FTC Seeks Comments on Additional Proposed Revisions to Children's Online Privacy Protection Rule
LINK

The Federal Trade Commission is publishing a Federal Register Notice seeking public comments on additional proposed modifications to the Children's Online Privacy Protection Rule.

In updating the Rule to keep current with technology advances, in September 2011, the FTC issued a Notice of Proposed Rulemaking seeking comment on proposed changes to the Commission's COPPA Rule. The Commission received 350 comments. In response to those comments and informed by its experience in enforcing and administrating the Rule, the FTC now proposes to modify certain definitions to clarify the scope of the Rule and strengthen its protections for the online collection, use, or disclosure of children's personal information.

The proposed modifications to the definitions of "operator" and "website or online service directed to children" would allocate and clarify the responsibilities under COPPA when third parties such as advertising networks or downloadable software kits ("plug-ins") collect personal information from users through child-directed websites or services. The Commission proposes to state within the definition of "operator" that personal information is "collected or maintained on behalf of" an operator where it is collected in the interest of, as a representative of, or for the benefit of, the operator. This change would make clear that an operator of a child-directed site or service that chooses to integrate the services of others that collect personal information from its visitors should itself be considered a covered "operator" under the Rule.

The Commission also proposes to modify the definition of "website or online service directed to children" to:

Clarify that a plug-in or ad network is covered by the Rule when it knows or has reason to know that it is collecting personal information through a child-directed website or online service;

Address the reality that some websites that contain child-oriented content are appealing to both young children and others, including parents. Under the current Rule, these sites must treat all visitors as under 13 years of age. The proposed definition would allow these mixed audience websites to age-screen all visitors in order to provide COPPA's protections only to users under age 13; and,

Clarify that those child-directed sites or services that knowingly target children under 13 as their primary audience or whose overall content is likely to attract children under age 13 as their primary audience must still treat all users as children.

Finally, the Commission proposes to modify the Rule's definition of "personal information" to make clear that a persistent identifier will be considered personal information where it can be used to recognize a user over time, or across different sites or services, where it is used for purposes other than support for internal operations. In connection with this change, the Commission proposes to modify the definition of "support for internal operations" in order to explicitly state that activities such as: site maintenance and analysis, performing network communications, use of persistent identifiers for authenticating users, maintaining user preferences, serving contextual advertisements, and protecting against fraud and theft will not be considered collection of "personal information" as long as the information collected is not used or disclosed to contact a specific individual, including through the use of behaviorally-targeted advertising, or for any other purpose.

Because these changes diverge from those proposed in the September 2011 proposal, the Commission has determined they warrant additional public comment prior to finalizing the Rule.

Public comments on the Supplemental Notice of Proposed Rulemaking will be accepted until September 10, 2012. Instructions for submitting comments are found in the Notice. Comments can be submitted electronically by clicking here. The Commission vote approving the Federal Register Notice was 5-0.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC's online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 2,000 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s website provides free information on a variety of consumer topics. Like the FTC on Facebook, follow us on Twitter, and subscribe to press releases for the latest FTC news and resources.

MEDIA CONTACT:
Claudia Bourne Farrell
Office of Public Affairs
202-326-2181
STAFF CONTACT:
Phyllis Marcus or Mamie Kresses
Bureau of Consumer Protection
202-326-2854 or 202-326-2070
(COPPA supplemental)

FTC proposes tougher kids privacy rules
By Cecilia Kang, The Washington Post
LINK

The Federal Trade Commission said Wednesday it is considering online privacy rules that would make it harder for advertisers and social networks to collect information about children without permission from parents.

The FTC said its proposed rules would require third-party partners of Web sites, including “plug-ins” and ad networks, to ask parents for permission to collect information about users under 13 years of age.

Currently, sites aimed at children are required by law to ask a parent’s permission when collecting personal identifiable information such as e-mail addresses and names. But vague language in the 1998 Children’s Online Privacy Protection Act could allow so-called third parties like Facebook and Twitter, whose services are attached to numerous smartphone games, to avoid the parental consent process.

The consumer protection agency said it would take comments on the proposal for 30 days and then vote on them as part of a bigger overhaul of COPPA rules expected by the end of the year.

The revision of child privacy laws aims to catch up with advancing technology, by ensuring that advertisers and Web sites limit tracking of children who are increasingly online using smartphones and tablets.

The FTC said in its proposal that the 1998 COPPA law “did not foresee how easy and commonplace it would become for child-directed services to integrate social networking and other personal information collection features into the content offered to their users, without maintaining ownership, control, or access to the personal data.”

“Given these changes in technology the Commission now believes that an operator of a child-directed site or service that chooses to integrate into a site or service other services that collect personal information from its visitors should be considered a covered operator under the rule,” the FTC wrote in its notice.

Consumer privacy advocates have pushed for stronger rules than what has been drafted for vote by the FTC. They say advertisers can avoid behavioral advertising limits on children by attaching themselves to children’s sites without notifying parents and children clearly.

“Today, the FTC took a giant step to protect children's privacy by proposing that the online data broker industry be required to comply to the Children's Online Privacy Protection Act,” said Jeffrey Chester, executive director of the Center for Digital Democracy, a privacy advocacy group. “The commission will also rein in the data brokers targeting kids who use social media, so-called "plug-ins," to gather information on a child and their friends.”

correction 7:58 p.m. rules would require parent’s consent for children younger than 13.

Related:

Facebook mulls letting underage kids onto site

Parents help children lie to get onto Facebook

High-Tech vs. No-Tech at two schools

By Cecilia Kang