Song BMG to pay $1 Million Civil Penalty for violations of the Children’s Online Privacy Protection Act (COPPA).

by Allen M Lee12. December 2008 09:18

On December 10, 2008, the Department of Justice filed on behalf of the FTC a complaint against Sony BMG Music Entertainment in the U.S. District Court for the Southern District of New York alleging violations of the Children’s Online Privacy Protection Act of 1998 (“COPPA”).  COPPA requires website operators to notify parents and obtain their consent before collecting, using or disclosing the personal information of children under the age of 13. 

As alleged in the complaint, Sony operated numerous websites which promoted its recording artists and recording labels.  On some of these sites, the registration forms collected personal information from users such as email addresses, date of birth and gender.   Some of the information was collected from children under 13 years of age. 

Although Sony’s websites did contain privacy notices purporting to restrict the use of the sites to users 13 and over, and stated that such users should not submit any personally identifiable information, children who entered dates of birth indicating that they were under 13 years of age were still freely able to register on Sony’s websites.  Sony’s privacy policy further stated that the sites used cookies to enforce the age restriction.  However, this was not done.   Despite the fact that Sony collected personal information from children under 13, Sony failed to comply with COPPA’s notice or consent rules.

The complaint alleged over 30,000 violations of COPPA and one count of unfair or deceptive trade practice for Sony’s failure to adhere to the representations in its privacy policy, and sought monetary civil penalties of $11,000 for each violation of COPPA.  On December 11, 2008, Sony settled the case by agreeing to pay $1 million in penalties and to engage in certain remedial actions.

The FTC has already brought numerous enforcement actions against companies failing to comply with COPPA, and it has already announced that enforcement of this law is one of its highest priorities.  Website operators should consider complying with the requirements of COPPA if there is any possibility that they may be taking personal information from users under the age of 13.  To reduce the odds of an FTC enforcement action, website operators should also strictly adhere to the terms of their privacy policies.  It is the FTC’s position that failing to adhere to the representations set forth in a privacy policy constitutes an unfair trade practice.


Allen M. Lee  Mr. Lee’s practice focuses on business, corporate and intellectual property matters, including the creation, protection and exploitation of intellectual property assets.  He counsels clients on business formation, general corporate matters, trademark, copyright, trade secret, patent, licensing, internet and domain name issues, among other things.  For more information contact: Allen M. Lee, a Professional Law Corporation, Tel: (650) 254-0758, Fax: (650) 967-1851, Email:, Internet: