A recently enacted Maine law, called the Act to Prevent Predatory Marketing Practices against Minors and scheduled to take effect on September 12, 2009, purports to regulate the collection, use, and disclosure of minors' (defined as children under 18) personal information both online and offline (a copy of the law is available at http://www.mainelegislature.org/legis/bills/bills_124th/chappdfs/PUBLIC230.pdf). While the original purpose of the bill focused on minors' health-related information, the bill was amended prior to passage to cover all personal information. If planned industry efforts to challenge this law or otherwise prevent it from taking effect are not successful, it would go far beyond the requirements of Children's Online Privacy Protection Act (COPPA), and in fact would appear to be preempted by COPPA, which preempts inconsistent state laws. Although the law enables the state Attorney General to investigate violations as unfair trade practices, it also provides a private right of action, under which an individual can obtain injunctive relief as well as actual damages or statutory damages in the amount of $250 per violation. The statutory damages provision will undoubtedly attract the attention of the class action bar, as no showing of actual harm is necessary to obtain statutory damages. Thus, development of a compliance plan is prudent in the eventuality that law is allowed to take effect.
Complying with this law could be burdensome and could involve excluding kids and teens in Maine from promotions, as well as implementing new age-screening for online promotions, newsletter signups, and other online data collection activities. It also could have consequences for previously collected data, promotions that are already underway and continued use of the "e-mail exceptions" under COPPA.
Specifically, the Act requires companies to obtain verifiable parental consent before knowingly collecting "personal information" or "health-related information" for "marketing purposes" from children under 18. Personal information includes first name or initial and last name, home or other physical address, social security number, driver's license or state ID number, as well as any information collected in combination with these identifiers. Health-related information is defined as any information about the individual (or a member of the individual's family) relating to health, nutrition, medication use, medical history, insurance, claims, etc. As currently formulated, the Act would prohibit companies from collecting qualifying information from minors without parental consent, transferring lawfully-collected information to any other party for any reason, or using the information itself to market or advertise products, goods, or services to minors. Thus, the law appears to require consent for collection of personal information from minors, but contains a per se prohibition on use for marketing and on transfer.
Key Differences from COPPA:
Among the key ways in which this law goes beyond COPPA, the law:
- Applies to information collected both on and offline, whereas COPPA applies only online;
- Applies to individuals under 18, whereas COPPA applies only to children under 13;
- Prohibits use of minor's personal information for marketing purposes, where COPPA allows use with appropriate parental consent;
- Prohibits disclosure or transfer of minor's personal information to third parties, irrespective of whether the site obtains verifiable parental consent. COPPA allows such disclosure, where offline parental consent has been obtained;
- Does not include the important exceptions to verifiable consent, such as the critically important e-mail exceptions, upon which many kid-directed sites depend; and
- Contains a private right of action, whereas COPPA is limited to Federal Trade Commission or state AG actions.