On August 1, 2012, The Federal Trade Commission (FTC) proposed to revise its regulations implementing the Children's Online Privacy Protection Act (COPPA) in what it calls an effort to keep current with technology. Several aspects of the new proposals should be of great concern to broadcasters, because they could hamper the ability of broadcasters to generate advertising dollars and create burdensome operational requirements.
COPPA, enacted in 1998, generally prohibits websites from collecting personal information or contact information from children under the age of 13 unless they first obtain prior verifiable parental consent. The requirement applies to websites that either have actual knowledge that children under 13 are using the site, or that are "directed" to such children, based on factors such as content, use of graphics, etc. Mechanisms to solicit and obtain such parental consent can be cumbersome to use, and as a result many publishers have chosen not to ask their website users for age information. Instead, they have sought revenue through contextual advertising that appears on their webpages and by means of advertising networks.
The FTC's proposals would change this in several ways. First, it would make operators of websites directed at children under 13 responsible for a plug-in, such as a Facebook "Like" button, that collects personal information directly from a child despite the operator having no ownership, control or access to the information collected by the plug-in.
Similarly, the proposal would also make websites more responsible for data collection by third-party advertising networks and make the advertising networks themselves "operators" for purposes of COPPA. This is because advertising networks set "persistent identifiers"—called "cookies"—that collect information about users as they browse across the Internet. This would, in practice, impose burdensome disclosure and consent verification obligations on broadcasters that use advertising networks.
Second, the FTC would broaden the definition of "personal information" to include an online screen name if it permits direct contact online. Also, the FTC would include any other form of "persistent identifier"—such as IP addresses or cookies—as "personal information" triggering COPPA obligations. This would be the first federal consumer privacy regulation that treats an IP address as personal information.
Third, the FTC would expand the websites subject to COPPA obligations by modifying the definition of a website "directed to children." One, the FTC would define a website "directed to children" as one that "knowingly targets" or that is "likely to attract" children under 13 as its "primary audience"— importantly, however, it does not define the term "primary." Two, the FTC's revision would also apply COPPA obligations on mixed audience sites that are "likely to attract an audience that includes a disproportionately large percentage of children under age 13 as compared to the percentage of such children in the general population." However, the FTC does not define "disproportionately."
Fourth, the FTC proposes to allow websites directed at children, but which attract a mixed audience, to offer COPPA protections only to children under 13, instead of to all site users, if the sites age-screen web visitors before collecting any other personal information such as name or email address. This proposal could require websites that contain substantial coverage of sports and music to redesign their sites to check age information at the outset.
Fifth, in a step that would ease the burden on websites, the FTC proposes to declare that certain data collection activity that provides "support for internal website operations" would not be considered the "collection" of personal information so long as the collected information is not used (or disclosed) to contact a specific individual for marketing or any other purpose. Such activity would include, for example, the serving of contextual advertising on a website, certain website analytics and authentication and personalization of the website services.
The FTC will accept comments on these proposals until September 10.
These proposals could have a significant impact on how broadcasters design and manage their sites, and materially affect their ability to generate revenue from site traffic.