FTC COPPA Rule Revision Comments-Deadline Extended to December 23

No need to fret over Thanksgiving! The Federal Trade Commission has extended until December 23, 2011, the deadline for the public to submit comments on proposed amendments to the Children’s Online Privacy Protection Rule. That's good news because the revisions are significant and include the demise of the flexible "sliding scale" approach that permitted operators to install an "email plus" method of obtaining verifiable parental consent when the collection and use was of a very limited nature. Without any data or evidence of consumer harm, the FTC has determined that the "shelf life of 'email plus' has expired," to use the phrase of Commissioner Julie Brill at a recent Promotion Marketing Association conference. Apparently, making it harder for industry to market to children will force it to "innovate" new ways to comply. Sounds expensive. But, unless industry can come up with some hard evidence of those costs, the process of engaging children in interactive media will be significantly altered. There are other major changes. (The proposed changes will mean the end of user-generated contests for kids if they involve any uploaded photographs of themselves, for example.) Several industry groups, including the PMA, are planning to file comments. This extension will give industry more time to come up with hard numbers. Our sources at the staff level indicate that although there is a definite desire to kill email plus, carving out exceptions might be possible (at least in the Frequently Asked Questions that the FTC has published to help operators comply with the COPPA Rule) if commenters can produce solid reasons why this removal of the flexible approach is going to impose unreasonable costs, compared with the potential protection from admittedly hypothetical harm.

Unlike some of the recent FTC initiatives, which are arguably overreaches, these revisions, albeit aggressive, are probably within the broad Congressional authority granted to the Commission under COPPA. That makes it even more important that commenters come up with numbers about the costs of these revisions and how they might be likely to affect jobs. Even with regard to the Commission's apparent usurpation of oversight from self-regulatory bodies in the area of children's privacy, those bodies are subject to regulation by the FTC by virtue of the safe-harbor provisions. Thus, even though it will be imposing new costs and requirements on the Children's Advertising Review Unit (CARU), which was monitoring the collection and use of information from children before there even was COPPA, CARU, because it sought safe harbor status, is subject to whatever new requirements the Commission may impose. One has to wonder, however, whether the existing safe harbor entities are sanguine about the new burdens because the FTC will be effectively making the barrier to entry for new safe harbor competitors nearly impossible. Interesting anti-competitive question.

CARU Annual Law Conference - Explore the role of self-regulation in the U.S. in the area of Marketing to Kids and Get a Discount

From the proposed changes to COPPA to the latest developments in the area of self-regulation of food marketing to children, the CARU conference to be held Wednesday, October 5, 2011 in New York City will be one of the best places not only to learn the details but also to interact with leaders in the industry to are on the front lines of self-regulation. Furthermore, FTC Commissioner, Julie Brill, will give a keynote address. Commissioner Brill tends to represent the more activist tendencies of the Commission, and those in attendance should be able to ask pointed questions and express concerns. The agenda and full conference information is located on the CARU website.

Because Reed Smith is a sponsor of the CARU conference, if you register by contacting Rey Persaud at 212-705-0113 or via email at rpersaud@narc.bbb.org and mention this blog post, you will receive a $100 discount on the conference fee. Offer expires October 3, 2011.

Teen COPPA?

The Federal Trade Commission testified that while teens are heavy users of the digital environment and may benefit from using the Internet to socialize with peers, learn about issues that interest them, and express themselves, it also can pose unique challenges for them. The FTC testimony to the Senate Committee on Commerce, Science, and Transportation, Subcommittee on Consumer Protection, Product Safety, and Insurance notes that the Commission will continue to use law enforcement, education, and policy tools to protect teens in the digital environment.

Maine Introduces COPPA Extension Bill

This post was written by John P. Feldman and Andrew R. Boortz.

Last year, the Maine Legislature adopted 10 MRSA c. 1055, which, among other things, attempted to extend COPPA-like protection to all minors (that is, children under the age of 18). The law was plagued by a number of issues, including questions regarding its constitutionality, and ultimately caused the Maine attorney general to promise not to enforce the law as written. Based on this, it was generally understood that the Maine Legislature would revisit the law in the 2010 legislature session.

The legislature did not wait long. On January 7, 2010, a new children's privacy bill was referred to the Maine Senate Committee on Business, Research, and Economic Development. The new bill, currently listed as LD 1677, would repeal the existing children's privacy law, but would enact a new prohibition on the collection and use of personal information that is: (a) collected and used on the Internet; (b) about a minor; or (c) for the purposes of pharmaceutical marketing.

