Feds eye update to rules governing kids’ privacy
WASHINGTON» Federal regulators this week began considering ways to update and potentially expand enforcement of the country’s online privacy law for children, questioning whether swift advances in technology have outpaced rules meant to protect kids younger than 13.
The effort by the Federal Trade Commission is in its initial phases, but the agency’s reevaluation of the Children’s Online Privacy Protection Act, or COPPA, eventually could lead to tougher enforcement of the 1998 law against apps and websites that illegally collect personal information from younger users.
“In light of rapid technological changes that impact the online children’s marketplace, we must ensure COPPA remains effective,” said FTC Chairman Joe Simons in a statement.
Among the FTC’s concerns are websites, video games and other services that aren’t explicitly marketed for children but still attract large numbers of kids anyway. An FTC investigation into YouTube that’s now underway originated with complaints from consumer groups, which argued the Google-owned streaming site violates COPPA through its large number of highly popular channels featuring content for young children, such as nursery rhymes and cartoons. YouTube says the site is not intended for children.
COPPA prohibits companies from collecting kids’ data in most circumstances or targeting them with personalized advertising, but the law applies only to websites or apps that are directed at children or have “actual knowledge” that users are under 13. Consumer and privacy groups long have complained this has allowed YouTube, Instagram, Snapchat, Fortnite and others to avoid the legal restrictions of COPPA, despite polling and other evidence showing they are popular with preteens.
In response, the FTC is seeking comment on how it might update its rules for enforc
ing COPPA to address the potential gap. The commission also seeks to determine if COPPA sufficiently covers newer technologies, including smart televisions, educational technologies and interactive games, which could include such new, massively popular titles such as Fortnite. The issues are among the 29 questions the agency posed for public comment in the Federal Register, the first step in what could be more than a year of work that leads to an update in the ways COPPA is enforced.
The FTC’s five commissioners — three Republicans and two Democrats — voted unanimously to initiate the review, which came as a surprise to some consumer advocates but illustrates that their complaints about the limits of COPPA have garnered attention at the FTC.
“I can only speculate that in trying to determine whether companies were violating COPPA, it became clear that there were many situations where the rules were ambiguous, did not clearly cover privacy invasive conduct or were simply ineffective,” said Angela Campbell, a law professor at Georgetown University who represents a coalition of consumer advocates and privacy groups that have filed FTC complaints about alleged COPPA violations by several technology companies.
Mark Eichorn, an assistant director at the FTC’s Division of Privacy and Identity Protection, said the commission has heard the “frustration from (privacy) groups that the statute and the rule don’t really account for those sites that certainly are not directed to kids, they’re not intended to be directed to kids, but they know they have a significant number of kids on there.”
The FTC’s new efforts to update COPPA come as lawmakers on Capitol Hill continue to push for a legislative overhaul of the law. Legal experts say that COPPA has limitations built into the statute that could make meaningful expansion of its reach difficult without action from Congress.
One bill by Democratic Sen. Ed Markey of Massachusetts and Republican Sen. Josh Hawley of Missouri, for example, would expand it to cover kids up to age 15 and also broaden the definition of covered companies to include those with demonstrably large numbers of underaged users — even if there is not “actual knowledge” about a particular user’s age. In a statement Thursday, Markey said an FTC update “will not eliminate the dire need for Congress to pass” the bill.
“But if the commission is truly serious about protecting young people online, it will enforce existing protections, hold violators accountable no matter how powerful they are, and act as a forceful check against the ever-increasing appetite for children’s data,” he added.
Under Simons, the FTC has sought to increase its enforcement of children’s privacy rules. In February, the commission took aim at the social media app Musical.ly — now known as TikTok — for allegations that it illegally collected the names, email addresses, pictures and locations of kids under 13. The settlement included a $5.7 million financial penalty, a record for a COPPA violation at the FTC. TikTok is also now under investigation in the United Kingdom.
“Our recent enforcement action involving TikTok, which is a rapidly growing social media product in this country and throughout the world, demonstrates our focus on new trends we’re seeing and our desire to protect children consistent with COPPA,” said Noah Phillips, a Republican FTC commissioner.
“My view is that we are hearing enough from all sorts of stakeholders, and we’re seeing changes in the market,” he added, “and so expedited review of this rule is warranted.”
When COPPA first passed, there was no YouTube, no Facebook and no iPhone, and the commission has struggled to keep pace with rapidly advancing technology while applying a law more than two decades old. The FTC did extensive updating to its rules regarding COPPA enforcement beginning in 2010, expanding several definitions of personal data to include videos, photos or voice clips.
News that the FTC was considering another overhaul to COPPA prompted some anxiety among consumer and privacy advocates, who expressed worry that the process could lead to the weakening of enforcement or other accommodations to technology companies.
“The biggest problem with COPPA is not the rules — it’s the lack of enforcement, a problem which could be solved immediately without a lengthy comment period and proceeding,” said Josh Golin, executive director of the Campaign for a Commercial Free Childhood, an advocacy group based in Boston. “In addition, many of the questions the commission is asking suggest they are considering loosening the rules to the benefit of Big Tech.”