Antitrust Law Daily Wrap Up, PRIVACY NEWS: FTC Amends Children’s Online Privacy Protection Rule, (Dec 19, 2012)
By Tobias J. Gillett, J.D., LLM.
The FTC has adopted final amendments to its Children’s Online Privacy Protection Rule, in a 3-1-1 decision, with Commissioner Maureen Ohlhausen dissenting and Commissioner J. Thomas Rosch abstaining. The amendments to the Rule, issued pursuant to the Children’s Online Privacy Protection Act (COPPA), are intended to strengthen children’s privacy protections and give parents greater control over their children’s online activities, according to the FTC. The amended Rule takes effect on July 1, 2013.
The final amendments contain a range of revisions to the Rule, including:
Clarifying that the list of personal information that cannot be collected without parental consent under the Rule includes geolocation information, as well as images, videos, and audio files that contain a child’s image or voice.
Adding new methods for obtaining parental consent, including electronic scans of parental consent forms, video-conferencing, government-issued identification, and alternative payment systems, so long as they meet the FTC’s criteria, and providing a voluntary process for companies to obtain FTC approval of new means of obtaining parental consent. The Rule retains “e-mail-plus”—obtaining consent through a parental e-mail followed by a delayed confirmation e-mail, a letter, or a telephone call—for internal use of personal information only.
Restricting the ability of third parties to collect information from children through plug-ins on child-directed apps and websites, and extending the Rule’s coverage so that some of those third parties also must comply with the Children’s Online Privacy Protection Act. The Rule now covers child-directed websites that integrate third-party services that collect personal information from visitors, but not platforms that merely offer access to child-directed apps.
Expanding the scope of the Rule to cover plug-ins and ad networks that have actual knowledge that they are collecting personal information through a child-directed service. Services that target children only as a secondary audience only need obtain parental consent for users who identify themselves as younger than 13.
Requiring that covered online service providers must take steps to ensure that they release children’s information only to third parties that are capable of keeping it secure and confidential. Service providers must retain the information only as long as reasonably necessary, and must prevent unauthorized access to it.
Requiring parental consent before use of “persistent identifiers” that track users across different online services, unless a “persistent identifier” is collected solely for internal purposes and never disclosed, employed to contact an individual, or used to create a profile on an individual.
Revising the notice provisions to ensure that website privacy policies and direct notices to parents are concise and timely.
Mandating that website operators must adopt procedures for data retention and deletion.
Requiring approved self-regulatory “safe harbor” programs to audit their members and annually report the results of the audits to the FTC.
Permitting websites to allow children to participate in interactive communities without parental consent, as long as the children’s personal information is deleted without being made public.
“The Commission takes seriously its mandate to protect children’s online privacy in this ever-changing technological landscape,” said FTC Chairman Jon Leibowitz in a statement accompanying the amendments. “I am confident that the amendments to the COPPA Rule strike the right balance between protecting innovation that will provide rich and engaging content for children, and ensuring that parents are informed and involved in their children’s online activities.”
In a prepared statement, Senator John D. Rockefeller IV (D-WV), Chairman of the U.S. Senate Committee on Commerce, Science and Transportation, commended the FTC’s actions.
“Revising the regulations that govern the Children’s Online Privacy Protection Act – also known as the “COPPA Rule” – was long overdue,” Senator Rockefeller stated. “The FTC is proposing common sense updates to the COPPA Rule that better reflect the realities of the current online world.”
Dissent
Commissioner Olhausen issued a dissenting statement questioning the extension of the rule “to reach child-directed websites or services that merely derive from a third-party plug-in some kind of benefit, which may well be unrelated to the collection and use of children’s information.” Commissioner Olhausen articulated her position that the application of the Rule to child-directed websites or online services that receive “any kind of benefit from using a plug-in,” rather than just “to the collection of personal information by the third-party plug-in on behalf of the child-directed site[s] or online service[s]” may exceed the FTC’s authority under COPPA.
News: Privacy FederalTradeCommissionNews