Is a UDP/IP network exempt from COPPA?
<p><a href="http://www.ecfr.gov/cgi-bin/text-idx?SID=4939e77c77a1a1a08c1cbf905fc4b409&amp;node=16%3A1.0.1.3.36&amp;rgn=div5" rel="nofollow">COPPA 312.2</a> defines "Internet" as</p>

<blockquote>
  <p>collectively the myriad of computer and telecommunications facilities, including equipment and operating software, which comprise the interconnected world-wide network of networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol, to communicate information of all kinds by wire, radio, or other methods of transmission.</p>
</blockquote>

<p>A literal reading of this means that if you use UDP instead of TCP, you would be exempt from COPPA.  Have there been any rulings on this?</p>

<p>As far as I can tell, no appeals court has had to decide whether "the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol" includes UDP for the purposes of 16 CFR §312.</p>

<p>I will argue that UDP is included.</p>

<p>From <em>King v. Burwell</em> (internal citations removed):</p>

<blockquote>
  <p>when deciding whether the language is plain, we must read the words in
  their context and with a view to their place in the overall
  statutory scheme.</p>
</blockquote>

<p>16 CFR §312, in conjunction with 15 USC §6501-6505, implements the <a href="https://en.wikipedia.org/wiki/Children%27s_Online_Privacy_Protection_Act" rel="nofollow">Children's Online Privacy Protection Act of 1998</a>.</p>

<p>The FTC is directed in 15 USC §6502(b) to promulgate regulations that (emphasis mine):</p>

<blockquote>
  <p>require the operator of <strong>any website or online service</strong> directed to children [...] to provide notice of what information is collected [...] and to obtain verifiable parental consent</p>
</blockquote>

<p>The FTC drafted 16 CFR §312 to that end. To treat UDP as exempt would mean that the FTC has not fulfilled their duty under 15 USC §6502(b). So, given the context of the overall statutory scheme, it is reasonable to conclude that the FTC intended 16 CFR §312 to include UDP.</p>

<p>However, even without the above line of reasoning, if the FTC were to attempt enforcement of 16 CFR §312 as if it included UDP, that interpretation would be controlling. The FTC would be afforded <a href="https://en.wikipedia.org/wiki/Auer_v._Robbins" rel="nofollow">Auer deference</a> by the court. They wrote the regulation; they know what it means. From <em>Auer v. Robbins</em> 519 U.S. 452 (1997):</p>

<blockquote>
  <p>Because the salary basis test is a creature of the Secretary's own regulations, his interpretation of it is, under our jurisprudence, controlling unless plainly erroneous or inconsistent with the regulation.</p>
</blockquote>

<p>And from <em>Bowles v. Seminole Rock &amp; Sand Co.</em> 325 U.S. 410 (1945):</p>

<blockquote>
  <p>Since this involves an interpretation of an administrative regulation, a court must necessarily look to the administrative construction of the regulation if the meaning of the words used is in doubt. The intention of Congress or the principles of the Constitution in some situations may be relevant in the first instance in choosing between various constructions. But the ultimate criterion is the administrative interpretation, which becomes of controlling weight unless it is plainly erroneous or inconsistent with the regulation.</p>
</blockquote>

<p>Again, given the context of the overall statutory scheme, such an interpretation of the regulation by the FTC wouldn't be <em>plainly</em> erroneous.</p>

united-states coppa