Lawmakers are busy playing politics, and it’s getting in the way of creating safety guardrails for children’s privacy online.
But let me back up first.
On Thursday, the Federal Trade Commission held an open meeting to publicly present its proposed changes to the Children’s Online Privacy Protection Act (COPPA) Rule. The law has been in effect for more than 20 years – and the FTC’s COPPA Rule, which explains what businesses need to do to comply, hasn’t been updated since 2013.
The FTC is proposing the following changes:
- Online services must turn off targeted advertising for children under 13 by default.
- They also must collect separate, verifiable opt-in consent from parents before sharing any personal information with third parties, including advertisers.
- Online platforms must create children’s data privacy and retention policies that name third parties receiving collected data and how that data is being used.
If the proposal passes – which requires a lengthy procedural process – apps would no longer be allowed to send push notifications to “nudge and manipulate children into habitual interactions with their services.” That’s how Commissioner Rebecca Slaughter phrased it during Thursday’s meeting. The more time a child spends in an app, the more opportunities a service has to collect information about that child.
Filling in the blanks
The FTC also wants to close loopholes in the COPPA Rule by narrowing an exception that allows online services to track children’s activity online with persistent identifiers for noncommercial purposes, such as fraud prevention. Sites and apps that still meet the narrowed exception (such as certain educational services) would only be able to retain data until they’ve achieved their intended purpose.
Now, you might be thinking: Wait, these specifications don’t already exist under COPPA?
Nope.
As FTC Chair Lina Khan put it: “The COPPA Rule has helped provide some baseline privacy and security protections for kids’ data.”
“Baseline” is the right word.
While the FTC did make some updates to the rule in 2013, like broadening the definition of personal information to include persistent identifiers and geolocation information, these don’t address the need for valid consent, data retention limits or disclosures about what actually happens to the data that platforms collect from kids.
Online companies have developed “more sophisticated tactics for harvesting people’s personal information,” Khan said, and the FTC needs to “ensure COPPA’s protections are keeping up with the times.”
Not my problem
But, seriously, why has the FTC waited 10 years to take action?
Well, the commission and Congress have been passing the responsibility for devising privacy-related protections back and forth like a hot potato.
Congress has been calling on the FTC to update the COPPA Rule since before 2019, which is when the commission started collecting feedback about the law from tech providers, publishers, academics and advertising industry trade groups. Meanwhile, the FTC has been waiting on Congress for just as long to pass an updated children’s privacy law before taking any definitive action itself.
But there’s also been disagreement between FTC commissioners themselves.
Before he resigned in late 2022, Republican Commissioner Noah Phillips publicly expressed that privacy-related rulemaking belongs in a legislative branch (Congress), not an administrative one (the FTC). Republican Commissioner Christine Wilson also cited the FTC overstepping as her reason for very vocally stepping down in 2023.
Now, only Democratic commissioners remain: Rebecca Slaughter, Alvaro Bedoya and, of course, Chair Khan.
When Commissioner Wilson resigned last year, privacy professionals noted that until the FTC becomes bipartisan once again, its actions could be perceived as biased and, therefore, less legitimate. But experts also agree that a single political party in power at the FTC means the rulemaking process will move far more quickly without all the infighting and politicking.
And it looks like they were right. Less than one year after losing its last Republican commissioner, the FTC’s COPPA Rule proposals are here.
Naturally, as a government agency, the FTC should – and will – regain its bipartisan status once Republican commissioners are finally confirmed.
What’s less certain is whether Congress will act to update COPPA itself.
And until that happens, the FTC is using what authority it does have to amend the COPPA Rule.
Playtime is over.
“Data-Driven Thinking” is written by members of the media community and contains fresh ideas on the digital revolution in media. This column is part of a series of perspectives from AdExchanger’s editorial team.
Follow Alyssa Boyle (@Alyssa_writes_) and AdExchanger (@adexchanger) on Twitter.
For more articles featuring Alyssa Boyle, click here.
