity Protection 8 9 . foane Waker 10 ORANA NESKOVIC 11 || Attorney Division of Privacy and Identity Protection 12 || Federal Trade Commission 600 Pennsylvania Avenue NW 13 || Mail Stop CC-8232 14 || Washington, DC 20580 (202) 326-2322 15 || gneskovic@ftc.gov 16 17 || Fee Magee

PEDER MAGEE

18 || Attorney Division of Privacy and Identity Protection 19 || Federal Trade Commission 20 600 Pennsylvania Avenue NW Mail Stop CC-8232 91 || Washington, DC 20580 (202) 326-3538 22 || pmagee@ftc.gov 23 24 25 26 27 28 21 PPrepesEep! STIPUT. ATED ORDER

| FOR DEFENDANT: 2 3 4 oT ate: STII“ ZB Emily/(S, Tabatabai 5 || Hannah Levin Orrick, Herrington & Sutcliffe LLP 1152 15th Street, NW, Washington, DC 20005 7 Tel: (202) 339-8400 Email: ectabatabai@orrick.com 8 || blevin@orrick.com Counsel for Edmodo LLC 9 10 1]

DEFENDANT:

12 13 i , □□ ul LL.) pe, S/BIZS 15 Vincent P, Riera Chief Executive Officer Edmode LLC 17 18 19 20 21 22 23 24 25 26 27 28 22 [PROPOSED] STIPULATED ORDER

CASE NO.

Appendix A and associates) in 2011 was $403, the accompanied by an adequate periodic reports will be prepared by average partner rate was $482, and the explanation of why estimates for compliance officers, at a labor rate of average associate rate was $303. technical support drawn from BLS $28 per hour.399Applied to an assumed The Commission believes it statistics are not an appropriate basis for industry total of 600 hours per year for reasonable to assume that the workload the FTC’s PRA analysis. Accordingly, this task, associated yearly labor costs among law firm partners and associates the Commission believes it is reasonable would be $16,800. for COPPA compliance questions could to retain the 2012 SNPRM estimate of Cumulatively, labor costs for the be competently addressed and $42 per hour for technical assistance above-noted reporting requirements efficiently distributed among attorneys based on BLS data. total approximately $38,400 per year. at varying levels of seniority, but would Thus, for the 180 new operators per be weighted most heavily to more junior year not previously accounted for under G.Non-Labor/Capital Costs attorneys. Thus, assuming an the FTC’s currently cleared estimates, Because both operators and safe apportionment of two-thirds of such 10,800 cumulative disclosure hours harbor programs will already be work is done by associates, and one- would be composed of 9,000 hours of equipped with the computer equipment third by partners, a weighted average legal assistance and 1,800 hours of and software necessary to comply with tied to the average firm-wide associate technical support. Applied to hourly the Rule’s new notice requirements, the and average firm-wide partner rates, rates of $365 and $42, respectively, final Rule amendments should not respectively, in the National Law associated labor costs for the 180 new impose any additional capital or other Journal 2011 survey would be about operators potentially subject to the non-labor costs.400 $365 per hour. The Commission proposed amendments would be believes that this rate B which is very $3,360,600 (i.e., $3,285,000 for legal List of Subjects in 16 CFR Part 312 near the mean of TIA’s stated range of support plus $75,600 for technical Children, Communications, Consumer purported hourly rates that its members support). protection, Electronic mail, Email, typically pay to engage counsel for Similarly, for the estimated 2,910 Internet, Online service, Privacy, Record COPPA compliance questions B is an existing operators covered by the final retention, Safety, science and appropriate measure to calculate the Rule amendments, 58,200 cumulative technology, Trade practices, Web site, cost of legal assistance for operators to disclosure hours would consist of Youth. comply with the final Rule 48,500 hours of legal assistance and amendments.396 9,700 hours for technical support. ■Accordingly, for the reasons stated TIA also states that the 2012 SNPRM Applied at hourly rates of $365 and $42, above, the Federal Trade Commission estimate of $42 per hour for technical respectively, associated labor costs revises part 312 of Title 16 of the Code support is too low, and that engaging would total $18,109,900 (i.e., of Federal Regulations to read as expert technical personnel can, on $17,702,500 for legal support plus follows: average, involve hourly costs that range $407,400 for technical support). from $72 to $108.397Similar to TIA’s Cumulatively, estimated labor costs for PART 312—CHILDREN’S ONLINE hours estimate, discussed above, the new and existing operators subject to PRIVACY PROTECTION RULE C mo am y m hai vss ei o bn ee b ne l bi ae sv ee ds oth na it m T pIA le’ ms e es nt ti im na gt e t $h 2e 1 ,f 4in 7a 0l , 5R 0u 0l .e amendments is S 31ec 2. . 1 Scope of regulations in this part. r Ce oq mui mre im sse ion nts h t ah sa t d, eu telt ri mm ia nte el dy n, t oh te t o (2)Reporting 3 31 12 2. .2 3 D Ree gfi un li at ti io on ns . o f unfair or deceptive acts adopt. For example, technical personnel The Commission staff assumes that or practices in connection with the will not need to ‘‘ensure’’ the security the tasks to prepare augmented safe collection, use, and/or disclosure of procedures of third parties; operators harbor program applications occasioned personal information from and about that have been eligible to use email plus by the final Rule amendments will be children on the Internet. f r ro e er q p u lp aia crr e ee d n i tt t .a o Il ti c m iso pn uls nee m cn lt ees an rw t wnil e hl w en t o hst y e b s rt e Te m IAs ’ sto p m Te her uafo n s,r lm aa pbe pod lr ip err a di t m e to a o r afi nl $y 1 a 8b ss0y u al ma nw e h dy o e iur ns r d., 3 ua 9 st 8 t a r y 3 3 31 1 12 2 2. . .4 5 6 infoN P R ra i mo grt e h aic n tt i e t o oa. f nl p c pao rrn oes vne it dn t et o. d r e bv yi e aw ch p ie ldrs . onal estimate for technical support is based total of 120 hours per year for this task, 312.7 Prohibition against conditioning a on the types of disclosure-related tasks incremental associated yearly labor child’s participation on collection of that the final Rule amendments would costs would total $21,600. personal information. actually require, other tasks that the final Rule amendments would not 398Based on Commission staff’s experience with 399See Bureau of Labor Statistics National require, or non-disclosure tasks not previously approved safe harbor programs, staff Compensation Survey: Occupational Earnings in covered by the PRA. Moreover, unlike anticipates that most of the legal tasks associated the United States, 2010, at Table 3, available at its estimate for lawyer assistance, TIA’s w hoit uh s es a cf oe u h na sr eb lo . r C p f.r Tog