Although this bill is narrower in scope than the law it seeks to replace, there are still problems with it. First, the bill applies to any personal information about a person under the age of 18, regardless of whether that information is related to health. Therefore, any information about a minor, including name, e-mail address, etc., would be covered. Second, the law seems to apply only to information collected on the Internet; it is unclear whether this information would apply to information collected through other means such as offline collection, mobile device, etc. Third, the text of the prohibition is poorly worded. The prohibition states that "any person may not collect and use information collected on the Internet ..." (emphasis added). Thus, by a literal reading of the text of the bill, a company could collect information about a minor for the purpose of pharmaceutical marketing and avoid liability if it does not use the information. Alternatively, a company could use information that is collected on the Internet by someone else since it would neither have collected nor used the information.

Of course, it is unlikely that the Maine attorney general would interpret the law in this way because this would create a substantial loophole. Instead, it is more likely that the law would be interpreted as creating two strict liability offenses—one for collection of information if the reason for the collection is to promote pharmaceutical sales, and one for the use of any information about a minor to promote pharmaceutical sales, whether or not the information was originally collected for that purpose.

Why This Matters: If enacted, this bill would place a higher burden on companies that sell either over-the-counter or prescription drugs, including pharmaceutical manufacturers and retailers. Such companies will have to be very careful with any marketing program that could conceivably collect or use information about a minor. For example, an e-mail blast with weekly offers that includes discounts on over-the-counter products could violate the bill's prohibition on marketing to children if a minor's e-mail address was included in the recipient list. Companies that sell pharmaceutical products should watch the progress of this bill closely to determine what kinds of systems should be created to avoid liability. There may be an opportunity to comment on rules that must be promulgated by the Maine attorney general within a year after enactment of the law.

The Other Shoe Drops on the Maine COPPA-extension Law

Following the U.S. District Court's statement last month regarding the dubious constitutionality of Maine's Act To Prevent Predatory Marketing Practices against Minors has been recommended for repeal by a special committee of the Maine legislature. MediaPost reports that last Friday, the state's judiciary committee conceded that the constitutionally flawed statute, which had been questioned but not invalidated by the Court, could only create unnecessary costs in a flurry of private actions. That said, the committee was committed to the original purpose behind the law, that is, to enact a carefully tailored measure to address the collection of minors' health-related information.

Why This Matters

Advertisers and marketers can go back to their normal age filters and can once again include Maine in their promotions and marketing plans.

Maine Children's Privacy Law Update

This post was written by Dan Jaffe.

The business community has won an important victory in a lawsuit challenging a Maine law that severely restricts the collection, transfer and use of “personal information” or “health-related information” from minors.  The Maine Attorney General has publicly committed not to enforce the law, which was scheduled to take effect on September 12th.  Although the federal court stopped short of granting a preliminary injunction, it sent a clear message that any private cause of action under the new law could suffer from “constitutional infirmities.”  We are very hopeful that this will give the business community an opportunity to work with the Attorney General, the bill’s sponsor and others in the Maine Legislature to resolve the serious defects with the legislation.

On August 26th, a lawsuit was filed in federal court in Maine by the Maine Independent Colleges Association, the Maine Press Association, NetChoice and Reed Elsevier challenging the Maine “Act to Prevent Predatory Marketing Practices Against Minors.”  The lawsuit argues that the law is unconstitutional on both First Amendment and dormant commerce clause grounds and is preempted by the federal Children’s Online Privacy Protection Act (COPPA).

After hearing arguments yesterday on the motion for a preliminary injunction against the Act, the federal court found that the Plaintiffs had “met their burden of establishing a likelihood of success on the merits of their claims that Chapter 230 is overbroad and violates the First Amendment.”  The court’s order specifically noted that the Attorney General has publicly acknowledged First Amendment concerns and has committed to not enforce the Act.  In addition, the order put potential third parties on notice that any private cause of action under the Act could suffer from “the same constitutional infirmities.”  We are very hopeful that this will discourage any such private lawsuits.  With these strong findings of the court, the parties agreed to dismiss the lawsuit without prejudice, allowing the parties to relitigate if some third party tries to enforce the law. 

ANA has provided financial support for the lawsuit and we are pleased with this result.  Also, there has been a commitment to revisit and consider carefully revising the law when the Maine Legislature reconvenes this January.

If you have any questions about the Maine lawsuit, please contact Dan Jaffe or Keith Scarborough in ANA’s Washington, DC office at (202) 296-1883.

Maine AG Supports Stay on Privacy Law Targeted at Minors

The news from the front is that progress is being made toward staying enforcement of the Maine privacy law targeting minors. The law, which contains a private right of action, has caused many to void Maine in their promotional plans for the fall and to adjust their data collection practices.

Background

The new Maine privacy law targeted at minors suffers from serious constitutional flaws. 

