Does the Children’s Online Privacy Protection Act [1], work? One of the ways to try to answer this question is the number of cases. There are less than 40 in total since the act was passed more than a decade ago. In other words, less than 4 enforcements on average per year.
Beyond just the number of enforcements, there is also the question of sanctions i.e. how damaging it is to a company in terms of fines to be enforced. The original maximum civil penalty per violation (e.g. a single data collection event on a single user) was $16,000, but it was recently raised to $40,000 [2] by the FTC. This sure sounds nice on paper, but the keyword, as we will find out below, is ‘maximum’. The actual penalties end up being a far cry from the promise.
Using the 15 enforcements where number of violations is published, which total in 103,272,600 violations, the average per violation fine is $8,760,000. This means the average fine per violation is $0.08. This is including the most recent InMobi case estimated at 100,000,000 violations, when the filings suggest there was multiple times more [3]. If we exclude this as anomaly, the remaining 14 cases yield 3,272,600 violations and fines of $7,810,000 and a $2.36 per violation fine. This is still 8,000 times less than the $16,000 per violation stipulated in COPPA.
The maximum cost-per-violation is $266 for 3,000 violations, and the only significant case in terms of the stated violations, the cost-per-violation is $0.01. Even the maximum is still over 50 times smaller than the stated $16,000 and well over 100 times smaller than the current $40,000 maximum fine per violation. In short summary, the closest anyone ever got to the maximum is 2% of it.
A Comprehensive List of COPPA Enforcements
| year | fine | reach | cost per | |
| InMobi | 2016 | 950,000 | 100,000,000 | 0.01 |
| Viacom | 2016 | 500,000 | na | na |
| Mattel | 2016 | 250,000 | na | na |
| JumpStart | 2016 | 85,000 | na | na |
| LAI Systems | 2015 | 65,000 | na | na |
| Retro Systems | 2015 | 300,000 | na | na |
| TinyCo, Inc | 2014 | 300,000 | na | na |
| Yelp Inc | 2014 | 450,000 | na | na |
| Path, Inc | 2013 | 800,000 | 3,000 | 266.67 |
| Artist Arena, LLC | 2012 | 1,000,000 | 75,000 | 13.33 |
| RockYou, Inc | 2012 | 250,000 | 79,000 | 3.16 |
| SkidleKids | 2011 | 100,000 | 5,600 | 17.86 |
| W3 Innovations | 2011 | 50,000 | 50,000 | 1.00 |
| Playdom, Inc. | 2011 | 3,000,000 | 1,224,000 | 2.45 |
| Iconix Brand Group, Inc. | 2009 | 250,000 | 1,000 | 250.00 |
| Sony BMG Music Entertainment | 2008 | 1,000,000 | 30,000 | 33.33 |
| Industrious Kid, Inc. and Jeanette Symons | 2008 | 130,000 | 10,500 | 12.38 |
| Imbee | 2008 | 130,000 | 10,500 | 12.38 |
| Xanga.com, Inc. | 2006 | 1,000,000 | 1,700,000 | 0.59 |
| UMG Recordings, Inc. | 2004 | 400,000 | na | na |
| Bonzi Software, Inc. | 2004 | 75,000 | na | na |
| Mrs. Fields Famous Brands, Inc. | 2003 | 100,000 | 84,000 | 1.19 |
| Hershey Foods Corporation | 2003 | 85,000 | na | na |
| Ohio Art Company | 2002 | 35,000 | na | na |
| American Pop Corn Company | 2002 | 10,000 | na | na |
| Frank, Lisa, Inc. | 2001 | 30,000 | na | na |
| Looksmart, Ltd | 2001 | 25,000 | na | na |
| Monarch Services, Inc., et al. | 2001 | 25,000 | na | na |
| Bigmailbox.Com, Inc., et al. | 2001 | 30,000 | na | na |
| Girls Life Inc | 2001 | 25,000 | na | na |
| Nolan Quan | 2001 | 25,000 | na | na |
| Toysmart.com, LLC | 2000 | 35,000 | na | na |
References
[1] https://en.wikipedia.org/wiki/Children%27s_Online_Privacy_Protection_Act
[2] https://www.wsgr.com/WSGR/Display.aspx?SectionName=publications/PDFSearch/wsgralert-ftc-violations.htm
[3] https://www.ftc.gov/news-events/press-releases/2016/06/mobile-advertising-network-inmobi-settles-ftc-charges-it-tracked