On September 15, 2011, the Federal Trade Commission ("FTC," or "the Commission") announced proposed changes to the Children's Online Privacy Protection Act Rule (the "COPPA Rule"). It is seeking public comment on proposed amendments to the COPPA Rule, which gives parents control over what personal information websites may collect from children under age 13. The FTC's purpose was to modernize the COPPA Rule in order to take into account technological changes. Written comments must be received on or before November 28, 2011.
Here are the five general categories in which the COPPA Rule would be modified:
- The COPPA Rule requires covered operators to obtain parental consent before collecting personal information from children. The FTC proposes updating the definition of "personal information" to include geolocation information and certain types of persistent identifiers used for functions other than the website's internal operations, such as tracking cookies used for behavioral advertising.
- In addition, the Commission proposes modifying the definition of "collection" so operators may allow children to participate in interactive communities, without parental consent, so long as the operators take reasonable measures to delete all or virtually all children's personal information before it is made public.
Parental Consent Mechanisms
- The FTC proposes adding new methods to obtain verifiable parental consent, including electronic scans of signed parental consent forms, videoconferencing, and use of government-issued identification checked against a database, provided that the parent's ID is deleted promptly after verification is done.
- The FTC proposes eliminating "e-mail plus," which has been used by operators that collect personal information only for internal use. This method currently allows operators to obtain consent through an email to the parent, coupled with another step, such as sending a delayed email confirmation to the parent after receiving consent.
- To encourage the development of new consent methods, the Commission proposes establishing a voluntary, 180-day, notice-and-comment process whereby parties may seek Commission approval of new consent mechanisms. In addition, the Commission proposes permitting operators participating in a Commission approved safe-harbor program to use a method permitted by that program.
Confidentiality and Security Requirements
- The Commission proposes adding a requirement that operators ensure that any service providers or third-parties to whom they disclose a child's personal information have in place reasonable procedures to protect it, that operators retain the information for only as long as is reasonably necessary, and that they properly delete that information by taking reasonable measures to protect against unauthorized access to, or use in connection with, its disposal.
- The FTC proposes to require self-regulatory "safe-harbor programs" to audit their members at least annually and report periodically to the Commission the results of those audits.