DOJ, Edmodo Agree to Permanent Injunction in COPPA Suit Settlement

Counsel for educational technology company Edmodo and DOJ agreed last week to have a magistrate judge conduct further proceedings in a privacy case brought by the DOJ. The parties filed a joint motion (docket 3:23-cv-02495) May 22, saying they resolved all issues in the matter by a proposed stipulated order for permanent injunction, civil penalty judgment and other relief in U.S. District Court for Northern California in San Francisco.

DOJ’s complaint alleged Edmodo violated the FTC Act, the Children’s Online Privacy Protection Act (COPPA) and the COPPA Rule by failing to obtain verifiable parental consent before collecting, using or disclosing children’s personal information and retaining their personal information collected online for longer than reasonably necessary. Edmodo also violated the FTC Act by requiring schools and teachers to comply with the COPPA Rule on its behalf without providing adequate information or support to meet the rule’s requirements, said DOJ.

The proposed order stipulates that Edmodo and its employees and agents are permanently enjoined from collection of personal information from children for failing to provide direct notice of a change in practice for disclosing personal information; failing to post a clear and conspicuous link to an online notice of information practices; failing to obtain verifiable parental consent or school authorization before collecting information; conditioning a child’s participation in an activity on disclosing more information than is necessary; and retaining information longer than necessary, said the motion.

Under the proposed order, Edmodo and its agents would be enjoined from relying on schools to be intermediaries to obtain verifiable parental consent on behalf of Edmodo and relying on school authorization for the collection of personal information from children unless they enter into a written agreement with the school, it said.

Within 60 days, Edmodo must destroy all personal information collected through the Edmodo platform from accounts that haven't provided verifiable parental consent or school authorization. Within 90 days of the order, Edmodo must identify the number of accounts for which direct notice was provided, plus the number of accounts that provided parental consent and school authorization.

The company will be required to adhere to a retention schedule for children’s information collected through the platform, stating the purpose for retaining personal information and the time frame for deleting the information, said the order. Deletion can't exceed one year after termination of the agreement with the school. The retention schedule must be publicly available on the Edmodo website, it said.

The order proposed a judgment of $6 million as a civil penalty. The penalty is suspended due to Edmodo's inability to pay, said the order, which said the amount constitutes an appropriate amount on which to base settlement. The full penalty amount will become due immediately if Edmodo is found to have misrepresented its finances, it said.