Antitrust Law Daily Wrap Up, PRIVACY NEWS: FTC’s COPPA Rule amendments take effect, FTC extends safe harbor programs, (Jul 1, 2013)

By Tobias J. Gillett, J.D., LL.M.

The FTC’s amendments to its Children’s Online Privacy Protection Act Rule took effect today, and the agency will continue five safe harbor programs under the Rule, the FTC has announced.

The FTC intended its revisions to the Rule to respond to changes in the ways in which children use and access the Internet, such as through mobile devices and social networking, and to give parents greater control over the collection of their children’s information online. Among other changes, the revised Rule expands the definition of personal information to include persistent identifiers, such as cookies, that can be used to track a child’s activity online, as well as geolocation information, photographs, videos, and audio recordings.

COPPA permits certain organizations to establish compliance programs for their members. Under these safe harbor programs, participating companies will generally be subject to the program’s review and disciplinary procedures rather than FTC investigation and enforcement. Now that the COPPA Rule revisions have become effective, the FTC will continue five current safe harbor programs, including those offered by Aristotle International, Inc., the Children’s Advertising Review Unit of the Council of Better Business Bureaus, ESRB Privacy Online, TRUSTe, and Privo, Inc.

“At the FTC, protecting children’s privacy is a top priority,” said FTC Chairwoman Edith Ramirez. “The updated COPPA rule helps put parents in charge of their children’s personal information as it keeps pace with changing technologies.”

The FTC has also released two pieces of guidance intended to help small businesses comply with their obligations under the COPPA Rule, including a document entitled “The Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business” and a video, labeled “Protecting Children’s Privacy Under COPPA,” explaining the changes. In addition, the FTC has published an updated guide for parents, called “Protecting Your Child’s Privacy Online,” to help them understand COPPA and how to protect their children online. The FTC also regularly updates a set of frequently asked questions about the Rule, and has a COPPA Hotline e-mail address, COPPAHotline@ftc.gov, that businesses can use to send questions about how to comply with the Rule.

The COPPA Rule implements the Children’s Online Privacy Protection Act of 1998, which requires operators of websites and online services that direct their services to children under age 13, or know that they will collect personal information from children under age 13, to provide notice to parents and obtain their verifiable consent before collecting, using, or disclosing the information, and to keep the information secure. The FTC’s amendments to its COPPA Rule contain a variety of changes, including:

• Clarifying that the list of personal information that cannot be collected without parental consent under the Rule includes geolocation information, as well as images, videos, and audio files that contain a child’s image or voice.

• Adding new methods for obtaining parental consent, including electronic scans of parental consent forms, video-conferencing, government-issued identification, and alternative payment systems, so long as they meet the FTC’s criteria, and providing a voluntary process for companies to obtain FTC approval of new means of obtaining parental consent. The Rule retains “e-mail-plus”—obtaining consent through a parental e-mail followed by a delayed confirmation e-mail, a letter, or a telephone call—for internal use of personal information only.

• Restricting the ability of third parties to collect information from children through plug-ins on child-directed apps and websites, and extending the Rule’s coverage so that some of those third parties also must comply with the Children’s Online Privacy Protection Act. The Rule now covers child-directed websites that integrate third-party services that collect personal information from visitors, but not platforms that merely offer access to child-directed apps.

• Expanding the scope of the Rule to cover plug-ins and ad networks that have actual knowledge that they are collecting personal information through a child-directed service. Services that target children only as a secondary audience only need obtain parental consent for users who identify themselves as younger than 13.

• Requiring that covered online service providers must take steps to ensure that they release children’s information only to third parties that are capable of keeping it secure and confidential. Service providers must retain the information only as long as reasonably necessary, and must prevent unauthorized access to it.

• Requiring parental consent before use of “persistent identifiers” that track users across different online services, unless a “persistent identifier” is collected solely for internal purposes and never disclosed, employed to contact an individual, or used to create a profile on an individual.

• Revising the notice provisions to ensure that website privacy policies and direct notices to parents are concise and timely.

• Mandating that website operators must adopt procedures for data retention and deletion.

• Requiring approved self-regulatory “safe harbor” programs to audit their members and annually report the results of the audits to the FTC.

• Permitting websites to allow children to participate in interactive communities without parental consent, as long as the children’s personal information is deleted without being made public.

News: Privacy FederalTradeCommissionNews