Under the new Maine law, which is scheduled to take effect Sept. 12, 2009, an entity may not collect, receive or use personal or health-related information from a minor for marketing purposes without first obtaining “verifiable parental consent.” To obtain such consent, the entity must undertake a “reasonable effort, taking into consideration available technology” to notify the parent and obtain parental consent. Any such notice must describe the entity’s practices regarding the collection, use, and disclosure of the information, and the consent provided must authorize such practices before any information may be collected, received or used.

Maine is following the lead of other states that have tried to expand the federal Children’s Online Privacy Protection Act (“COPPA”) to address adolescents between 13-17 years of age and their use of social networking websites. Like COPPA extension proposals in New Jersey (extending COPPA to cover the 13-17 age range) and Illinois (applying COPPA to most social networking sites), the Maine law tries to build on COPPA’s "verifiable parental consent" requirement for the 13-17 age range.

But, the Maine law addresses the following additional items:

  • Online & Offline Information Collection: The Maine law applies to all collection, receipt or use of information from a minor, whether online or offline, whereas COPPA only applies to online activities.
  • Personal Information: Although both COPPA and the Maine law define “personal information” generically as any “individually identifiable information,” the examples provided in the Maine law are less focused on the online collection of information than COPPA.
  • Health Related Information: The Maine law applies to the collection and use of both “personal information” and “health-related information,” whereas COPPA only applies to personal information. 

This statute potentially could greatly complicate children’s marketing compliance, because it will create a marketing environment in Maine that is inconsistent with COPPA. Because the Maine legislature will not be in session until Jan. 6, 2010, and there have been no rumors of a special legislative session before September, the industry has been busy seeking a way to stay enforcement of the law. Among the bases for challenge that could forestall enforcement of the law might be:

  • Statutory Preemption: Section 1303(d) of COPPA preempts state or local government laws that are inconsistent with COPPA. The legislative history of COPPA reveals Congressional findings that: (1) adolescents over the age of 13 have privacy rights and a greater understanding of commercial content, and (2) a national uniform standard was necessary because of the global distribution of the Internet. With this knowledge, Congress chose to regulate only the online collection of information from children younger than 13, and included this preemption provision to specifically guard against a patchwork of inconsistent regulation.
  • Dormant Commerce Clause: Under Pike v. Bruce Church, 397 U.S. 137 (1970), if “the burden imposed . . . is clearly excessive in relation to the putative local benefit, and if the local interest can be promoted by other regulations that have a lesser impact on interstate activities,” the court may strike down a state law that burdens interstate commerce. Courts have invalidated a number of Internet-related state laws (regarding matters such as obscenity and SPAM regulation) on these grounds. In this case, the Maine law would be excessive because it forces out-of-state websites to treat Maine users differently – or to treat all Internet users as if they were located in Maine. Further, the interest of protecting children’s activities online is already addressed in COPPA, a uniform federal statute that has less impact on interstate commerce.First Amendment Commercial Speech: Under Central Hudson Gas v. Public Service Commission, 447 U.S. 557 (1980), commercial speech that is not illegal or deceptive is afforded First Amendment protection. Courts may overturn statutes where the government does not demonstrate that its regulation: (1) directly advances a substantial government interest, and (2) is no more restrictive of speech than necessary. In this case, the Maine statute is overbroad and would not directly advance the government’s interest of protecting children’s activities online – the statute pertains to any collection of a youth’s information whether online or offline. Likewise, advertisers could find less restrictive and less comprehensive approaches to deter the perceived harm. For example, a parent could monitor his child’s computer use, and prevent the child from providing personal information. Or, parents could purchase “Net Nanny” software, which has settings to prevent personal information disclosure. Both of these solutions require no regulation at all.
  • Higher Value First Amendment Concerns: This statute has the potential to raise issues justifying a higher level of judicial scrutiny. For example, if government regulation could cause a chilling effect on any form of speech or regulate political speech, courts generally afford the speech strict scrutiny. In this case, it is not out of the realm of reasonableness to assume that some website operators could avoid information collection to the 14- to 17-year-old age group altogether, chilling all forms of youth marketing. Or, for political speech matters, groups like the Young Democrats or the Young Republicans may want to avoid collecting youth information as well, because much political activity could be viewed as marketing (i.e., party donation solicitations and memorabilia sales e-mails). 

The news on the front is that the AG of Maine understands and supports the stay. At least we know for sure the AG will not be bringing any actions under this law until the legislature revises it. It is critical that a stay be put in place to ensure that the industry is not inundated with nuisance private lawsuits for violation of the law. On the whole, however, things are moving in the right direction.

We will, of course, be following this carefully. Please call if you have any questions.