GMC Regulatory Compliance 3 — Questions and Answers
Question 1: A SaaS company collects data on children under 13 for its educational app marketed in the US. Which law mandates verifiable parental consent before collection?
- FERPA
- COPPA (Correct answer)
- CIPA
- HIPAA
Correct answer: COPPA
The Children's Online Privacy Protection Act (COPPA) requires verifiable parental consent before collecting personal information from children under 13.
Question 2: A marketer uses lookalike audiences built from hashed email lists on a social platform. Which compliance consideration is most critical under GDPR?
- Ensuring the email list was obtained with consent covering this purpose (Correct answer)
- Verifying the social platform is headquartered in the EU
- Confirming the hash algorithm meets ISO standards
- Limiting the lookalike audience to 1% similarity
Correct answer: Ensuring the email list was obtained with consent covering this purpose
Under GDPR, the original lawful basis and purpose of data collection must extend to subsequent uses like lookalike modeling, requiring compatible purpose or fresh consent.
Question 3: What is 'consent withdrawal' under GDPR, and what must follow it?
- A legal notice sent to the supervisory authority
- The data subject's right to revoke consent at any time, after which processing must stop (Correct answer)
- A cooling-off period before data can be re-used
- An audit of all data processed under that consent
Correct answer: The data subject's right to revoke consent at any time, after which processing must stop
GDPR Article 7(3) grants data subjects the right to withdraw consent at any time, and controllers must cease processing based on that consent without delay.
Question 4: Under the TCPA, which type of calls is exempt from the prior express written consent requirement?
- Promotional calls to wireless numbers
- Calls made with an auto-dialer to wireless numbers
- Non-commercial informational calls to landlines with established business relationships (Correct answer)
- All calls to numbers on the National Do Not Call Registry
Correct answer: Non-commercial informational calls to landlines with established business relationships
Non-commercial informational or transactional calls to landlines where an established business relationship exists may be exempt from TCPA's stricter consent rules.
Question 5: A brand publishes a sponsored Instagram post through an influencer. The FTC requires the influencer to:
- Use only the hashtag #ad somewhere in the post
- Clearly and conspicuously disclose the material connection in a way consumers will notice (Correct answer)
- Disclose only if paid more than $500
- File a disclosure form with the FTC before posting
Correct answer: Clearly and conspicuously disclose the material connection in a way consumers will notice
FTC Endorsement Guides require that material connections (payment, free products, etc.) be disclosed clearly and conspicuously so that ordinary consumers notice and understand the disclosure.
Question 6: Which regulation governs how health-related marketing data can be used when a company is a covered entity or business associate?
- COPPA
- FCRA
- HIPAA (Correct answer)
- SOX
Correct answer: HIPAA
HIPAA's Privacy and Security Rules restrict how covered entities and their business associates may use or disclose protected health information (PHI), including for marketing.
Question 7: A marketer uses a third-party data broker's consumer list for email prospecting. Under the FTC Act, the marketer is responsible for:
- Only the broker's compliance, not their own
- Verifying the list was legally obtained and that claims made are truthful (Correct answer)
- Filing a data broker disclosure with the FTC
- Obtaining GDPR adequacy decisions for all contacts
Correct answer: Verifying the list was legally obtained and that claims made are truthful
Marketers bear FTC Act responsibility for their own campaigns regardless of where data originated, including ensuring claims are truthful and data use is lawful.
