In enacting the Children’s Online Privacy Protection Act, Congress determined that the safeguards built into the statute should apply only to children under 13. It sought to focus the restrictions on collection and use of personal information on younger children who are particularly vulnerable to marketing tactics because of their unfamiliarity with advertising and the privacy risks associated with interactive Web services. In 2013, when the FTC expanded the COPPA Rule, it considered proposing protections to older children. As it states in its FAQs for COPPA, the Commission staff has been interested in promoting “strong, more flexible, protections” for teens. But, as of now, in the U.S., COPPA protections are limited to children under 13 years of age.
For years, Senator Ed Markey (D-Mass), and a small bi-partisan group of lawmakers, have been trying to move legislation forward that would expand COPPA and introduce a “bill of rights” for children and teens in connection with digital media usage. The latest version of this bill is the Do Not Track Kids Act of 2018 (“Act”).
Whereas this legislative initiative has failed in the past, and bipartisan legislation is hard to imagine passing in this Congress, there appears to be some momentum in this area perhaps brought on by recent revelations about Facebook and Google as well as the regulatory mist floating over the Atlantic from Europe with the effective date of GDPR now behind us. Here are the key elements of the Act that seeks to amend COPPA:
- The term “operator” will include any person who “operates or provides a website on the Internet, an online service, an online application, or a mobile application” (currently, an operator is “any person who operates a Web site located on the Internet or an online service…”);
- Disclosure requirements under COPPA will be expanded to include “the procedures or mechanisms the operator uses to ensure that personal information is not collected from children or minors except in accordance with the [Act]”;
- COPPA will apply to “minors,” defined as “an individual over the age of 12 and under the age of 16”;
- In addition to parents, minors will be able to review personal information collected by operators;
- Operators must maintain a “policy of openness,” which policy includes practices and policies regarding the personal information of minors, operator contact information (address, email, and phone number), identification of type and usage of personal information, and a means to have such information corrected, erased, completed, or otherwise amended;
- Operators must adopt a Digital Marketing Bill of Rights for Minors (intended to be consistent with the Fair Information Practices Principles, to be further defined by the FTC) before collecting personal information from minors;
- Operators of sites (etc.) directed to children may not use, disclose, or compile personal information for targeted marketing; operators of sites (etc.) directed to minors may not use, disclose, or compile personal information for targeted marketing without the verifiable consent of the minor;
- To the extent technologically feasible, operators must provide mechanisms by which to delete certain personal information of children and minors upon request and to inform users of such mechanisms;
- Manufacturers of connected devices must display a “privacy dashboard” on packaging detailing, whether, what, and how personal information of a child or minor is collected, transmitted, retained, used, and protected; and
- Connected devices must meet certain cybersecurity and data security standards to be promulgated by the FTC.
Why this Matters:
The Do Not Track Kids Act of 2018 may fail as it did in previous incarnations, but if there is anything that might get traction during this polarized time, it is children’s privacy. Extra attention should be paid to so-called “general audience” sites to make sure all COPPA requirements are observed, including age-screening mechanisms. Demonstrating to lawmakers and the FTC that appropriate safeguards are in place could help to dissuade lawmakers from creating new and costly regulatory hurdles