• by Wendy Davis  @wendyndavis, September 30, 2014

Two watchdogs say that AgeCheq -- a company that aims to help app developers comply with children's privacy rules -- itself violates those regulations.

The Center for Digital Democracy and Campaign for a Commercial-Free Childhood allege in comments filed with the Federal Trade Commission complaint that AgeCheq collects data about children without first obtaining their parents' permission. Doing so violates FTC regulations implementing the Children's Online Privacy Protection Act, according to the advocacy groups.

AgeCheq CEO Roy Smith calls the allegations “specious.” “We're mystified by this whole thing,” Smith says, adding that he doesn't believe federal rules prohibit AgeCheq from collecting data about children.

COPPA bans Web site operators and app developers from knowingly collecting some types of information -- including device identifiers and data stored on persistent cookies -- from children under 13 without their parents' permission.

To comply with that law, some sites and developers use FTC-approved third parties to verify parental consent, through mechanisms like placing a charge on a parents' credit card. AgeCheq recently applied for approval of its “verified parental consent” platform.

The company says it developed a common mechanism for multiple app developers to obtain consent from parents. Without this type of common platform, each individual developer potentially would have to ask parents to verify their identity, Smith says.

AgeCheq says in its FTC application that it can connect a “verified parental identity” to “a specific device associated with a child,” and then offer parents a dashboard that enables them to approve individual apps that children want to access.

But the Center for Digital Democracy and Campaign for a Commercial-Free Childhood say that AgeCheq's platform will necessarily collect about children, due to its architecture.

“The company’s own application demonstrates how it is violating COPPA,” the groups allege. They add that AgeCheq “is tying children’s device identifiers to account information and to usage statistics.”

“The company’s ability to track what apps a child uses, when they use them, and possibly the location of the child while they are using the apps (i.e. through IP address or cell tower information) goes far beyond the abilities of any app developer to track a child over time and across different Web sites or online services,” the groups say. “This is potentially a full profile of a child’s preferences and habits.”

For his part, Smith says that AgeCheq doesn't fit into COPPA's definition of Web site operator, in part because it doesn't offer services that children would use. Instead, he says, AgeCheq offers a business service for developers, and a platform where parents can consent to their children's use of apps.

But the Center for Digital Democracy's legal director, Hudson Kingston, counters that AgeCheq meets COPPA's definition of “Web site operator.”

That law defines the term as anyone who operates a commercial site or service and “collects or maintains personal information from or about the users of or visitors to such Web site or online service, or on whose behalf such information is collected or maintained.”

“They might think there is an exception out there for what they’re doing, but it’s not in the COPPA Rule definition of 'operator,'” Kingston says in an email to Online Media Daily.