For years, plausible deniability was the online ad industry’s de facto workaround for dealing with children’s privacy.
The concept of “actual knowledge” under the Children’s Online Privacy Protection Act quietly set the bar. As long as an operator wasn’t provably aware that it was collecting personal information from children under 13, it could keep treating that traffic as general audience.
Sticking your head in the sand was a semi-viable strategy. Not a good one, but a lot of folks did it, because they were incentivized not to look too hard, says Julie Rooney, chief privacy officer and deputy general counsel at OpenX.
But that’s getting a lot harder to pull off with the FTC’s recent update to the COPPA Rule – the enforcement deadline passed on April 22 – and as more states chime in with their own youth privacy laws.
“We’re seeing a huge wave of new rules aimed at children and teens,” Rooney said, “and the common theme is that not knowing who’s in your audience isn’t good enough anymore.”
But that’s where a lot of the commonality ends. You know the saying that states are the laboratories of democracy? Well, it’s especially true for US children’s privacy laws.
Some state laws treat anyone under 16 as a minor, while other laws also apply to age 17 or even 18. A few, like Maryland, ban the sale of personal data and targeted advertising to minors altogether. Others still allow targeting, but only under stricter conditions and with consent.
And then there are the age verification laws that require sites and app stores to check who’s a minor before unlocking certain features.
“It’s getting really, really complex,” Rooney said.
I caught up with Rooney to talk about what this flurry of activity means in practice for intermediaries and the wider ad tech ecosystem.
AdExchanger: How big of a lift was it to get ready for the new COPPA Rule?
JULIE ROONEY: The COPPA updates weren’t a massive shift. They expanded and clarified some things, but I’d say these were some of the more straightforward changes in the children’s space over the last couple of years.
For example, the FTC issued a policy to clarify that if you’re doing age gates or age checks in good faith and not using that data for anything else, they’re not going to treat that alone as a COPPA violation.
That kind of guidance is important. But, for us, getting ready was mainly about reviewing what we already had in place and making sure we were in good shape.
How does liability work in the supply chain if a publisher using your platform is out of compliance?
COPPA has high penalties, and the framework is built around what a company knows about a user’s age. The actual knowledge standard means that, to be liable, you need to actually know you’re dealing with someone under 13. Newer privacy laws are experimenting with “should have known” standards, but COPPA didn’t go that far.
For intermediaries, the FTC has suggested that you can’t just take a publisher completely at their word if you’re reviewing their properties. If you’ve seen a site that’s clearly child‑directed and subject to COPPA, you can’t ignore it. That’s why we take a more aggressive approach on our exchange and work with a vendor that looks at app and site content to flag likely child‑directed properties, instead of relying only on publisher self‑attestation.
Are there any standards for sending compliant signals and labeling child-directed inventory?
There are signals, but they’re limited. The COPPA RTB signal has been around for a long time, but it’s binary. In practice, a lot of DSPs just drop or refuse that traffic, which can discourage people from sending the signal at all.
The IAB’s Global Privacy Platform introduces more granular signals for things like children’s data and sensitive data, but it’s new and pretty complex, so it hasn’t seen broad adoption yet. Our view is that you need a more vetted and auditable system rather than a single yes/no flag nobody really revisits.
That’s why we’re in the very early stages of building a dedicated marketplace for this kind of inventory.
Can you tell me more about the marketplace?
Historically, it’s been very hard to monetize genuinely child-directed content programmatically. Everyone is nervous about the risk, and there hasn’t been a good, trusted channel for it, so a lot of buyers just avoid that traffic.
The marketplace we built is specifically for children’s data and teens where we vet the publishers and their content. We make sure it’s high quality and that they’re following the right regulations, and we have them send that traffic to us through a separate channel. On the other side, we only make it available to vetted advertisers, and we have external oversight through a COPPA Safe Harbor program.
That’s where we think things need to go. Otherwise, people will stop making this type of content. You might be able to find it on YouTube Kids or whatever, but I think there should also be other channels available.
Zooming out, what’s your read on the KIDS Act, which recently passed the House?
The KIDS Act is interesting, because it moved very quickly through the House and with a pretty overwhelming majority, which is rare.
Substantively, it fits into the same family as some of the other federal bills we’ve seen. It would extend protections up to teens, put real limits on targeted advertising to minors and require more protective default settings around addictive design features, like autoplay and infinite scroll.
The fact that it’s moved this fast and with that level of support gives it more traction than some of the earlier proposals, but there’s still a lot of work to be done in the Senate.
The final shape is very much an open question.
What’s your under-over on the KIDS Act becoming law within the next two years?
I’d probably put it at maybe around 60%? It’s hard to predict, but I think there’s a real chance.
Is protecting children’s privacy online basically the only thing folks on both sides of the aisle can agree on?
Privacy more broadly has some bipartisan support, but once you get into the specifics, things get harder. With children’s privacy, there’s much more alignment. It’s one of the clearest areas of bipartisan agreement right now.
This interview has been lightly edited and condensed.
🙏 Thanks for reading! As always, feel free to drop me a line at allison@adexchanger.com with any comments or feedback. And please also watch this heartwarming interaction between an adventure cat and an adorable little girl.
For more articles featuring Julie Rooney, click here.
