Case Studies and Examples

The following case studies provide some real-world background on COPPA and FERPA. These examples provide insight into how the laws are challenged and viewed.

Children’s Privacy

Website operators have an obligation to follow COPPA if they know that they are collecting information from children.

In 2019, the FTC charged operators of the Musical.ly video social networking app with violating COPPA. Musical.ly is now known as TikTok. The FTC alleged that Musical.ly knew many children were using the app. It also alleged that Musical.ly failed to seek parental consent before collecting personal information from users under the age of 13. Even though Musical.ly was a general use website, the FTC said that Musical.ly had received thousands of complaints from parents upset that their children under age 13 had created Musical.ly accounts. Because it had received so many complaints, Musical.ly could not argue that it had no knowledge that children were using the app.

As part of its settlement agreement with the FTC, Musical.ly agreed to pay $5.7 million to settle the FTC’s claims. Musical.ly also had to agree to comply with COPPA by:

• Notifying parents about the app’s collection and use of children’s personal information
• Getting parental consent before collecting and using data from children
• Deleting personal information when parents request it
• Removing all videos made by children under the age of 13

The FTC documents related to the Musical.ly case are available at https://www.ftc.gov/enforcement/cases-proceedings/172-3004/musically-inc

Release of Disciplinary Records

Disciplinary records are a part of student records. Because FERPA protects student records, it thereby protects disciplinary records. A student’s consent is required before releasing any of these records.

A U.S. district court in the Southern District of Ohio decided this in 2000. The U.S. Court of Appeals affirmed the decision in 2002. However, the case actually started in 1995 and has a colorful history.

In 1995, the Miami University (located in Ohio) student newspaper asked Miami University to provide disciplinary records on students. This was to track crime trends on campus. The university refused to release the records. The paper then made a request using the Ohio Public Records Act. Miami University released the records but removed all personally identifiable information. They also removed information such as the date, time, and location of the incidents.

Editors of the paper thought that the university removed too much information from the records, so they went to the Ohio Supreme Court seeking full disclosure of the records. In a divided decision, the Ohio Supreme Court agreed and ruled that FERPA does not cover the disciplinary records. Miami University tried to take the case to the U.S. Supreme Court, but the Court chose not to hear the case in 1997.

Miami University notified the U.S. Department of Education (ED) that it did not think it was able to comply with FERPA based on the decision. The university also adopted a policy of releasing disciplinary records to any third-party requestor. Ohio State University also released similar records and notified ED that it planned to honor future requests. ED disagreed and thought that the Ohio Supreme Court made a mistake.

ED filed a motion to stop both universities from releasing these records. The U.S. district in the Southern District of Ohio heard the case. The universities did not dispute the facts and were willing to allow the court to rule. However, the school newspaper filed a motion to intervene. Although the newspaper was not named in the suit, it wanted its voice heard.

The newspaper claimed that ED did not have authority in the case. Instead, ED could take action only after the release of records, not before. However, the circuit court disagreed. It determined that ED did have authority. Additionally, the circuit court determined that disciplinary records are education records and covered by FERPA. The court ordered the universities not to release the information.

The newspaper appealed this decision to the U.S. Court of Appeals, arguing that FERPA violates the First Amendment and the district court did not recognize this violation. However, the U.S. Court of Appeals upheld the district court’s decision in 2002. Even today, schools must not release student disciplinary records without student consent.

ED documents related to the Miami University case are available at http://www2.ed.gov/policy/gen/guid/fpco/ferpa/library/unofmiami.html and http://www2.ed.gov/policy/gen/guid/fpco/courtcases/miami.html.