The Federal Trade Commission is currently conducting a review of the Children’s Online Privacy Protection Act, which governs how Web sites may collect and use personal information from children under the age of 13.
The law, commonly known as COPPA and which became effective in 2000, requires a Web site operator to obtain verifiable consent from a parent before collecting and using a child’s information obtained online.
The FTC conducted a similar review in 2005 but made no changes. The agency is conducting this review in light of developments and changes in the online and wireless environment, specifically children’s use of mobile technology to access the Internet. In connection with this review, the FTC posted a notice for public comment in April seeking information about how children access the Internet, the applicability of certain definitions to newer technologies, and whether the definition of “personal information” should be expanded to include information that may be collected from mobile devices. The comment period closed on July 12.
Commenters Weigh In
Not surprisingly, several advocacy groups suggested that the FTC broaden the definition of “personal information” so as to extend the reach of the law’s scope. Specifically, comments from a coalition of nonprofits and children’s advocacy groups, including the Center for Digital Democracy, Consumers Union, and the American Academy of Pediatrics, suggested that COPPA’s reach should be extended to new technologies, including mobile phones, interactive television, online gaming consoles, and other digital platforms, and that the definition of “personal information” should be broadened to include cookies, IP addresses, and geolocation data.
These groups also suggested that the FTC develop a separate set of privacy protections for children between the ages of 13 and 18, in line with the Fair Information Practices principles created by several international privacy organizations, which would provide some protections to teenagers, albeit less stringent than COPPA. In addition, the coalition said that major Web sites, ad networks, and social networks should be required to file regular reports about their data-collection practices with the FTC.
Other groups also weighed in with suggestions, including Common Sense Media, a parental organization that wants COPPA to be extended to all children under the age of 18, and the Center for Democracy & Technology (CDT). CDT argued that the definition of “personal information” should not be expanded to include IP addresses and that data collected for behavioral advertising purposes should not be considered personal information because of the industry’s self-regulatory standards, which already ban behavioral advertising to children without parental consent. The National Cable and Telecommunications Association (NCTA) submitted comments suggesting that changes to COPPA were unnecessary. The NCTA told the FTC it opposes the expansion of “personal information” and said no major changes to the law are necessary, as COPPA has been working well.
Leave It Alone
Other trade associations, including the Motion Picture Association of America, the Toy Industry Association, and the Word of Mouth Marketing Association, also agreed that the law should not be changed, as it provides a balanced approach to protecting the privacy of children while allowing Web site operators to provide online visitors with content and activities.
FTC Testifies to Congress on Protecting Children Online
Coincidentally, during the same week that the comment period closed, the FTC testified before the Senate Committee on Commerce, Science and Transportation in connection with its hearings on “Protecting Youths in an Online World.” In its testimony the FTC expressed concern with teens’ use of new technology without fully appreciating the privacy and security issues they present, saying, “Most teens today are avid consumers of digital media. Despite their technological sophistication, teens are still vulnerable to privacy and security risks.” The FTC cited one study that reported that in 2009 75% of teens aged 12 to 17 had a cell phone, up from 45% for that same age group in 2004. The FTC observed that “teens are increasingly using their phones for texting, e-mail and web browsing and making online purchases. They are also using mobile applications that raise unique privacy concerns, such as location-based tracking.” Further, the FTC noted another report that found 73% of American teens aged 12 to 17 are using social networking sites such as Facebook and MySpace, which is up from 55% two years ago.
While this testimony suggests that the FTC might be leaning toward suggesting to Congress that it raise the age of COPPA’s coverage, it also acknowledged that this might not be workable. “While the parental notice and consent model works fairly well for young children . . . it may be less effective or appropriate for adolescents [as they] have greater access to the Internet outside of the home than young children do,” noted the FTC. The testimony also observed that “teens seeking to bypass the parental notification and consent requirements may be less likely than young children to provide accurate information about their age or their parents’ contact information.” Further, the FTC acknowledged case law recognizing that as children age, they have increased constitutional right to access information and express themselves publicly. However, the FTC did not foreclose the possibility of supporting new legislation directed towards this older age group, telling the Committee that “ the Commission is available to work with this Committee, if it determines to enact legislation mandating special protections for teens.”
Conclusion
Given the rapid changes and developments in technology and the increasing use of the Internet and mobile devices by children under 13, the FTC is likely to make some changes to COPPA. In making these changes, the FTC will need to balance issues expressed by privacy advocates concerning the types and amount of information capable of being collected by Web site operators with the realities of whether such information may actually be attributable to a child under 13. However, based on its recent testimony, it appears that the FTC does not intend to recommend that Congress increase the age of the law to cover children 13 and older.
Marc Roth is a partner in the New York office of Manatt, Phelps & Phillips, LLP, where he advises clients on privacy, advertising and marketing issues. Contact him at [email protected].
Network
