WASHINGTON — In an effort to bring outdated 20th-century federal rules protecting children’s online privacy into the smartphone era, the Federal Trade Commission last week proposed tougher rules to make it harder for data brokers to collect personal information such as email addresses without parental approval.
By pushing for more safeguards in a 1998 law called the Children’s Online Privacy Protection Rule, or COPPA, the FTC is acknowledging that the law essentially has been rendered outmoded, thanks to the explosive use of mobile devices by children and the proliferation of data-seeking companies trying to mine details of their online lives.
Fourteen years ago, the FTC said in a statement, “the commission did not foresee how easy and commonplace it would become for child-directed sites and services to integrate social networking and other personal information collection features into the content offered to their users, without maintaining ownership, control or access to the personal data.”
The proposed rules, which are open to public comment until Sept. 10, update the definition of “personal information” to require parental permission before identifiers such as IP addresses, which can be used to recognize a user over time or across different sites or services, could be collected while children surf the Internet.
“The FTC is signaling strongly that it understands how companies like Facebook and Google do business and how critical it is of the unregulated digital data broker industry,” said Jeffrey Chester, executive director of the Center for Digital Democracy, a privacy advocacy group. “This helps to bring COPPA into the 21st century.”
Google did not immediately respond to a request for a comment, but Facebook issued a statement saying, “Nothing is more important to Facebook than the safety and privacy of the teens who use our site, and we appreciated the opportunity to comment on the FTC’s proposed amendments to the Children’s Online Privacy Protection Rule (COPPA).”
“While Facebook’s policies prohibit children under the age of 13 from signing up for our service,” the statement continued, “we are committed to improving protections for all young people online and helping them benefit from new services and technologies. We commend the commission for leading this thoughtful review process and we look forward to evaluating its most recent proposal.”
As the law currently reads, websites targeted at children must seek parental permission before gathering personal information. But because of the law’s vague wording, so-called third parties such as Facebook and Twitter, who link their services to many smartphone games, can avoid that gatekeeper completely. The FTC has proposed rules that would force third-party partners of websites, including “plug-ins” and ad networks, to get parental consent before gathering data about users younger than 13.
By proposing that a parent’s approval would stand between data-mining companies and their young targets, the FTC will certainly get an earful during the comment period, said Lorrie Faith Cranor, an associate professor at Carnegie Mellon University who studies online privacy.
“The most controversial part of the proposal is that companies would need parental consent before they can do any behavioral advertising to children,” she said. “Most parents would love that. But the FTC is bound to get a lot of resistance from the companies. Their decision will be definitely controversial either way.”
