Children’s Privacy: Federal Regulations Are About To Change

In 1998, Congress enacted the Children’s Online Privacy Protection Act (“COPPA”) to protect children’s privacy. We’re now awaiting the release of the third version of the FTC’s COPPA regulations, as to which comments closed on March 11, 2024. In light of the revolution in privacy laws since COPPA was enacted, it’s worth looking at the likely changes we’ll see.

Is Your Website “Directed to Children” Under 13?

None of this matters unless you operate a website or provide an online service that is “directed to children” under the age of thirteen. Under COPPA, however, this is a holistic, i.e., mushy, question. And general businesses have gotten caught in the crosshairs.

The FTC looks at the subject matter of the site, including the nature of the audio and visual content, the use of animations, child-oriented activities, the age of models, etc., as well as any other information it deems relevant. The FTC’s latest actions make clear that this can include a deep dive into how you describe the site and its audience internally and to third parties. Expect far-ranging document demands if your company ends up in the sights of federal investigators.

One of the more difficult issues is whether a site meant to reach an audience of older children (say, over sixteen) could nonetheless be deemed to be directed to children under thirteen. The short answer is, maybe. In such cases, the FTC expects you either to demonstrate to its satisfaction that the site isn’t “directed to children under thirteen,” including potentially through the use of an age-gating mechanism, or to apply COPPA protections to any visitors under 13.

Age-gating mechanisms, which the FTC will continue to allow, cannot default to a certain age or entice visitors under the age of thirteen to lie about their age.

The FTC appears to have resisted pressure to expand the reach to websites which, based on overall content, are “likely to attract a disproportionately large percentage of children under age 13 …” This may be a pyrrhic victory, as the FTC took the occasion to emphasize that a determination of whether a website is directed to children under 13 includes reviewing “competent and reliable empirical evidence regarding audience composition.”

On what might seem to be a more positive note, the FTC is open to an exception to COPPA where a website operator “undertakes an analysis of the site’s … audience composition and determines that no more than a specific percentage of users are likely to be under 13.” The devil, of course, is in the details, and the FTC has solicited comments on those details, including how this assessment could be made reliably and the appropriate percentage to use as a threshold.

If such a self-assessment is ultimately permitted, I would recommend caution before undertaking it. Among other things, there is no practical way of keeping the results confidential from the FTC if an investigation takes place, even if you take pains to conduct such analysis on a privileged basis under the direction of outside counsel. The results of such a survey could poison your ability to claim that COPPA doesn’t apply.

Another federal agency once said the quiet part out loud: “We assume materials withheld on grounds of privilege are harmful to your client’s position.”

Proposed Modifications to the Federal Children’s Privacy Requirements

If your website is subject to COPPA, there is a lot to digest in the new proposed rules and accompanying FTC commentary on children’s privacy, including:

• The definition of “Personal Information” is expanded to include children’s information obtained from third parties which have, in turn, obtained it from other sources. This is intended to close a “loophole” for information aggregators who may not, themselves, have collected such information.
• The FTC underscored that persistent identifiers constitute personal information even if they are not connected to a person’s identity. Parental consent will be required for the disclosure of such identifiers to third parties for advertising.
• Personal information will include a wide variety of biometric information.
• The amended regulation will limit the use of personal information, including identifiers like cookies, through machine learning or otherwise, to enhance site usage by or advertising to children under 13. Expect more regulations.
• Gives greater latitude to schools to permit website information collection, and without prior notice to parents. Parents will be informed through generic, after the fact disclosures in school privacy disclosures. No parental opt-out mechanism so far. While cloaked in language seeking to address difficulties experienced by schools, the exclusion of parents from the consent equation could be subject to challenge.
• New data retention and deletion requirements.
• The mandatory identification of third parties with whom data is shared and separate consent for disclosure made for targeted advertising.
• Would allow collection of cellphone numbers before consent if collected solely to obtain parental consent.
• Prohibitions on “dark patterns” and other efforts to nudge additional usage by children, driven by a view that children “overuse” online services and websites.
• Requiring that parents be given the option of collection without disclosure to third parties.

Children’s Privacy: Further Complications On the Horizon

As you might have guessed, it won’t be long before state laws proliferate on children’s privacy. California already enacted such a law, California Age-Appropriate Design Code (CADC), but its enforcement was enjoined based on the likelihood that it violated the First Amendment. An appeal is currently briefed and pending before the United States Court of Appeals for the Ninth Circuit.

Florida has enacted its own law aimed at protecting children’s online privacy, effective July 1, 2024, as well as a newer law limiting the ability of children to have social media account. More will surely follow.

You may have noticed a trend in all of these privacy laws. The major concern is advertising and marketing to children, with scant attention paid to the misuse of information for nefarious purposes. You’ll also note that the government appears to have gotten a pass. I’ll hold off on my editorializing — for now. If you’re caught in the investigative crosshairs, griping won’t get you anywhere. But the First Amendment might. Stay tuned.