The Federal Trade Commission (FTC) has announced that it is seeking public comments on proposed amendments to the Children’s Online Privacy Protection Rule (COPPA), which aims to protect the personal data of children under 13 years old online. The proposed changes would further limit certain websites and online services from using and monetizing children’s data, and give parents more control over their children’s online activities.
COPPA was enacted by Congress in 1998 and implemented by the FTC in 2000. It requires operators of websites or online services that are directed to children under 13, or that have actual knowledge that they are collecting personal information from children under 13, to obtain verifiable parental consent before collecting, using, or disclosing such information. COPPA also requires operators to post clear and comprehensive privacy policies, to provide parents with access to their children’s data, and to maintain reasonable security measures to protect the data.
COPPA is important because it recognizes that children are more vulnerable to online privacy risks than adults, and that parents have the right and responsibility to protect their children’s online privacy. COPPA also helps to prevent online services from exploiting children’s data for commercial purposes, such as targeted advertising, behavioral profiling, or location tracking.
What are the proposed changes to COPPA?
The FTC has proposed several changes to COPPA to address the evolving online landscape and the challenges posed by new technologies and business practices. Some of the key proposed changes are:
- Expanding the definition of “personal information” to include biometric data, such as facial recognition or voiceprints, and persistent identifiers, such as cookies or device identifiers, that can be used to track children’s online activities over time and across different platforms.
- Clarifying that COPPA applies to general audience platforms that host child-directed content, such as YouTube or TikTok, and requiring them to treat all users as children under 13, unless they have reliable age-verification mechanisms.
- Requiring operators to obtain parental consent before collecting geolocation data that is precise enough to identify a street name and city or town, or before collecting personal information from children’s audio or video files, such as voice recordings or live streams.
- Strengthening the parental consent methods and the safe harbor programs that operators can use to comply with COPPA, and encouraging the development of new consent mechanisms, such as common consent platforms or blockchain-based systems.
- Updating the data retention and deletion requirements to ensure that operators keep children’s data only for as long as reasonably necessary, and delete it securely when no longer needed.
- Increasing the civil penalties for COPPA violations, and enhancing the FTC’s enforcement authority and cooperation with other agencies and foreign counterparts.
How can the public comment on the proposed changes to COPPA?
The FTC is seeking public input on the proposed changes to COPPA until February 18, 2024. The public can submit comments online at this link, or by mail to the following address:
Federal Trade Commission, Office of the Secretary 600 Pennsylvania Avenue N.W., Suite CC-5610 (Annex B) Washington, DC 20580
The FTC will also hold a public workshop on March 9, 2024, to discuss the proposed changes and hear from various stakeholders, such as industry representatives, consumer advocates, academics, and policymakers. The workshop will be webcast live on the FTC’s website.
The FTC will consider the public comments and the workshop discussions before issuing a final rule, which is expected to take effect later in 2024.