## Facts

- Yelp Inc. operated an online review platform and mobile application allowing users to create accounts, post reviews, upload photos, and interact with other users.
- Yelp’s website registration process required a date of birth and was configured to block users under 13 from registering.
- From at least 2009 to 2013, Yelp’s mobile app registration allegedly lacked a functional age screen and allowed thousands of users who entered birth dates indicating they were under 13 to register and access the service.
- During registration and use, Yelp allegedly collected personal information, including name, email address, ZIP code, and other profile data, and the app automatically collected unique device identifiers.
- The United States, following FTC authorization, filed a civil enforcement action alleging violations of the Children’s Online Privacy Protection Act (COPPA) and the COPPA Rule for collecting children’s personal information without required parental notice and verifiable parental consent.
- The parties negotiated a stipulated order that resolved the case without a contested merits ruling; Yelp neither admitted nor denied the complaint’s allegations, except for jurisdictional facts.

## Issues

1. Whether an online service operator has “actual knowledge” under COPPA when users self-report dates of birth indicating they are under 13.
2. Whether collecting children’s personal information through a mobile app without parental notice and verifiable parental consent violates COPPA and the COPPA Rule.
3. What injunctive and monetary relief is appropriate to remedy alleged COPPA violations involving under-13 registrants and retained data.

## Decision

- The court entered a stipulated permanent injunction and civil penalty judgment resolving all matters in dispute between the parties.
- Yelp agreed to pay a civil penalty (publicly reported as $450,000).
- Yelp agreed to injunctive terms requiring future compliance with COPPA’s notice and verifiable parental consent requirements.
- Yelp agreed to delete personal information collected from accounts registered with ages under 13, absent proof the user was at least 13 at registration.
- Yelp agreed to compliance reporting obligations, including submission of a detailed compliance report on a specified schedule.

## Legal Principles

- COPPA applies to operators with “actual knowledge” that they are collecting personal information from children under 13, including when age information is obtained through a registration flow.
- Before collecting, using, or disclosing personal information from a child, an operator must provide parents notice of its information practices and obtain verifiable parental consent.
- “Personal information” under COPPA can include identifiers such as names, email addresses, and persistent device identifiers gathered through mobile applications.
- In COPPA enforcement actions, remedies may include civil penalties, deletion of improperly collected children’s data, forward-looking compliance obligations, and monitoring or reporting requirements.
- A stipulated injunction and penalty judgment resolves the parties’ dispute without adjudicating liability on the merits and may include non-admission provisions.

## Conclusion

The court entered a negotiated COPPA settlement requiring Yelp to pay a civil penalty and to implement prospective compliance measures, including parental notice and verifiable consent procedures and deletion of certain data collected from users who registered as under 13, without a merits determination of liability.


United States v. Yelp Inc., No. 3:14-cv-04163 (N.D. Cal. 2014)