or ya m Ins d w usi tl rl y b Ae sp se or cfo iar tm ioe nd by in- h rat tt ep : h// aw s w now t. b bl es e.g no cv o/n nc tes s/ to ec ds ./ sp/nctb1477.pdf. This (comment 89, 2012 SNPRM), at 19 (regional BLS 400NCTA commented that the Commission failed 396Cf. Civil Division of the United States statistics for lawyer wages can support estimates of to consider costs ‘‘related to redeveloping child- Attorney’s Office for the District of Columbia, the level of in-house legal support likely to be directed Web sites’’ that operators would be United States Attorney’s Office, District of required on an ongoing basis). Moreover, no ‘‘forced’’ to incur as a result of the proposed Rule Columbia, Laffey Matrix B 2003-2013, available at comments were received in response to the amendments, including for ‘‘new equipment and http://www.justice.gov/usao/dc/divisions/ February 9, 2011 and May 31, 2011 Federal software required by the expanded regulatory Laffey_Matrix_2003-2013.pdf (updated ‘‘Laffey Register notices (76 FR at 7211 and 76 FR at 31334, regime.’’ NCTA (comment 113, 2011 NPRM), at 23. Matrix’’ for calculating ‘‘reasonable’’ attorneys fees respectively, available at http://www.gpo.gov/fdsys/ Similarly, TIA commented that the proposed Rule in suits in which fee shifting is authorized can be pkg/FR-2011-02-09/pdf/2011-2904.pdf and http:// amendments would entail ‘‘increased monetary evidence of prevailing market rates for litigation www.gpo.gov/fdsys/pkg/FR-2011-05-31/pdf/2011- costs with respect to technology acquisition and counsel in the Washington, DC area; rates in table 13357.pdf), which assumed a labor rate of $150 per implementation * * *.’’ Toy Industry Association range from $245 per hour for most junior associates hour for lawyers or similar professionals to prepare (comment 163, 2011 NPRM), at 17. These to $505 per hour for most senior partners). and submit a new safe harbor application. Nor was comments, however, do not specify projected costs integrity of personal information that term is defined in Section 551(1) of Person means any individual, collected from children. title 5, United States Code. partnership, corporation, trust, estate, 312.9 Enforcement. Internet means collectively the cooperative, association, or other entity. 312.10 Data retention and deletion myriad of computer and Personal information means 3 31 12 2. .1 1re 1 2qui S Vr ae ofm le u e h nn a tat rs rb. y o r C p or mo mgr ia sm sis o. n Approval t ee ql uec ipo mm em nu t n anic da t oio pn ers a f ta inci gl i st oie fs tw, i an rc el ,u ding i an bd oi uv ti d anu a il nl dy ii vd ie dn ut ai lf i ca ob ll le e cin tefo dr om na lt ii no en , Processes. which comprise the interconnected including: 312.13 Severability. world-wide network of networks that (1)A first and last name; employ the Transmission Control (2)A home or other physical address Authority: 15 U.S.C. 6501–6508. Protocol/Internet Protocol, or any including street name and name of a §312.1 Scope of regulations in this part. predecessor or successor protocols to city or town; This part implements the Children’s such protocol, to communicate (3)Online contact information as Online Privacy Protection Act of 1998, information of all kinds by wire, radio, defined in this section; (15 U.S.C. 6501, et seq.,) which or other methods of transmission. (4)A screen or user name where it prohibits unfair or deceptive acts or Obtaining verifiable consent means functions in the same manner as online practices in connection with the making any reasonable effort (taking contact information, as defined in this collection, use, and/or disclosure of into consideration available technology) section; personal information from and about to ensure that before personal (5)A telephone number; children on the Internet. information is collected from a child, a (6)A Social Security number; parent of the child: (7)A persistent identifier that can be §312.2 Definitions. (1)Receives notice of the operator’s used to recognize a user over time and Child means an individual under the personal information collection, use, across different Web sites or online age of 13. and disclosure practices; and services. Such persistent identifier Collects or collection means the (2)Authorizes any collection, use, includes, but is not limited to, a gathering of any personal information and/or disclosure of the personal customer number held in a cookie, an from a child by any means, including information. Internet Protocol (IP) address, a but not limited to: Online contact information means an processor or device serial number, or (1)Requesting, prompting, or email address or any other substantially unique device identifier; encouraging a child to submit personal similar identifier that permits direct (8)A photograph, video, or audio file information online; contact with a person online, including where such file contains a child’s image (2)Enabling a child to make personal but not limited to, an instant messaging or voice; information publicly available in user identifier, a voice over internet (9)Geolocation information sufficient identifiable form. An operator shall not protocol (VOIP) identifier, or a video to identify street name and name of a be considered to have collected personal chat user identifier. city or town; or information under this paragraph if it Operator means any person who (10)Information concerning the child takes reasonable measures to delete all operates a Web site located on the or the parents of that child that the or virtually all personal information Internet or an online service and who operator collects online from the child from a child’s postings before they are collects or maintains personal and combines with an identifier made public and also to delete such information from or about the users of described in this definition. information from its records; or or visitors to such Web site or online Release of personal information (3)Passive tracking of a child online. service, or on whose behalf such means the sharing, selling, renting, or Commission means the Federal Trade information is collected or maintained, transfer of personal information to any Commission. or offers products or services for sale third party. Delete means to remove personal through that Web site or online service, Support for the internal operations of information such that it is not where such Web site or online service the Web site or online service means: maintained in retrievable form and is operated for commercial purposes (1)Those activities necessary to: cannot be retrieved in the normal course involving commerce among the several (i)Maintain or analyze the of business. States or