Home Data Getting Children’s Privacy Right Requires Opening Your Eyes

Getting Children’s Privacy Right Requires Opening Your Eyes

Young African kid using digital tablet

Data privacy is a hot topic, but children’s privacy is often kept on the backburner.


Compliance with child data protection laws is hard to get right because it involves determining the exact age of your audience – and playing by different rules accordingly.

Although the Children’s Online Privacy Protection Act (COPPA) is well into adulthood at 24 years old – it was passed in 1998 – the ad industry continues to struggle with the challenge of age verification.

“It’s tricky to determine how old someone is,” said Virginia Lee, Cisco’s privacy officer for the Americas, speaking at an International Association of Privacy Professionals event in Washington, DC, earlier this week.

“If you get it wrong, you’re screwed,” Lee said. “And it’s very easy to get it wrong.”

Who knows?

Staying on the right side of COPPA isn’t easy – and a mistake is very expensive. Businesses can be fined more than $40,000 per violation.

Yet COPPA also contains a knowledge exception, meaning the operators of general audience sites or apps are only covered by the law if they have actual knowledge that children under 13 are sharing their personal information without parental consent.

Companies that claim ignorance of how old their audience is can use the actual knowledge standard as a loophole.

It’s a bit of a head-scratcher. Some lawyers argue that getting rid of the knowledge exception and implementing stricter age verification obligations are what’s needed to make COPPA work more effectively.


AdExchanger Daily

Get our editors’ roundup delivered to your inbox every weekday.

Otherwise, the incentives are out of whack. Companies can either err on the side of caution (which can hamper growth) or turn a blind eye (which isn’t good for child privacy).

But companies generally do want to get this right. It’s rare to see a business actively push back against child safety guardrails, said Dona Fraser, SVP of privacy initiatives at BBB National Programs.

There have been exceptions, however.

Take TikTok. Before its rebrand in 2018, when the app was still called Musical.ly, parents sent in thousands of requests demanding the app delete their children’s data. When Musical.ly refused to do so, those requests became complaints, and TikTok was eventually fined millions by the Federal Trade Commission the following year.

But this story could have ended differently for TikTok, Fraser said, if it had taken into consideration the feedback it received from unhappy parents and used it to do better by its young audience.

But even if the complaints hadn’t provided Musical.ly with actual knowledge that children under 13 were using its service, as the FTC found, the app should have had “constructive knowledge” of the age of its audience.

Actual knowledge is when a company knows something definitively versus constructive knowledge, which is something a company is reasonably expected to know.

All Musical.ly would have had to do was Google itself to find scores of press reports about the popularity of its app with teens and young people.

Making use of constructive knowledge will help companies implement best practices and operate on the right side of the law even before they have actual knowledge of whether there are children under 13 in their audience.

“If you have a platform that wasn’t designed for children, but then [discover] they’re starting to use it, you have to [address] this,” Cisco’s Lee said.Comic: "Protect consumer privacy!"

The constructive knowledge standard is starting to catch on. It makes an appearance in the Kids PRIVCY Act, a bill introduced in the Senate last year that would require sites and services to get parental consent if they have actual or constructive knowledge that they’re processing child data. (PRIVCY stands for “Protecting the Information of our Vulnerable Children and Youth,” I kid you not.)

Aside from its comically overzealous acronym, the act’s emphasis on constructive knowledge could help address some of the endemic issues with COPPA, Fraser said.


But speaking of issues, the Kids PRIVCY Act has a few of its own.

For example, the bill aims to update COPPA by repealing the provisions that allow for industry self-regulation, Fraser said. Doing so, however, would also prevent companies from taking proactive steps to implement improvements to their own online platforms with children’s safety in mind.

Banning self-regulation could have “a chilling effect,” Lee said. Companies, looking to avoid a misstep, might stop providing meaningful online platforms for developing teens, she said.

And that would be both a shame and a disservice to young people.

“There’s harm in social media, but there’s also a lot of good that can [allow] teens to expand their worldviews rather than narrowing them,” said Kathryn Farrara, associate general counsel at Unilever.

It’s also difficult for legislation to be effective without including perspective from all of the parties involved.

Policies might “sound good and look good on paper,” Fraser said, “but what does it actually look like in practice? That’s our ask. If you want to require anything, require the industry to come together to work with legislators about education.”

And proactive self-regulation is a force for good, she said.

“Self-regulation has helped [implement] COPPA over the last 20 years,” said Fraser, who noted that BBB National Programs has conducted more than 200 investigations since the law was passed.

By comparison, she claimed, the FTC has conducted less than 40.

Must Read

Comic: TFW Disney+ Goes AVOD

Disney Expands Its Audience Graph And Clean Room Tech Beyond The US

Disney expands its audience graph and clean room tech to Latin America, marking the first time it will be available outside the US. The announcement precedes this week’s launch of Disney+ with ads in Latin America.

Advertible Makes Its Case To SSPs For Running Native Channel Extensions

Companies like TripleLift that created the programmatic native category are now in their awkward tween years. Cue Advertible, a “native-as-a-service” programmatic vendor, as put by co-founder and CEO Tom Anderson.

Mozilla acquires Anonym

Mozilla Acquires Anonym, A Privacy Tech Startup Founded By Two Top Former Meta Execs

Two years after leaving Meta to launch their own privacy-focused ad measurement startup in 2022, Graham Mudd and Brad Smallwood have sold their company to Mozilla.

Privacy! Commerce! Connected TV! Read all about it. Subscribe to AdExchanger Newsletters

Nope, We Haven’t Hit Peak Retail Media Yet

The move from in-store to digital shopper marketing continues, as United Airlines, Costco, PayPal, Chase and Expedia make new retail media plays. Plus: what the DSP Madhive saw in advertising sales software company Frequence.

Comic: Ad-ception

The New York Times And Instacart Integrate For Shoppable Recipes

The New York Times and Instacart are partnering for shoppable recipe videos.

Experian Enters The Third-Party Data Onboarding Business

Experian entered the third-party data onboarder market on Tuesday with a new product based on its Tapad acquisition.