Is “Apple Compliant” the same as “COPPA Compliant”?

Having recently returned from our industry’s annual Game Developers Convention in San Francisco, I wanted to touch on something we heard for the first time at the show. Several game developers we spoke to described their games as being “Apple Compliant”.  What does that mean?

As we all know, Apple is extremely discerning about what will and won’t be allowed into its App Store.  We work months on our games and then meekly submit them to the Apple review team, hoping that we won’t get an arbitrary denial for some small transgression, or worse, a denial with no reason given. The collective sigh of relief heard when the Apple “Ready for Sale” email arrives can blow windows out.

For games that are specifically for children, Apple has created a separate sub category called “Kids”, and those apps are subject to even more specific rules:

24.1 Apps in the Kids Category must include a privacy policy and must comply with applicable children's privacy statutes

24.2 Apps in the Kids Category may not include behavioral advertising (e.g. the advertiser may not serve ads based on the user's activity within the App), and any contextual ads presented in the App must be appropriate for kids

24.3 Apps in the Kids Category must get parental permission or use a parental gate before allowing the user to link out of the app or engage in commerce

24.4 Apps in the Kids Category must be made specifically for kids ages 5 and under, ages 6-8, or ages 9-11

All of these rules make sense and a game that can pass the tests is certainly kid friendly. But it’s not COPPA compliant. 

“Apple Compliant” is not the same as COPPA compliant.

Apple’s rules cover parts of COPPA but they ignore other aspects, like positively identifying the parent, presenting the parent with an accurate list of the PII that the game will capture, and most importantly, not allowing the child to play the game until the parent has viewed the privacy disclosure and approved the game.

So my point is that being accepted by Apple into one of its “Kids” categories doesn’t mean you are compliant with anything other than Apple’s guidelines.  Because you are definitely targeting kids, you should definitely go the rest of the way and add full COPPA compliance to your game.

In my opinion, by creating their own similar but incomplete rule, Apple has done a disservice to the app development world by further confusing the issues around COPPA and child privacy. I can’t fathom why Apple didn’t just require apps in the kids category to be COPPA compliant, since by definition, they are required to be by law.   Another question is why Apple chose to limit its protection to age 11 and under while COPPA covers children 12 and under.

The potential penalty for not complying with Apple’s guideline is simple; your app will be rejected and thus will not be available on the App Store, but the potential penalty for not complying with COPPA is much more of a mystery.  COPPA can be enforced by either the FTC or by any state.  Despite the fact that the FTC has only enforced COPPA two times since its 2013 update, there are indications they will step up their efforts.  With election year coming in 2016, it would not be surprising to see a lot more state Attorneys General seeking headlines by enforcing this child privacy law, the political equivalent of kissing babies.

If you'd like to educate yourself on COPPA, here's a page of history and links AgeCheq has created for game developers. To learn more about COPPA directly from The Federal Trade Commission, check out this list of answers to frequently asked questions: http://business.ftc.gov/documents/Complying-with-COPPA-Frequently-Asked-Questions .  Because there are numerous “incomplete” versions on the web, I encourage you to always view the final, official text of the COPPA law, which can be found here:

http://www.ecfr.gov/cgi-bin/text-idx?tpl=/ecfrbrowse/Title16/16cfr312_main_02.tpl