with 1 or more foreign nations; functioning of the Web site or online Disclose or disclosure means, with in any territory of the United States or service; respect to personal information: in the District of Columbia, or between (ii)Perform network communications; (1)The release of personal any such territory and another such (iii)Authenticate users of, or information collected by an operator territory or any State or foreign nation; personalize the content on, the Web site from a child in identifiable form for any or between the District of Columbia and or online service; purpose, except where an operator any State, territory, or foreign nation. (iv)Serve contextual advertising on provides such information to a person This definition does not include any the Web site or online service or cap the who provides support for the internal nonprofit entity that would otherwise be frequency of advertising; operations of the Web site or online exempt from coverage under Section 5 (v)Protect the security or integrity of service; and of the Federal Trade Commission Act the user, Web site, or online service; (2)Making personal information (15 U.S.C. 45). Personal information is (vi)Ensure legal or regulatory collected by an operator from a child collected or maintained on behalf of an compliance; or publicly available in identifiable form operator when: (vii)Fulfill a request of a child as by any means, including but not limited (1)It is collected or maintained by an permitted by §312.5(c)(3) and (4); to a public posting through the Internet, agent or service provider of the operator; (2)So long as The information or through a personal home page or or collected for the activities listed in screen posted on a Web site or online (2)The operator benefits by allowing paragraphs (1)(i)–(vii) of this definition service; a pen pal service; an electronic another person to collect personal is not used or disclosed to contact a any other purpose. acts or practices in connection with the to the Collection, Use, or Disclosure of noT t:h ird party means any person who is c p co hel r il lse doc rn eti nao l n o i, n n u f tos hre em, Ia a nn t ti ed o r/ no n r efr td o .i msc alo ns du are b oo uf t a d iC r (e ih )ci Ttl d n h’ o as t tP i tce her e s s o ohn paa elll r asI tn e otf ro f or hm r at sha t c: i oo ln le). c T teh di s t he (1)An operator with respect to the General requirements. It shall be parent’s online contact information from collection or maintenance of personal unlawful for any operator of a Web site the child, and, if such is the case, the information on the Web site or online or online service directed to children, or name of the child or the parent, in order service; or any operator that has actual knowledge to obtain the parent’s consent; (2)A person who provides support for that it is collecting or maintaining (ii)That the parent’s consent is the internal operations of the Web site personal information from a child, to required for the collection, use, or or online service and who does not use collect personal information from a disclosure of such information, and that or disclose information protected under child in a manner that violates the the operator will not collect, use, or this part for any other purpose. regulations prescribed under this part. disclose any personal information from c o ish r W ti o ald n re gr lb ie e nn ts eei t dm e s e teo orar v n cio s hcn e ial l,i d cn o roe r e m p nse o .m r rv e tii r oc ce nia d tl h i Wr ee rec ebt oe fsd ,i ttt heo a t G m o cone u ( lln a ls i ee ) nt c:r P e a t r ssl o l e fy v rr, ovi du micen e cd n o he o f ir t l i w dt ch re hi e s ao n tnp , i a hntr h oft oe, w r a W m n it e a o ub tp i s os ee ni sr ta e sit t uo o cr r h t s i ch nu oe f(c loi l h ic eri h m c)c ti To al fd n h t ri o s e oi e mf na nt d h t t t; hd he ei e p t i o ca o hpr ne iea ln r dl at , i t d t o oeo r rm e i tns hs t en o e o f n p t p d o p te s e r r t no s oov t ini ad a le l (1)In determining whether a Web site information, and its disclosure practices opportunities for the disclosure of or online service, or a portion thereof, for such information (§312.4(b)); personal information, should the parent is directed to children, the Commission (b)Obtain verifiable parental consent provide consent; will consider its subject matter, visual prior to any collection, use, and/or (iv)A hyperlink to the operator’s content, use of animated characters or disclosure of personal information from online notice of its information c m m c l W wah e n hu o l ei el g eds bd bi u te c hs- r alo i i eso g ttr , rei er i ep e a oo s orn d rt e rwt h v s oe o ee hed nt rr n ho l t a a ic i e na sc u e r ipt e d ni co pv si ghfo ei e act pa ri c rh vl re ao oi is t cl cn o m d ta et ec n e , oc r hnd ai te s ii st l nl t,i e d in w ga b crc g sr e oee e i ln rotn l io , fet a fi ts s v h oe es r , c p i t mn oh a af( (i r roc dil e e nd ) r )n fm tur P Nt ee sr a ntn oo eo t a t iv ( t o nr c§ oi e nd c o 3 v p e e nc1 i e de (oa2 r §w il m. r tl5 3e ie ) t i o1a c; h t n2 s t ie eo . t 6 a d sn p ) ca ;fe f u hrb r os r il to le m h d nm e ’a a srle c ua hn si es l d ofo ra r n a d p o c c ina ofr fa ( n lt ov lhc e rp)t i c mi s T rc t o i as he ove ts e n iic odr m ,te ni e uoq e ;v s nu a aee; ni n, rr s die a fd n b ia y du b wn dled ih sce i cor c l nh op ss a t uehr n ra e eg t pr t oa oa fp r t teh h hn e e( t d ) appearing on the Web site or online participation in a game, the offering of (vi)That if the parent does not service is directed to children. The a prize, or another activity on the child provide consent within a reasonable Commission will also consider disclosing more personal information time from the date the direct notice was competent and reliable empirical than is reasonably necessary to sent, the operator will delete the evidence regarding audience participate in such activity (§312.7); parent’s online contact information from composition, and evidence regarding and its records. the intended audience. (e)Establish and maintain reasonable (2)Content of the direct notice to the b h coe a( lsd2 l ea) e cceA ttm iu nW ae gld e pk b d en is ror si e wt oe c nl to ee adr d l go i t nen o fl t oci hn rh a me i tl as id t te r ir ie osv n n i c w de i h rs e eh n ca t l lil yt

