FTC’s New COPPA Rule Expands Children’s Online Privacy Obligations
In December 2012, the Federal Trade Commission (FTC) released amendments to its Children's Online Privacy Protection Rule (Rule). The amended Rule will take effect on July 1, 2013 and could have a dramatic impact on operators of websites or online services that could be used by children. In certain instances, operators may be held responsible for the practices of third parties that place advertising or provide services through the operator's website or app.
The Rule implements the Children's Online Privacy Protection Act (COPPA). In sum, the statute requires that operators of websites or online services that are either directed to children under 13 or have actual knowledge that they are collecting personal information from such children give notice to parents and obtain their prior verifiable consent.
The amended Rule aims to update children's online privacy protections in light of changes in online practices since 2000, when the Rule originally went into effect. As detailed further in a Wiley Rein summary entitled “New FTC Children's Privacy Rules May Impact Financial Support for Broadcaster Websites and Apps,” the Rule:
- Expands the critical definition of “personal information” that cannot be collected without parental notice and consent to include geolocation information, photographs and videos, as well as persistent identifiers (including IP addresses and mobile device IDs) that can be used to recognize a user over time and across different sites or online services. Certain important exceptions and qualifiers may apply, especially to support “internal operations.”
- Expands the key definition of “operator” to place strict liability obligations on companies that direct a site or service to a child when a third-party service—such as a plug-in or advertising network—collects personal information from visitors. The FTC characterizes this amendment in a press release as “clos[ing] a loophole.”
- Expands the key definition of “website or online service directed to children” to place obligations directly on plug-ins or advertising networks that have actual knowledge of collecting personal information through a child-directed site or service. Only sites and services that do not target children as a “primary” audience may “differentiate among users.” Such sites must provide notice and obtain parental consent for those users who identify themselves as being younger than 13.
- Imposes new “just in time” parental notice requirements.
- Retains the popular “email plus” method for obtaining “verifiable parental consent” and identifies certain new acceptable methods.
- Imposes requirements to reasonably secure children's personal information, to conduct due diligence before disclosing such information to third parties and to delete such information after it is no longer “reasonably necessary.”
- All businesses operating online should review their practices in light of the new Rule. With the amendments, COPPA will cast a much wider net, reaching companies that may not consider themselves to be interacting online with children. COPPA enforcement by the FTC will remain active, imposing monetary penalties and reputational risks.