Last week, ten privacy groups requested that the FTC open an investigation into a Topps Co. online contest, which they allege violated the Children’s Online Privacy Protection Act (COPPA). Specifically, the groups claim that Topps’s #RockThatRock contest collected photos of children under age 13 without obtaining their parents’ consent.

Last spring, Topps invited its Facebook, Twitter, and Instagram followers to post photos of themselves “rocking” a Ring Pop (the company’s edible candy lollipop) using the hashtag #RockThatRock for a chance to have their photo featured in a music video for a popular tween band. In addition to social media, Topps promoted the contest on Candymania.com – its allegedly child-directed website that features content such as candy-related games. Entrants’ photos were posted on Candymania.com, and the music video, which has appeared on YouTube since June, has received over 900,000 views.

COPPA requires that businesses provide parental notice and obtain parental consent prior to collecting the personal information of children under age 13. The definition of “personal information” was updated in July 2013 to explicitly include photographs. COPPA violations carry a hefty fine – up to $16,000 per affected child – so it’s important to always consider a promotion’s potential audience, as well as the types of information collected.

Privacy Groups Ask FTC to Investigate Contest Sponsor for Alleged COPPA Violations