p c p co hr eo n r ilsc f doie d rnd ee au nn lr t (e ii §ns a f 3lt oio 1t ry 2mp , . r 8s ao )e t .t ic e ouc nrt i ct th oye l, l a en cd te din ft re og mrit y of p N A U Ina co s fr et ote ii rvc on mie rt t i aDtu eo tn s i i s o Pd N c nae lo )orr .te s § Wn uIn3 t r h v e1 o eo 2 f o rl . fa ev5 i P( aC nc e ng) h r( si2 otl oh) pd ne( e’sV a rC alOo o tl on lu l rl en i cnta te ir o y n , from users of another Web site or online §312.4 Notice. chooses to notify a parent of a child’s service directed to children. (a)General principles of notice. It participation in a Web site or online (3)A Web site or online service that shall be the obligation of the operator to service, and where such site or service is directed to children under the criteria provide notice and obtain verifiable does not collect any personal set forth in paragraph (1) of this parental consent prior to collecting, information other than the parent’s definition, but that does not target using, or disclosing personal online contact information, the direct children as its primary audience, shall information from children. Such notice notice shall set forth: not be deemed directed to children if it: must be clearly and understandably (i)That the operator has collected the (i)Does not collect personal written, complete, and must contain no parent’s online contact information from information from any visitor prior to unrelated, confusing, or contradictory the child in order to provide notice to, collecting age information; and materials. and subsequently update the parent (b)Direct notice to the parent. An about, a child’s participation in a Web (ii)Prevents the collection, use, or operator must make reasonable efforts, site or online service that does not disclosure of personal information from taking into account available otherwise collect, use, or disclose visitors who identify themselves as technology, to ensure that a parent of a children’s personal information; under age 13 without first complying child receives direct notice of the (ii)That the parent’s online contact with the notice and parental consent operator’s practices with regard to the information will not be used or provisions of this part. collection, use, or disclosure of personal disclosed for any other purpose; (4)A Web site or online service shall information from children, including (iii)That the parent may refuse to not be deemed directed to children notice of any material change in the permit the child’s participation in the solely because it refers or links to a collection, use, or disclosure practices Web site or online service and may commercial Web site or online service to which the parent has previously require the deletion of the parent’s directed to children by using consented. online contact information, and how the information location tools, including a (c)Content of the direct notice to the parent can do so; and of this section. from children. The link must be in close ensure that the person providing (3)Content of the direct notice to the proximity to the requests for consent is the child’s parent. (2) parent under §312.5(c)(4) (Notice to a information in each such area. An Existing methods to obtain verifiable Parent of Operator’s Intent to operator of a general audience Web site parental consent that satisfy the Communicate with the Child Multiple or online service that has a separate requirements of this paragraph include: Times). This direct notice shall set forth: children’s area must post a link to a (i)Providing a consent form to be (i)That the operator has collected the notice of its information practices with signed by the parent and returned to the child’s online contact information from regard to children on the home or operator by postal mail, facsimile, or the child in order to provide multiple landing page or screen of the children’s electronic scan; online communications to the child; area. To be complete, the online notice (ii)Requiring a parent, in connection (ii)That the operator has collected the of the Web site or online service’s with a monetary transaction, to use a parent’s online contact information from information practices must state the credit card, debit card, or other online the child in order to notify the parent following: payment system that provides that the child has registered to receive (1)The name, address, telephone notification of each discrete transaction multiple online communications from number, and email address of all to the primary account holder; the operator; operators collecting or maintaining (iii)Having a parent call a toll-free (iii)That the online contact personal information from children telephone number staffed by trained information collected from the child through the Web site or online service. personnel; will not be used for any other purpose, Provided that: The operators of a Web (iv)Having a parent connect to disclosed, or combined with any other site or online service may list the name, trained personnel via video-conference; information collected from the child; address, phone number, and email (v)Verifying a parent’s identity by (iv)That the parent may refuse to address of one operator who will checking a form of government-issued permit further contact with the child respond to all inquiries from parents identification against databases of such and require the deletion of the parent’s concerning the operators’ privacy information, where the parent’s and child’s online contact information, policies and use of children’s identification is deleted by the operator and how the parent can do so; information, as long as the names of all from its records promptly after such (v)That if the parent fails to respond the operators collecting or maintaining verification is complete; or to this direct notice, the operator may personal information from children (vi)Provided that, an operator that use the online contact information through the Web site or online service does not ‘‘disclose’’ (as defined by collected from the child for the purpose are also listed in the notice; §312.2) children’s personal information, stated in the direct notice; and (2)A description of what information may use an email coupled with (vi)A hyperlink to the operator’s the operator collects from children, additional steps to provide assurances online notice of its information including whether the Web site or that the person providing the consent is practices required under paragraph (d) online service enables a child to make the parent. Such additional steps of this section. personal information publicly available; include: Sending a confirmatory email (4)Content of the direct notice to the how the operator uses such information; to the parent following receipt of parent required under §312.5(c)(5) and, the operator’s disclosure practices consent, or obtaining a postal address or (Notice to a Parent In Order to Protect for such information; and telephone number from the parent and a Child’s Safety). This direct notice shall (3)That the parent can review or have confirming the