The COPPA Rule
The COPPA Rule, which implements the 2000 Children’s Online Privacy Protection Act (COPPA), requires websites and other online services to provide notice to parents and obtain verifiable parental consent prior to collecting, using, or disclosing personal information from children under the age of 13. The COPPA Rule applies to operators of websites and online services directed to children under 13 that collect personal information from children, as well as to operators that have “actual knowledge” that they are collecting personal information from children under 13.
The FTC amended the COPPA Rule in 2013 extensively to address technological changes such as the proliferation of social media and increased use of mobile devices. These amendments, among other changes, approved additional methods for obtaining parental consent, specified new requirements for notices to parents, and expanded the definition of personal information to include geolocation data, pictures, videos, audio recordings, and persistent identifiers. In light of continued rapid changes in technology, however, the FTC is considering whether additional changes to the COPPA Rule might be warranted, particularly as applied to: the educational technology sector, voice-enabled connected devices, and general audience platforms that host third-party child-directed content.
Request for Comment
The FTC has therefore opened up review of the COPPA Rule outside of its regular 10-year cycle and is seeking public comment on whether the 2013 revisions to the COPPA Rule have resulted in stronger protections for children and more meaningful parental control over the collection of personal information from children, and whether the revisions have had any negative consequences.
The FTC seeks comments on whether exceptions to parental consent are warranted for: 1) the use of education technology where a school provides consent for the collection of personal information from the child; or 2) the collection of audio files as a replacement for text, where the audio files are promptly deleted (as addressed in the FTC’s 2017 enforcement policy statement on this issue). Further, the FTC seeks comment on whether the definition of “Web site or online service directed to children” should be amended to cover websites and online services that have a large number of child users but do not otherwise meet the current definition).
The FTC noted its particular interest in comments addressing a variety of questions, including:
- Has the COPPA Rule affected the availability of websites or online services directed to children?
- Are there additional categories of information that should be expressly included in the definition of “Personal information,” such as genetic data, fingerprints, retinal patterns, or other biometric data? What about personal information that is inferred about, but not directly collected from, children?
- Does the COPPA Rule correctly articulate the factors to consider in determining whether a website or online service is directed to children, or should additional factors be considered? For example, should the COPPA Rule be amended to better address websites and online services that may not include traditionally child-oriented activities, but have large numbers of child users?
- Should the definition of “Support for the internal operations of the website or online service,” an important exception to notice and prior parental consent requirements for the use of persistent identifiers, be modified either to exclude more activities from its scope or to permit additional activities under it? For example, the FTC raises whether advertising attribution (i.e., measuring the effectiveness of an ad) should be included in the exception.
- What are the implications for COPPA enforcement raised by technologies such as interactive television, interactive gaming, or other similar interactive media?
- Should the Commission consider a specific exception to parental consent for the use of education technology in schools? Should education technology operators be able to use the personal information collected from children to improve the product?
- Should the Commission modify the COPPA Rule to encourage general audience platforms to identify and police child-directed content uploaded by third parties?
- Are there additional methods to obtain verifiable parental consent, based on current or emerging technological changes, that should be added to the Rule?
The FTC has published a Federal Register notice. Comments may be submitted by mail or online at www.regulation.gov for 90 days after the notice appears in the Federal Register.
The FTC is also hosting a public workshop about the rule on October 7, 2019 at the Constitution Center, where many of the same issues will be discussed. Those wishing to suggest topics or to participate as panelists can contact the FTC at COPPAWorkshop@ftc.gov.
Authored by Timothy Tobin, Laurie Lai, Catherine Essig and Marco Peraza (Summer Associate)
