intrusion-detection software to monitor unauthorized access, and use of secure web
servers and firewalls to ensure confidentiality, data breaches have occurred.
The FTC is the primary agency entrusted with prosecuting COPPA violations on
the federal level. Because COPPA violations are considered to be unfair or deceptive
trade practices under § 5 of the Federal Trade Commission Act, the FTC can impose
civil penalties for its violation. State-level attorneys general are authorized to bring
compliance actions in federal district court. Although the COPPA Act itself does not
establish dollar penalty figures, courts determine damages based on Section 5 of the
FTC Act. While the maximum penalty figure for Section 5 violations was originally
set at $16,000 per violation, as of August 1, 2016, the maximum civil penalty nearly
doubled to $40,654 per violation. Because a violation is defined as each incident in
which a website or app collects personal information falling under the Act, the size
of potential civil penalties is extremely large.
The 2003 case, United States v. Boston Scientific Corp., 253 F. Supp. 2d 85, 98
(D. Mass. 2003), developed a six-step process for determining damages pursuant to
15 U.S.C. §45(a)(1). Those factors include: the level of harm to the public; the
benefits gained by the defendant; the good or bad faith of the violator [willful versus
negligent conduct]; the defendant’s ability to pay; the deterrence value of the penalty
for this defendant and other operators; and an amount needed to vindicate the FTC’s
authority. Although there is no private cause of action for COPPA violations, states
may file civil actions to obtain injunctions and damages in the interest of their
citizens.
2.4 Mandated Opt-Out Systems
The Controlling the Assault of Non-Solicited Pornography and Marketing
(CAN-SPAM) Act of 2003, covers all commercial messages,
98 which the law
defines as “any electronic mail message the primary purpose of which is the
commercial advertisement or promotion of a commercial product or service”,
including email that promotes content on commercial websites. Pursuant to this
Act, the sender of the message must clearly and conspicuously disclose that the
message is an advertisement.
99 The message must explain how recipients may opt
out of receiving future email using clear and conspicuous language that an ordinary
person can recognize, read, and understand.
100 Although senders of marketing based
98 Under the Act commercial messages are defined as “any electronic mail message the primary
purpose of which is the commercial advertisement or promotion of a commercial product or service
(including content on an internet web site operated for a commercial purpose).” 15 U.S.C. 7702(2)
(A).
99 15 U.S.C. § 7704.
100 “CAN-SPAM Act: A Compliance Guide for Business”, Federal Trade Commission Website.
Available at: https://www.ftc.gov/tips-advice/business-center/guidance/can-spam-act-complianceguide-business. Last accessed on 17 July 2017 [hereinafter Compliance Guide].
422
S. M. Boyne
servers and firewalls to ensure confidentiality, data breaches have occurred.
The FTC is the primary agency entrusted with prosecuting COPPA violations on
the federal level. Because COPPA violations are considered to be unfair or deceptive
trade practices under § 5 of the Federal Trade Commission Act, the FTC can impose
civil penalties for its violation. State-level attorneys general are authorized to bring
compliance actions in federal district court. Although the COPPA Act itself does not
establish dollar penalty figures, courts determine damages based on Section 5 of the
FTC Act. While the maximum penalty figure for Section 5 violations was originally
set at $16,000 per violation, as of August 1, 2016, the maximum civil penalty nearly
doubled to $40,654 per violation. Because a violation is defined as each incident in
which a website or app collects personal information falling under the Act, the size
of potential civil penalties is extremely large.
The 2003 case, United States v. Boston Scientific Corp., 253 F. Supp. 2d 85, 98
(D. Mass. 2003), developed a six-step process for determining damages pursuant to
15 U.S.C. §45(a)(1). Those factors include: the level of harm to the public; the
benefits gained by the defendant; the good or bad faith of the violator [willful versus
negligent conduct]; the defendant’s ability to pay; the deterrence value of the penalty
for this defendant and other operators; and an amount needed to vindicate the FTC’s
authority. Although there is no private cause of action for COPPA violations, states
may file civil actions to obtain injunctions and damages in the interest of their
citizens.
2.4 Mandated Opt-Out Systems
The Controlling the Assault of Non-Solicited Pornography and Marketing
(CAN-SPAM) Act of 2003, covers all commercial messages,
98 which the law
defines as “any electronic mail message the primary purpose of which is the
commercial advertisement or promotion of a commercial product or service”,
including email that promotes content on commercial websites. Pursuant to this
Act, the sender of the message must clearly and conspicuously disclose that the
message is an advertisement.
99 The message must explain how recipients may opt
out of receiving future email using clear and conspicuous language that an ordinary
person can recognize, read, and understand.
100 Although senders of marketing based
98 Under the Act commercial messages are defined as “any electronic mail message the primary
purpose of which is the commercial advertisement or promotion of a commercial product or service
(including content on an internet web site operated for a commercial purpose).” 15 U.S.C. 7702(2)
(A).
99 15 U.S.C. § 7704.
100 “CAN-SPAM Act: A Compliance Guide for Business”, Federal Trade Commission Website.
Available at: https://www.ftc.gov/tips-advice/business-center/guidance/can-spam-act-complianceguide-business. Last accessed on 17 July 2017 [hereinafter Compliance Guide].
422
S. M. Boyne