The Federal Trade Commission (FTC) has proposed a revamp of the rules that protect children from the ever-expanding reach of the surveillance economy. According to the proposed changes, companies would now require parental consent before sharing any data with advertisers and would be prohibited from holding onto said data for unspecified “internal operations,” among other restrictions.
“The proposed changes to the Children’s Online Privacy Protection Act (COPPA) are long overdue, especially in a time where online tools are vital for everyday life and corporations are utilizing increasingly advanced digital techniques to track children,” said FTC Chair Lina Khan in a blog post.
COPPA was first established in 2000 and has proven effective in preventing extreme cases of data collection and exploitation of children. However, the law has not been updated since 2013 and is in need of modernization. The FTC has sought input on the matter, receiving a significant number of comments from parents, educators, industry members, researchers, and others.
<p"In response to the FTC's announcement that it was considering revisions to the COPPA Rule, we received over 175,000 comments," the agency stated in a news release. "The proposed rule reflects the feedback we received from various parties, as well as our 23 years of experience enforcing COPPA."
The agency intends to release a Notice of Proposed Rulemaking (NPRM) soon, which is a preliminary draft of the new COPPA rules. This document will be open for public comment and criticism for the next 60 days. The exact date of its release depends on when it appears in the Federal Register, which is out of the FTC’s control but is expected to be within the next few weeks. In the meantime, a draft can be viewed here.
Here’s what the updated rule would entail:
- Parents must give opt-in consent before any sharing of a child’s information with third parties, unless the sharing is deemed essential to the service. This could lead to many features being categorized as “essential” in the future.
- A loophole that allowed “support for internal operations” will be narrowed. For example, Amazon previously exploited this exception by indefinitely retaining children’s information to enhance its voice recognition technology. This will hopefully occur less frequently under the new rule.
- “Nudges,” such as push notifications that encourage children to open apps or stay online, require more justifiable reasoning.
- Apps or features cannot demand personal data from children as a prerequisite for use (e.g. “provide your birthday to receive 100 free crystals”).
- Any data collected cannot be retained indefinitely and must serve its original stated purpose. In the case of Amazon, they may use a child’s voice command to launch an app (primary use), but cannot use it for any other purpose without explicit consent.
- Edtech providers can collect and utilize students’ personal information only with authorization from schools or school districts, for educational purposes only.
- The definition of “personal information” will now include biometrics.
- And several other changes, with more detailed information available in the NPRM itself. This may be of interest primarily to those directly affected.
If you’re curious about the necessity of these changes, or why COPPA is important in the first place, Commissioner Alvaro Bedoya published an explanatory piece that may provide some insight.
Senator Brian Schatz (D-HI) has applauded the FTC’s proposed update, stating that it is a “promising step towards implementing safeguards that safeguard the youngest users of social media against constant monitoring and manipulation.”
However, he also stated that “rulemaking cannot serve as a replacement for legislation – it is crucial for Congress to take action. We must urgently pass laws that safeguard children online by establishing minimum age requirements for social media usage and prohibiting algorithmic targeting for children and teenagers.”
Given the current state of Congress, and the possibility of a turbulent 2024 election, it is unlikely that the Senator’s sense of urgency will turn into a law anytime soon. The new FTC rules will likely remain in place for the foreseeable future.
