Yesterday, the FTC announced it would not delay the July 1, 2013 date for implementation of the updated Children’s Online Privacy Protection Rule (COPPA). (Link to Commission Letter). The Commission noted that implementation of the updated rule marks the culmination of a three-year process and that during that period, the Commission noted, FTC staff have conducted numerous meetings and consultations with organizations and individual businesses on how to ensure compliance with the new rule, and recently issued FAQs.
The Commission noted that petitioners seeking to extend the compliance date "have not raised any concrete facts to demonstrate that a delay is necessary." With regard to specific issues raised, the Commission addresses them in turn.
- First, with respect to "actual knowledge" standard of liability of third-parties that collect information from children on child-directed sites, the Commission said they had provided specific guidance on what constitutes "actual knowledge." (citing FAQ 39.)
- Second, regarding concerns with respect to the liability of child-directed sites and services for the conduct of third-parties, the Commission emphasized how they made clear that they would consider the level of due diligence exercised by a primary content provider in applying its prosecutorial discretion.
- Third, the Commission also dismissed concerns about not having appropriate lead time to address changes to the definition of "personal information." The Commission noted that it created an exception to the Rule's notice and consent requirements where an operator collects a persistent identifier for the sole purpose of providing support for its internal operations and twice expanded its originally proposed definition of support for internal operations which, according to the Commission, help ease compliance by the effective date.
- Last, the Commission notes that the Rule provides "significant flexibility" for operators to select the most cost-effective technologies to achieve the Rule's requirements and cites, by way of example, that companies may choose to obtain verifiable parental consent by any means reasonable calculated, in light of available technology.
To give some comfort to companies, the Commission noted that they "will exercise prosecutorial discretion in enforcing the rule, particularly with respect to small businesses that have attempted to comply with the Rule in good faith in the early months after the Rule becomes effective."
What does this mean in practical terms? It means, if you are a large entity you should be well underway with making changes in relation to the new Rule's requirements. If you are a small business, you may have more time, but you should also get cracking. July 1 will be here very soon.