## Facts

- Artist Arena LLC operated fan-club and newsletter websites for popular recording artists and collected user information through registrations and subscriptions.
- The United States, on an FTC referral, alleged the websites collected personal information from children under age 13, including email addresses, street addresses, birth dates, phone numbers, and related data.
- The government alleged the company allowed under-13 users to register and create profiles, and that some websites either did not seek parental consent or used consent methods that did not satisfy COPPA’s “verifiable parental consent” requirements.
- The government also alleged the company sent emails to parents that were false or misleading, including statements that personal information would not be collected without prior parental consent when the information allegedly had already been collected.
- The United States filed a civil enforcement action seeking civil penalties and injunctive and equitable relief.
- The matter resolved through a court-entered consent decree in which the defendant neither admitted nor denied the allegations except as to jurisdictional facts.

## Issues

1. Whether the operator of child-directed websites, or websites that knowingly collect information from children under 13, violated COPPA and the COPPA Rule by collecting, using, or disclosing children’s personal information without adequate parental notice and verifiable parental consent.
2. Whether emails to parents about children’s data-collection practices constituted deceptive acts or practices in violation of § 5(a) of the FTC Act.
3. What civil penalties and injunctive/equitable relief were appropriate to remedy and prevent the alleged statutory violations.

## Decision

- The district court entered a Consent Decree and Order resolving the action without adjudicating issues of fact or law.
- The order imposed $1,000,000 in civil penalties.
- The order enjoined future violations of COPPA, the COPPA Rule, and § 5 of the FTC Act, including requirements tied to parental notice and verifiable parental consent before collecting children’s personal information.
- The order required deletion of personal information previously collected from children under age 13.
- The order included compliance provisions typical of FTC enforcement resolutions, including recordkeeping, reporting, and monitoring/inspection mechanisms.
- The order stated that the complaint stated claims upon which relief could be granted under COPPA and specified provisions of the FTC Act.

## Legal Principles

- COPPA and the COPPA Rule require covered website operators to provide notice to parents and obtain verifiable parental consent before collecting, using, or disclosing personal information from children under 13.
- Deceptive statements to parents about whether and how children’s personal information has been collected can constitute a deceptive act or practice under § 5(a) of the FTC Act.
- In a consent decree, the court may impose civil penalties and forward-looking injunctive and compliance obligations to prevent future statutory violations, even where the defendant does not admit liability.
- Equitable relief in COPPA/FTC Act enforcement may include mandatory deletion of improperly collected children’s personal information and ongoing reporting and recordkeeping to verify compliance.

## Conclusion

The case concluded with a court-entered consent decree requiring Artist Arena to pay $1 million, delete children’s personal data previously collected, and comply with injunctive and monitoring obligations designed to ensure future adherence to COPPA, the COPPA Rule, and the FTC Act’s prohibition on deceptive practices.


United States v. Artist Arena LLC, No. 12-cv-07386 (S.D.N.Y. 2012)