parent’s consent by letter set forth: deleted the child’s personal or telephone call. An operator that uses (i)That the operator has collected the information, and refuse to permit this method must provide notice that name and the online contact further collection or use of the child’s the parent can revoke any consent given information of the child and the parent information, and state the procedures in response to the earlier email. in order to protect the safety of a child; for doing so. (3)Safe harbor approval of parental (ii)That the information will not be consent methods. A safe harbor program used or disclosed for any purpose §312.5 Parental consent. approved by the Commission under unrelated to the child’s safety; (a)General requirements. (1) An §312.11 may approve its member (iii)That the parent may refuse to operator is required to obtain verifiable operators’ use of a parental consent permit the use, and require the deletion, parental consent before any collection, method not currently enumerated in of the information collected, and how use, or disclosure of personal paragraph (b)(2) of this section where the parent can do so; information from children, including the safe harbor program determines that (iv)That if the parent fails to respond consent to any material change in the such parental consent method meets the to this direct notice, the operator may collection, use, or disclosure practices requirements of paragraph (b)(1) of this use the information for the purpose to which the parent has previously section. stated in the direct notice; and consented. (c)Exceptions to prior parental (v)A hyperlink to the operator’s (2)An operator must give the parent consent. Verifiable parental consent is online notice of its information the option to consent to the collection required prior to any collection, use, or practices required under paragraph (d) and use of the child’s personal disclosure of personal information from of this section. information without consenting to a child except as set forth in this (d)Notice on the Web site or online disclosure of his or her personal paragraph: service. In addition to the direct notice information to third parties. (1)Where the sole purpose of to the parent, an operator must post a (b)Methods for verifiable parental collecting the name or online contact prominent and clearly labeled link to an consent. (1) An operator must make information of the parent or child is to online notice of its information reasonable efforts to obtain verifiable provide notice and obtain parental practices with regard to children on the parental consent, taking into consent under §312.4(c)(1). If the home or landing page or screen of its consideration available technology. Any operator has not obtained parental from its records; persistent identifier and no other child’s participation on collection of (2)Where the purpose of collecting a personal information and such identifier personal information. parent’s online contact information is to is used for the sole purpose of providing An operator is prohibited from provide voluntary notice to, and support for the internal operations of conditioning a child’s participation in a subsequently update the parent about, the Web site or online service. In such game, the offering of a prize, or another the child’s participation in a Web site or case, there also shall be no obligation to activity on the child’s disclosing more online service that does not otherwise provide notice under §312.4; or personal information than is reasonably collect, use, or disclose children’s (8)Where an operator covered under necessary to participate in such activity. p pe ar rs eo nn t’a sl o i nn lf io nr em ca oti no tn ac. tI n in s fu oc rh m c aa tis oe ns , m th ae y p sia tera og rr a op nh li n(2 e) so ef r t vh ice e d de if ri en cit ti eo dn t oo f Web § in3 te1 g2. r8 ity oC fo pn efi rd se on nt aia l l ii nty fo, rs mec au tir oit ny , c a on lld ected not be used or disclosed for any other children in §312.2 collects a persistent from children. purpose. In such cases, the operator identifier and no other personal The operator must establish and must make reasonable efforts, taking information from a user who maintain reasonable procedures to into consideration available technology, affirmatively interacts with the operator protect the confidentiality, security, and to ensure that the parent receives notice and whose previous registration with integrity of personal information a c f ors o no ( l ed m3 l -ee ) t cs iaW mtc i cr nh ei hb g e i b e r lo aded n s t iii lh ssn i n e tt§ o e os 3 o c ar1 el o se s2 n p p. p t4 ea ou c( c nc r it d fp) i( i o c2 n d s) f ri; e o r e er qo m c uf t ea ly sti to o fn n ro a m

t n b §h eo 3a t 1nt a 2oo . cp 4ohe .bir lla id gt .o a Ir tn i i o n s nd u ti c oc h a p t ce ra os s vet ih , d a t eht e ns ru oec t ih a cl esu os u e s nr h d i a es l rl c m r oeo nu ll lel s ye at c s ta oet le s c sd o eh rf itr vlao d ik cm re ee nrc pe ’h rsa oi s pl vod e inr dre a s en ob r. nl s eT a a lsh n t ie e dn po f tosp h re t imo rr da a t to ir o n the child, and where such information §312.6 Right of parent to review personal parties who are capable of maintaining is not used to re-contact the child or for information provided by a child. the confidentiality, security and a i r cs en h cdy io le do rl d ’et sh st e r e p edr qr p ob uu my e r st pp th ;to e ls y oe a, p fi e ts er a rn to ro et r s d pfri oos nc ml do iis nte s gd t, oa n thd e c t ooh p ( i a ea l rd) W a U th oep a b rso o sn p fi trr teo he v oq ai ru td We oes ndt el bio p n f e s ea r i ts s ep o e a n r ovr a re i l ocn i e nt n , lw f ito nhh r eemo s ae tion i p m mn r a at oe i nv ng nir td ei at e riy n . a o s thf s us eu r iac nnh fc o i e rn msf o t ahr tm a iot a ntt h i io e nyn s , w u a cin l hld a w ho (4)Where the purpose of collecting a service is required to provide to that §312.9 Enforcement. child’s and a parent’s online contact parent the following: Subject to sections 6503 and 6505 of information is to respond directly more (1)A description of the specific types the Children’s Online Privacy Protection than once to the child’s specific request, or categories of personal information Act of 1998, a violation of a regulation and where such information is not used collected from children by the operator, prescribed under section 6502 (a) of this for any other purpose, disclosed, or such as name, address, telephone Act shall be treated as a violation of a combined with any other information number, email address, hobbies, and rule defining an unfair or deceptive act collected from the child. In such cases, extracurricular activities; or practice prescribed under section the operator must make reasonable (2)The opportunity at any time to 18(a)(1)(B) of the Federal Trade efforts, taking into consideration refuse to permit the operator’s further Commission Act (15 U.S.C. available technology, to ensure that the use or future online collection of 57a(a)(1)(B)). parent receives notice as described in personal information from that child, §312.4(c)(3). An operator will not be and to direct the operator to delete the §312.10 Data retention and deletion deemed to have made reasonable efforts child’s personal information; and requirements. to ensure that a parent receives notice (3)Notwithstanding any other An operator of a Web site or online where the notice to the parent was provision of law, a means of reviewing service shall retain personal information unable to be delivered; any personal information collected from collected online from a child for only as (5)Where the purpose of collecting a the child. The means employed by the long as is reasonably necessary to fulfill child’s and a parent’s name and online operator to carry out this provision the purpose for which the information contact information, is to protect the must: was collected. The operator must delete safety of a child, and where such (i)Ensure that the requestor is a such information using reasonable information is not used or disclosed for parent of that child, taking into account measures to protect against any purpose unrelated to the child’s available technology; and unauthorized access to, or use of, the safety. In such cases, the operator must information in connection with its make reasonable efforts, taking into (ii)Not be unduly burdensome to the deletion. consideration available technology, to parent. provide a parent with notice as (b)Neither an operator nor the §312.11 Safe harbor programs. described in §312.4(c)(4); operator’s agent shall be held liable (a)In general. Industry groups or (6)Where the purpose of collecting a under any Federal or State law for any other persons may apply to the child’s name and online contact disclosure made in good faith and Commission for approval of self- information is to: following reasonable procedures in regulatory program guidelines (‘‘safe (i)Protect the security or integrity of responding to a request for disclosure of harbor programs’’). The application its Web site or online service; personal information under this section. shall be filed with the Commission’s (ii)Take precautions against liability; (c)Subject to the limitations set forth Office of the Secretary. The Commission (iii)Respond to judicial process; or in §312.7, an operator may terminate will publish in the Federal Register a (iv)To the extent permitted under any service provided to a child whose document seeking public comment on other provisions of law, to provide parent has refused, under paragraph the application. The Commission shall information to law enforcement (a)(2) of this section, to permit the issue a written determination within agencies or for an investigation on a operator’s further use or collection of 180 days of the filing of the application. matter related to public safety; and personal information from his or her (b)Criteria for approval of self- performance standards: provide effective enforcement of the subject operator for violations of this (1)Program requirements that ensure requirements of this part. part, the Commission will take into operators subject to the self-regulatory (d)Reporting and recordkeeping account the history of the subject program guidelines (‘‘subject requirements. Approved safe harbor operator’s participation in the safe operators’’) provide substantially the programs shall: harbor program, whether the subject same or greater protections for children (1)By July 1, 2014, and annually operator has taken action to remedy as those contained in §§312.2 through thereafter, submit a report to the such non-compliance, and whether the 312.8, and 312.10. Commission containing, at a minimum, operator’s non-compliance resulted in me(2 c) hA ann i se mff e fc ot ri v the, e m ina dn ed pa et no dry ent a thn e a ig ng dr ee pga et ne dd e s nu tm asm sea sr sy m o ef nth tse cr oe nsu dl uts c to ef d any one of the disciplinary actions set assessment of subject operators’ under paragraph (b)(2) of this section, a forth in paragraph (b)(3). compliance with the self-regulatory description of any disciplinary action §312.12 Voluntary Commission Approval program guidelines. At a minimum, this taken against any subject operator under Processes. mechanism must include a paragraph (b)(3) of this section, and a comprehensive review by the safe description of any approvals of member (a)Parental consent methods. An harbor program, to be conducted not operators’ use of a parental consent interested party may file a written less than annually, of each subject mechanism, pursuant to §312.5(b)(4); request for Commission approval of operator’s information policies, (2)Promptly respond to Commission parental consent methods not currently practices, and representations. The requests for additional information; and enumerated in §312.5(b). To be assessment mechanism required under (3)Maintain for a period not less than considered for approval, a party must this paragraph can be provided by an three years, and upon request make provide a detailed description of the independent enforcement program, such available to the Commission for proposed parental consent methods, as a seal program. inspection and copying: together with an analysis of how the (3)Disciplinary actions for subject (i)Consumer complaints alleging methods meet §312.5(b)(1). The request operators’ non-compliance with self- violations of the guidelines by subject shall be filed with the Commission’s regulatory program guidelines. This operators; Office of the Secretary. The Commission p b a t rh ecye ge( tr : i i u f ) o io lnnM ar dm tt oa uaa n rsk yn d te r c a gn ye t u o gas ir rg dt y oa a e, un i l np ipd nsu a t eibr s ssd sl ;ui u cm b i njra ee gy cp t tob hore ept is e sna ergt a li fts o -of fi r e a sd n b y y t a c (a bs ok )s( ( m (i i ee 2i i sn p) i )) s lR oa m iR ae fg e e nc a ts n ho i cun t ir es sld s t rt s os s es ef qoo u cs uff tb u iitd j orh bei e njes c e dc .t ci i no utp p d noli e e dpn r p eea a e rrr t anoy ptdr o aa s e rrc ; an s t a ’ gi t no radn p s h w d t a oh fo wi e tl c hl ru r ip eem t q tu feue ib n ln e il ni st ds t gs eh . e t oT eei fn h rk m t ei ht n h iC eg ne o r apF em tu qie omb ud nl ee ii s sr c ws ta ;c i il o to a R hn nm ie dnsmg h i 1es a 2t n le l 0t r i o dsa sn a u y e s (ii)Consumer redress; (e)Post-approval modifications to (b)Support for internal operations of (iii)Voluntary payments to the United self-regulatory program guidelines. the Web site or online service. An States Treasury in connection with an Approved safe harbor programs must interested party may file a written industry-directed program for violators submit proposed changes to their request for Commission approval of of the self-regulatory guidelines; guidelines for review and approval by additional activities to be included (iv)Referral to the Commission of the Commission in the manner required within the definition of support for operators who engage in a pattern or for initial approval of guidelines under internal operations. To be considered practice of violating the self-regulatory paragraph (c)(2) of this section. The for approval, a party must provide a guidelines; or statement required under paragraph detailed justification why such activities o p fof r r( ( os v c ape)) pl ofRA ps-re en req ody gu v u so e aalt s la fh t e st e of h hor r a ar ye l r lCq p b bu o r o eoa m r l g al pm r cy a r c oi me s ogf s mf ri ge ao puc mnt aii d ’ nav se ipe erl p i ea dn qrc eo but si v yeo .a sn Al t. ( t p rc h er) ge o (( f u 4 v )p l) i R ar so o ti e of op v rnt o o yh ss c i e pas od rtfs i o oe c t ghc h n ret a ai o no mg fn ug a e i gm pds u pea iu dl rfs i of ent e v l ecd ia nste l . e es o sc x f .r i i s s Tb t e hie ln f e -h g ow s o p ph p o rio e t veu r anal cd t ti yi o ab . lne T es hd , f f ee a e e n rcm ed ts q e a uod n en ss a c tu n h sp a hip l ly ado ls rr li et s b nf eoo ’ sfr f it oi lhn enet dle i i r nr w n e ia tl h the following: Commission reserves the right to revoke the Commission’s Office of the (1)A detailed explanation of the any approval granted under this section Secretary. The Commission will publish applicant’s business model, and the if at any time it determines that the in the Federal Register a document technological capabilities and approved self-regulatory program seeking public comment on the request. mechanisms that will be used for initial guidelines or their implementation do The Commission shall issue a written and continuing assessment of subject not meet the requirements of this part. determination within 120 days of the operators’ fitness for membership in the Safe harbor programs that were filing of the request. safe harbor program; approved prior to the publication of the (2)A copy of the full text of the Final Rule amendments must, by March §312.13 Severability. guidelines for which approval is sought 1, 2013, submit proposed modifications The provisions of this part are and any accompanying commentary; to their guidelines that would bring separate and severable from one (3)A comparison of each provision of them into compliance with such another. If any provision is stayed or §§312.2 through 312.8, and 312.10 with amendments, or their approval shall be determined to be invalid, it is the the corresponding provisions of the revoked. Commission’s intention that the guidelines; and (g)Operators’ participation in a safe remaining provisions shall continue in ( (4 i)) HA o s wta tt hem e se en lt f -e rex gp ula lain toin ryg : program h da eerb mo er d p tr oo g br ea m in. cA on m o pp lie ar na cto er w w iti hll tb he e effect. guidelines, including the applicable requirements of §§312.2 through 312.8, assessment mechanisms, meet the and 312.10 if that operator complies requirements of this part; and with Commission-approved safe harbor Commissioner Rosch abstaining, and unlawful for an operator of a Web site or advertising revenue). I find that this Commissioner Ohlhausen dissenting. online service directed to children, or any proviso—which would extend COPPA Donald S. Clark, operator that has actual knowledge that it is obligations to entities that do not collect Secretary. collecting personal information from a child, personal information from children or have to collect personal information from a child access to or control of such information Dissenting Statement of Commissioner in a manner that violates the regulations collected by a third-party does not comport Maureen K. Ohlhausen prescribed [by the FTC].’’403 with the plain meaning of the statutory t A po rc I ot t h vv (e io C s t C O ie ohd P ni P a l od Ag fra )e ti hn Rn es ’ us t al ea O m d bn eo el np i cn dt ai e mun sPg eer nt i Ih tv sbe a e eca l xym i c eP ee vr en eo d d t a sem cc thoe tin r eo e t n s a t d th hm ie r eT ee mh c cn ue t sd e e rS m dr le vt a e Wn et n ste e t Cm cs b o O (e s lSn P liB ett P e c Po sA t) f o c d RB hri ua iss ls l ec dei rus r vm s ea is ncn ae ’eyd s ss c pnP to h eou n ratr s c tp c o e doo nr v os n ae e ls n r f oto ch tr h a t ith l de - d c i In noe f vf ooi e tn r hr mi s et i a roo tn wn iol oyo n r f e d ia n s sn t ,c i Ioto i l dp e l oese c r ‘ na ‘ to e oto n d t r bw a i enn h ld ioC e ms vO e eaP b i tP n heA h t aa ta, i l tw nf h eh s edu i f.c c ’ ah ’h c4 t0 6 scope of the authority granted us by Congress information but may incorporate third-party that a child-directed site or online service in COPPA, the statute that underlies and plug-ins that collect such information404for receives any kind of benefit from using a authorizes the Rule.401Before I explain my the plug-ins’ use but do not collect or plug-in is equivalent to the collection of concerns, I wish to commend the maintain the information for, or share it with, personal information by the third-party plug- Commission staff for their careful the child-directed site or service. To address in on behalf of the child-directed site or consideration of the multitude of issues these concerns, the amendments add a new online service. raised by the numerous comments in this proviso to the definition of operator in the As the Supreme Court has directed, an proceeding. Much of the language of the COPPA Rule: ‘‘Personal information is agency ‘‘must give effect to the amendments is designed to preserve collected or maintained on behalf of an unambiguously expressed intent of f p s l p a c s p al at tv h tr r re r ar o o io six o g f vl tt t fii n e d ae e a’db slg krc c cy ii elt t n yg el y i ni s r c gnt ia. et ’y h nr g s nT u a ii f t dok n tl cho hd ee h n der d ir x i l u stet f eil ph h i d nen e mn ee e per’ b ra s e a r ti u cl un ti in p o tg srp n’ ed r d esh nri d r u eov t tp i e e hn ns pa b r rnt ac s io a sr tv t vyy thls o aaa ea, e en w ncn na d b y a dc p d h eg a re ir o ei o em ns ol n nb aa ee gve el l r o i iis v on tI ndn ft w i fd r s vee c ci tu em r aev h hae sp lsi i ene unn . lp o n d d a vTg fo t b r ahsrt e llt o e en u ’ es s t co m t a i s eh n i olp t rla e f T leoe mo li hr o en w r oa cmp et ‘rit ‘a t e no op eoai rr nn g dt n ra i o w e lat o w aio pd n n n nh r ho o b e de ; d s o t yn o eh si s m r r: de ea e e( r( a n ra c bavb i p) t m e ni)a l c i he yg ttt ee ah re a n.s fi ien l’rs no ’ fd o t o 4 enc s mm 0o dpo u 5tr e ’l e co ’ul ns r h e ta c se t oc e st or it o n v r rle csr l efid oe oc ab o c ne r co e ft m s hr p n s tp ru ar e ce uo tf c hr ii ev hs ot i i s o l ntd dW hnb e -ieay ser l b o f j e ‘ s [ BC u ‘ Fex Ioo LRs t Ip p Ln t b t Di Ia eg Nhf yn r oir Gea ce cd C rta .s Ci eo ots 2n Ofi r. n 0oo g’ ’ D1’ ’ g r n Et4 2eb rh s0 –e e 6 7 re 3so 7y e s 1 5T f d o s 03f i ph nee –4n 0f eru d 1 ie 1cC s n –Fd t t, POi h f i, tr u l ei ee PI o l dg lc Psn y a ta 1A a r n –o dd t . 