United States v. Edmodo, LLC

Background

The United States filed the action after receiving authorization from the Federal Trade Commission. The complaint invoked the Federal Trade Commission Act, the Children’s Online Privacy Protection Act, and the related Children’s Online Privacy Protection Rule. It charged that Edmodo collected, used, or disclosed children’s personal information without verifiable parental consent; retained children’s information longer than reasonably necessary; and unfairly required schools and teachers to comply with the privacy rule on Edmodo’s behalf without adequate information or support.

The parties stipulated to an order resolving all matters in dispute. Edmodo waived service, agreed to bear its own costs and attorneys’ fees, and waived rights to appeal or otherwise challenge the order. Edmodo did not admit or deny the complaint’s allegations, except for facts necessary to establish jurisdiction.

Injunctive Requirements

The permanent injunction prohibits Edmodo and covered persons acting with it from violating the Children’s Online Privacy Protection Rule. Among other requirements, Edmodo must make reasonable efforts to provide parents or qualifying school representatives with direct notice of its practices, post a clear and conspicuous online privacy notice, and obtain verifiable parental consent or qualifying school authorization before collecting, using, or disclosing children’s personal information, unless an exception applies.

Edmodo may not condition a child’s participation in an activity on providing more personal information than reasonably necessary. It must not retain children’s information longer than reasonably necessary and may not collect more information than reasonably necessary for a child’s participation. It generally may not rely on schools to obtain parental consent, and school authorization requires a written agreement addressing educational use, the information collected, notice, the representative’s authority, and the school’s direct control over the information.

For previously collected information, Edmodo must refrain from using, disclosing, or benefiting from the information unless the required consent or authorization is obtained. Within 60 days, it must destroy information from accounts lacking that consent or authorization. Within 90 days, it must report its notice and consent efforts to the Commission and delete or destroy affected work product—models or algorithms developed in whole or part from children’s information collected without the required consent or authorization. Edmodo must maintain a retention schedule that generally does not exceed one year after the applicable school agreement ends or, for information not under a school’s direct control, one year after the data is generated, subject to the order’s stated exceptions.

Money and Compliance

The order enters a $6 million civil-penalty judgment in favor of the United States against Edmodo. The judgment is suspended based on Edmodo’s sworn financial statements and related documents. If, on the United States’ motion, the court finds that Edmodo failed to disclose a material asset, materially misstated an asset’s value, or made another material misstatement or omission, the suspension may be lifted. The judgment would then become immediately due, less any payment already made, plus interest.

The order also requires Edmodo to provide acknowledgments and copies of the order to specified personnel and controlled businesses, submit a sworn compliance report after one year, provide certain change notices for ten years, and create specified records for ten years while retaining each record for five years. The Commission and the United States may request information, conduct depositions, inspect and copy documents, and use specified discovery procedures to monitor compliance. Judge Thomas Hixson retained jurisdiction to construe, modify, and enforce the order.