COPPA isn’t a kid anymore. The law needs a refresh, like, yesterday.
The Children’s Online Privacy Protection Act, which applies to any online service directed at kids under the age of 13, has barely been updated since it was first enacted in 1998.
The law is older than Myspace, Friendster, Facebook, the first iPhone and YouTube. Google Search was still nascent in the late ’90s. TikTok wasn’t even a twinkle.
“Being a 13-year-old today is not the same as having been a 13-year-old in 1998,” said Dona Fraser, SVP of privacy initiatives at BBB National Programs, a self-regulatory body that helps enforce against misleading claims in advertising.
“And the way kids engage online today has very little to do with the way the internet looked 25 years ago,” Fraser said.
To be fair, the Federal Trade Commission, which enforces COPPA, did make a few revisions to the law in 2013 using its rulemaking authority, including expanding the definition of personal information to include persistent identifiers, geolocation data, photos and videos.
But although the FTC announced another COPPA rule review in 2019 and collected public comments, it hasn’t taken any further action, despite calls from Congress to do so. (Meanwhile, the commission appears to be waiting for Congress to pass an updated children’s privacy law before doing anything itself.)
In the interim, an outdated federal law remains on the books and states are starting to pass child-focused privacy and online protection laws of their own, including California, Utah and Arkansas.
Before taking on her broader role, Fraser spent nearly six years as director of the Children’s Advertising Review Unit (CARU), which operates under the umbrella of BBB National Programs and helps companies navigate and comply with regulations and guidelines that protect children.
AdExchanger spoke with Fraser.
AdExchanger: There’s been talk of raising the age of consent from 13 to 16 under COPPA. Does that make sense to you?
DONA FRASER: I never understood why 13 was the number under COPPA in the first place.
Although we don’t allow anyone under 18 to enter into a legal agreement in this country, we’re asking 13-year-olds to affirm they’ve read a privacy policy or terms of service, which are legal documents. People just seem to ignore that fact.
But raising the age brings up other questions.
For example, what does a 16-year-old – or a 13-year-old, for that matter – have in common with a 6-year-old? Teenagers deserve autonomy. They’re starting to make their own purchase decisions at that age, and they’re beginning to build loyalty with brands. Advertisers should be able to reach them responsibly.
But teenagers over 13 also deserve privacy protections.
Basically, I can make a case for why the age should be raised and why it shouldn’t.
No easy answers. But some states are taking action. The Age-Appropriate Design Code Act in California, for example, raises the age of consent from 13 to 17.
The US remains sectoral. There are conflicts between the states and the federal level, and I’d even argue that there are conflicts between CCPA, CPRA and the Age-Appropriate Design Code.
In the meantime, last year, we [BBB National Programs] launched something called TAPP [Teenage Privacy Program], which is a framework to help companies collect teenage data responsibly and create digital products and services that understand the risks facing kids in that age group between childhood and adulthood.
During his State of the Union Address in February, President Joe Biden specifically mentioned the need for lawmakers to address children’s safety online. To quote him: “It’s time to pass bipartisan legislation to stop Big Tech from collecting personal data on kids and teenagers online, ban targeted advertising to children and impose stricter limits on the personal data that companies collect on all of us.” Do you think that’s going to happen?
We’ll have to wait and see, but I will say this: If a federal data privacy law passes, that will automatically trigger an update to COPPA on any changes to the age requirement.
What do you think of the term “surveillance advertising”? Seems like it’s here to stay.
I’m not a fan. The word “surveillance” has a lot of implications. I feel the same way about “dark patterns.” These are phrases that some people use to instill fear instead of making the effort to educate.
This interview has been edited and condensed.
For more articles featuring Dona Fraser, click here.