1n f u il 6se to t –sh os t e 1 rs es 3ny uo ;t t e p .f 8p r :at p 4mh r 5o ae r m a tp m eo ]t l ei rc sy i i o f r o o o cn s o e op b n ps r a I lle l em u n c li itr r ege nh h a ay C cas ee .t t t. t4O o oc ii0 ss no or r2 eP t sn gnaa rP I t v ws n st puA i id i od eict s te rnC ee h t s’ uh sr so ooa an e dn na pt cr di ig n ate eo ri ur ldb r esn e a ap c iy s t nt lo t us h o es fkf t re oed d e nst t re h dC ot motf oe Oh wi fts n a he cP We l te a h e i Pod oi t diem u A l nC b gw dt ep e O fR rsh rro ei tPu o o t hnr b e mPlt a o eia s oAs t’u n rs o t a n t hp r n d el aa ycr ay e rs e o c e td d o t hh h xrfi e e 4 4 pr e ihr b 0 0 l e ri Sda3 4ce ec v Bv r1 Ion st e ef e Ps5e le n t ll fd ah yf U n’er c si eo oct c .W t pS, u ttm ot ehi e.w a ve Co sri l e ,b sra .nh k r d o a 6 e i nts n-a 5 dc bh pi o an 0t h e ai w ble 2 hr d r yis md t( l an ya e u vt-o f) d a hp iop(sr og1y erea l e r) mus r C. a we o g tt la Ohyr s fe t av - a Pic il dp oti nl Ph vc n l ts Ab hu eie tl a re es g hd tsr y i- teeut r s i ah y ae in cn t nr ua n h a er gst tr’ ie e o s c el nm l d . o m a ea T- le t tld l whree er i ed c ure oak e tl s rdici ty ,n kn o yt a e g td sd h at t a a t o i c m Wh o tp n ow s ae e4 n p t co n i0 h btC r n6 op s r eo sto al T e ep a l id cm r e th nnr t ea a ci ui adm t tas t oo na ai/t i roe ore l cs c x n r e oris ot s ep i e ncl oa o lsa lt o lan fen ot in n t nc d t ’ f id h‘ ts to o e ‘ re e ml e r np oo sdd l sd ir eao , s ne h’d rie k ’ nv vft i te ou h pei a itf o ce rsr e si t mn enmu i t rn i i h as n e iait g nnen gi tfc o io c afio oe can n r e rn n onc m d, g co lt t ,it l i o al a nf h a etu r tn y ngo ceiss ’ o t p d i se cp is noe n n ou rr tn ,r ge hlet ca li w -l eht ett aeah yo ch n xt ra’ar ti oo dis i o st sr l o /ns etpe t ‘ oni‘th v s aw na o r hee y a t g fh ur i n s p ts o s d hfe o a es r s targets children under the age of 13 is already maintaining the information (i.e., whether the site 40115 U.S.C. 6501–6506. deemed an operator. The amendment must participates in collection or is merely a conduit 402COPPA, 15 U.S.C. 6501(2), defines the term therefore be aimed at reaching third-party plug-ins through which the information flows to another ‘‘operator’’ as ‘‘any person who operates a Web site that are either not child-directed or do not have entity.)’’ Children’s Online Privacy Protection Rule l c a so eo bc rl o va l uet ie c ct d t eus , s o o oen r rr sm ot h o nae f i w onIn r ht at v oe i i snr s en s i te bp ot e reo hsrr s at o la o fnn s sa u uo l c n ci h hnli fn W io ne r e f ms obe ra r mstv ii t aoi ec tn ie o o f ra nr n o o imd n s l w io nrh e o a p w ec xe ht aru as ma o t l pn h k la a en l r , m o i inw t f t ao hl pe r id m s p g eaae amt rit so eh n n ta h, dt aw mt th h e te hi ny c it h sa w r sre aia l mic ls o ae el ds l t e d yac pr qt e ei u sn s oeg . fs Fc t hih oo ai rn rl md ar be on u’s t 6 ru4 l 4 eF 0) 7R . C 5 h9 e8 v8 ro8 n, 5 v9 .8 N9 a3 t, u5 r9 a8 l 9 R1 e ( sN ouo rv c. e3 s, D19 ef9 e9 n) s ( ef inal collected and maintained * * *’’ As stated in the could occur through general audience Web sites Council, Inc., 467 U.S. 837, 842–43 (1984) (‘‘When Statement of Basis and Purpose for the original and online services collecting and using visitors’ a court reviews an agency’s construction of the COPPA Rule, ‘‘The definition of ‘operator’ is of personal information without knowing whether statute which it administers, it is confronted with central importance because it determines who is some of the data is children’s personal information, two questions. First, always, is the question covered by the Act and the Rule.’’ Children’s which is a practice that COPPA and the whether Congress has directly spoken to the precise Online Privacy Protection Rule 64 FR 59888, 59891 amendments do not prohibit. question at issue. If the intent of Congress is clear, (Nov. 3, 1999) (final rule). 40516 CFR 312.2 (Definitions). that is the end of the matter; for the court, as well as the agency, must give effect to the unambiguously expressed intent of Congress.’’). Exhibit B

REASONS FOR SETTLEMENT

This statement accompanies the Stipulated Order for Permanent Injunction and Civil Penalty Judgment (“Stipulated Order”) executed by Edmodo, LLC (“Defendant”) in settlement of an action brought to obtain penalties and equitable relief for engaging in acts or practices in violation of the Children’s Online Privacy Protection Act of 1998 (“COPPA”), 15 U.S.C. §§ 6502(c) and 6505(d), and the Children’s Online Privacy Protection Rule (“Rule”), 16 C.F.R. Part 312, and §§ 5(a)(1), 5(m)(l)(A), 13(b), and 16(a) of the Federal Trade Commission Act (“FTC Act”), 15 U.S.C. §§ 45(a), 45(m)(l)(A), 53(b), and 56(a). The settlement requires Defendant to pay a civil penalty in the amount of $6 million dollars ($6,000,000), which has been suspended due to inability to pay. The settlement also imposes robust injunctive relief. Pursuant to Section 5(m)(3) of the FTC Act, as amended, 15 U.S.C. § 45(m)(3), the Commission hereby sets forth its reasons for settlement by entry of the Stipulated Order: On the basis of the allegations contained in the attached complaint, the Commission believes that the $6 million civil penalty, suspended due to inability to pay, constitutes an appropriate amount on which to base settlement. The full penalty amount will become immediately due if Defendant is found to have misrepresented its finances. The civil penalty and provisions enjoining Defendant from violating the Rule constitute effective means to assure its future compliance and deter others who might violate these laws. Additionally, with the entry of such a Stipulated Order, the time and expense of litigation will be avoided. For the foregoing reasons, the Commission believes that the settlement by entry of the attached Stipulated Order with Defendant is justified and well within the public interest.