The FTC hosted a workshop last Wednesday aimed at determining whether the Child Online Privacy Protection Act of 1998 (COPPA) continues to remain effective in the ever-changing world of online privacy. COPPA generally prohibits the online collection of personal information from children under the age of thirteen--without notice and parental consent--where a website or online service is directed to children or the operator has actual knowledge of the collection of personal information from children. The FTC has frequently targeted companies for failing to develop or abide by privacy policies that adhere to COPPA guidelines.
Three out of the five panels in the FTC’s program poked and prodded the statutory text, testing its durability and flexibility in different contexts. The first panel examined the definitions of “internet,” “website,” and “online service,” finding that all three terms continue to adequately describe the kinds of media, changed though they may be, that COPPA intended to regulate. The panelists determined that the definition of “internet,” for example, not only continues to be technically accurate, but also encompasses such new developments as mobile browsing. “Online service” remains a capacious term, as Congress intended, that extends beyond the internet, having possible implications for text messaging and other emerging means of communication. (See a previous blog post on this topic here). Because many new services, such as interactive television, carry on the trend toward increased connectivity via the internet, COPPA continues to be widely applicable in new contexts. However, COPPA is still limited by an important caveat: where a website or online service is not operated for commercial purposes, COPPA doesn’t apply.
The second panel investigated the “actual knowledge” standard for operators of websites not otherwise directed to children. Described as an industry victory, Congress’s adoption of this standard in lieu of a more expansive “constructive knowledge” or “knowing” standard provided operators a greater degree of protection, requiring direct and clear knowledge of the collection of personal information from a child in order to trigger COPPA applicability. Panelists contested the adequacy of this standard in light of advertising developments such as behavioral targeting. Some panelists suggested that the term “actual knowledge” could stretch to cover effective knowledge of the age of targeted viewers from behavioral monitoring, potentially blurring the industry-protective line between actual and constructive knowledge embedded in the statute.
In a similar vein, the third panel addressed the question of whether “personal information” includes facts that separately fail to identify an individual (such as an IP address), but, when aggregated, may point to a specific person. The panelists arrived at no clear conclusions.
Whether any changes result from this discussion remains unclear. What does seem clear is that the FTC will continue its vigorous enforcement in this area.
