On August 1, 2012, the Federal Trade Commission (“FTC”) issued its supplemental Notice of Proposed Rulemaking (“NPRM”) in connection with its Children’s Online Privacy Protection Rule (“COPPA Rule”) review.5 The NPRM proposes additional modifications to the COPPA Rule’s definitions of terms: “operator,” “personal information,” “screen name,” “support for internal operations,” and “website or online service directed to children.” The FTC will be taking comments until September 10, 2012.
This NPRM follows and modifies the FTC’s earlier proposed rule (“Proposed Rule”), issued in September 2011, to amend the FTC’s current COPPA Rule. The COPPA Rule applies to operators of commercial websites and online services directed to children under age 13 that collect, use, or disclose personal information This NPRM follows and modifies the FTC’s earlier proposed rule (“Proposed Rule”), issued in September 2011, to amend the FTC’s current COPPA Rule. The COPPA Rule applies to operators of commercial websites and online services directed to children under age 13 that collect, use, or disclose personal information from children, and to operators of general audience websites that have actual knowledge that they are collecting, using, or disclosing personal information from children under age 13. The COPPA Rule provides parents with tools to control how personal information about their children is collected online.
When the Commission released the Proposed Rule, it explained that it was seeking to update the regulation to help ensure that it continues to protect children’s privacy online as technologies evolve. In its proposal, the FTC explained that the COPPA Rule would continue to apply to children under age 13. Additionally, the Commission noted that the regulation would still only apply to general audience websites and online services when operators have actual knowledge that they are collecting personal information from children.
The Proposed Rule includes several proposed amendments to the COPPA Rule, including among others the FTC’s proposals to:
- Expand the definition of “collection”;
- Consider the presence of child celebrities and celebrities who appeal to children as factors when determining if a website or online service is directed to children;
- Modify required online privacy policies and direct parental notices;
- Eliminate the sliding scale approach to obtaining verifiable parental consent;
- Create a Commission approval process for identifying new means of obtaining verifiable parental consent;
- Place data security obligations on service providers;
- Implement new data retention and deletion requirements; and
- Include audit and reporting requirements for self-regulatory safe harbor programs.