U.S. Senator, Edward J. Markey, announced, on 12 March 2019, that he had introduced, together with U.S. Senator Josh Hawley, a bill (‘the Bill’) to amend the Children’s Online Privacy Protection Act of 1998 (‘COPPA’). The Bill includes provisions in relation to the online collection, use, and disclosure of personal information of children under the age of 13, and minors, which it defines as individuals over the age of 12 and under the age of 16. Moreover, the Bill prohibits internet companies from collecting personal and location information from children without parental consent and from minors without verifiable consent, and introduces fair information practices, including principles on collection limitation, data quality, purpose specification and racial and socioeconomic profiling.
Alan L. Friel, Partner at Baker & Hostetler LLP, told DataGuidance, “The Bill seeks to vastly expand strict privacy restrictions that apply to children, to minors. Further, it borrows from COPPA to treat websites which are directed or attractive [to children or minors], as per se restricted, and to require verified consent before collecting personal information. That would unduly burden sites and services that are not intended for young children but are, at least in part, appropriate for teens. A 15-year old’s interests, and what is attractive to them, is not materially different than what is of interest to older teens and even college students and adults. Think, [for example,] social media and mobile games. The line was drawn at under 13 for a reason; it marks a level of development below which added protection is appropriate. That is the same reason that there are laws and self-regulatory programmes that govern children’s advertising, where the line is drawn at roughly the same age – 12.”
Expanding COPPA-like restrictions to older teens will impact the ability of publishers to offer free, ad-supported content to teens and young adults
Furthermore, the Bill amends various COPPA definitions and introduces new ones, such as ‘connected device’, ‘mobile application’ and ‘targeted marketing’, the former of which it prohibits altogether for children, as well as for minors, unless they have provided verifiable consent. In addition, it requires operators to implement mechanisms that would allow users to erase submitted content or information that is publicly available and contains or displays personal information of children or minors. Finally, the Bill requires manufacturers of connected devices targeted to children and minors to prominently display on their packaging a privacy dashboard detailing how personal information is collected, transmitted, retained, used, and protected. Following this, the Bill prohibits the sale of such devices targeted towards children and minors unless they meet appropriate cybersecurity standards.
Friel concluded, “Interest-based advertising (‘IBA’) to children under 13 is already restricted under COPPA as it now stands, as well as under the advertising industry self-regulatory programmes. Raising the age to 16 will essentially cause sites and services attractive to teens and young adults to have to move to an opt-in approach to IBA, which is likely to disrupt the ad-supporting free access to these sites and result in more pay-to-play subscription and in-service purchase models. The result will be less content available to less wealthy teens and young adults […] The ‘eraser concept’ comes from the California Consumer Privacy Act of 2018, but here, it goes much further, not just by giving minors the right to remove their own posts, but also posts by others. Although likely well intentioned, expanding COPPA-like restrictions to older teens will impact the ability of publishers to offer free, ad-supported content to teens and young adults.”
NIKOS PAPAGEORGIOU Privacy Analyst