FTC Seeks to Strengthen Privacy Protections of Children Online
On December 20, 2023, the Federal Trade Commission ("FTC") announced a Notice of Proposed Rulemaking ("NPRM") to revise the Children's Online Privacy Protection Act ("COPPA") Rule to reduce the amount of information collected, increase security of data, and require greater transparency with respect to personal information collected about children.
COPPA was passed into law by Congress with the aim of limiting the online collection of personal information from children under the age of 13 without parental consent. COPPA provided the FTC with enforcement authority and the power to adopt implementing regulations, pursuant to which the FTC promulgated the COPPA Rule in 1999, and further amended it in 2013. Spurred by changing use of technology by children, in 2019, the FTC announced another review of the COPPA Rule. The FTC received more than 175,000 comments and subsequently held a workshop in October 2019 to assess the potential amendment.
As reflected in the COPPA NPRM, the FTC seeks to further amend the COPPA Rule to cover or strengthen the following areas:
- Amend the definition of personal information to include biometric identifiers;
- Require separate opt-in consent to targeted advertising;
- Prohibit conditioning access to services on the disclosure of information to third parties;
- Prohibit collection of more information than is "reasonably necessary" as a condition to participating in a game or other activity, or offering of a prize;
- Require online notice disclosing the use of persistent identifiers to support internal operations, and the use of personal information to prompt or encourage use of a service;
- Codify existing guidance for education technology providers;
- Require safe harbor programs to publish membership lists and report certain information to the FTC to promote accountability;
- Strengthen data security requirements;
- Impose data retention limits and require maintenance of a data retention policy; and
- Prohibit secondary uses of personal information.
Comments to the proposed amendments must be received by the FTC within 60 days of when the COPPA NPRM is published in the Federal Register.
This follows recent approaches by some states to expand privacy protections over personal information relating to individuals under the age of 18. For example, the California Consumer Privacy Act, as amended, prohibits the sale of personal information of consumers under the age of 16 without first obtaining consent; California's Age Appropriate Design Code Act will regulate a wide variety of companies that provide online services, products, or features that are likely to be accessed by minors; and Utah's Social Media Regulation Act will specifically regulate the use of social media by minors.
On December 20, 2023, U.S. Senators Bill Cassidy and Edward Markey released a statement expressing support for the FTC's proposed amendments to the COPPA Rule. However, they also emphasized that Congress should pass the Children and Teens' Online Privacy Protection Act, also known as COPPA 2.0, to address similar concerns as these state laws.
