In the process of amending its Rule regarding the implementation of the Children’s Online Privacy Protection Act, the Federal Trade Commission has requested additional comments on newly proposed modifications.
Last September the agency announced proposed revisions to the COPPA Rule in five areas: definitions, parental notice, parental control mechanisms, confidentiality and security of children’s personal information, and safe harbor programs. Since then, the FTC has received 350 comments.
In response to those comments and “informed by its experience in enforcing and administering the Rule,” the FTC proposed additional modifications to three definitions of terms under the Rule: “operator,” “website or online service directed to children,” and “personal information.”
The agency seeks to include third parties – like advertising networks or plug-ins that collect personal information – in the definitions of both “operator” and “website or online services directed to children.” Under the new proposal, the definition of “operator” would include personal information “collected or maintained on behalf of” an operator where it is collected in the interest of, or by a representative of, or for the benefit of, the operator.
“This change would make clear that an operator of a child-directed site or service that chooses to integrate the services of others that collect personal information from its visitors should itself be considered a covered ‘operator’ under the Rule,” the FTC said in its announcement.
Similarly, the definition of “website or online service directed to children” would also cover a plug-in or ad network “when it knows or has reason to know that it is collecting personal information through a child-directed website or online service.” This proposal would reflect the reality that some Web sites have a mixed audience appealing to adults and children under 13.
Sites with mixed audiences would be allowed to age-screen visitors and be required to follow the COPPA Rule with respect to only those under age 13. However, sites that knowingly target children under 13 as their primary audience, or whose overall content is likely to attract those under 13 as their primary audience, would still have to treat all visitors as children.
The FTC also said it plans to update the definition of “personal information.” Under the proposed revision, the term would include a persistent identifier “where it can be used to recognize a user over time, or across different sites or services, where it is used for purposes other than support for internal operations.” The agency also clarified the phrase “support for internal operations” is intended to include the maintenance and analysis of sites, the performing of network communications, the use of persistent identifiers to authenticate users, the maintenance of user preferences, and devices and techniques used to protect against fraud and theft. Serving contextual advertisements also qualifies as support for internal services “so long as the information collected is not used or disclosed to contact a specific individual, including through the use of behaviorally-targeted advertising, or for any other purpose.”
Public comment on the FTC’s supplemental notice of proposed rulemaking will be accepted until Sept. 10.
To read the FTC’s supplemental notice of proposed rulemaking and request for comment, click here.
Why it matters: Each of the proposed amendments could have a significant impact on Web sites and other online services geared toward children under 13 years of age. In particular, the definition of an “operator” would greatly expand the entities covered by the COPPA Rule, to include advertising networks and third parties offering social plug-ins. “The Commission now believes that the most effective way to implement the intent of Congress is to hold both the child-directed site or service and the information-collecting site or service responsible as covered co-operators,” the FTC said in its proposal. Advertisers should continue to monitor the FTC’s proposed changes to the COPPA Rule as the revision process continues.