FTC Official Outlines New COPPA Rule; Industry Questions Implementation

The rule is also flexible because it creates processes for operators to submit new definitions for “internal support” -- for which personal information can be collected from children -- and for new mechanisms of verifiable parental consent, which website operators must obtain if they want to collect personal information from users under 13 for uses other than internal support, Quaresima said. App operators are very interested in creating a mechanism that would obtain this consent through application platforms, such as Google Play or the Apple App Store, he said. “A platform-based consent mechanism, if done properly, may very well meet” the rule’s standard, and the FTC “encourage[s] continued thinking on that."

The July 1 implementation date doesn’t give operators much time to adjust their practices for the updated rule, panelists said. Operators of child-directed sites and apps have “a long list of things to do,” said Jim Halpert, technology lawyer with DLA Piper and counsel to the Internet Commerce Coalition. He suggested that websites review their data collection practices and those of the plugins they have installed. Dona Fraser, director of the Privacy Online Program at the Entertainment Software Rating Board, said her organization -- a COPPA-certified safe harbor -- is working with its members to ensure they comply with the new rule. “Those things are going to take time,” she said.

Education from the FTC will play a big role in the coming months, Fraser said. “That education really needs to come into play now … everyone needs to be educated,” including operators and parents who many not know what COPPA is and be turned off by family-oriented sites that ask users to provide their age before accessing content, she said. The FTC should use its educational outreach efforts, including online FAQs, to clarify confusing parts of the rule, Halpert said. Specifically, the FTC can clarify when first parties will be held accountable for the data collection of third parties, he said: For instance, if a child-directed website that does not collect personal information downloads a plugin that it believes not to collect personal information, and that plugin collects the information anyway, should the site’s operator be held responsible? “I think the FTC in practice would not” go after the website itself, Halpert said. “This can be clarified to scale the possible reach of the strict liability standard back."

The updated COPPA rule will drive app developers from the market, said Tim Sparapani, Application Developers Alliance vice president-law, policy and government relations. “There are developers who are literally stopping what they are doing” because they are confused by the new rules, don’t have the legal resources to understand and comply, and worry about how to monetize their products under the new rule, he said. For instance, Sparapani asked what an app that uses a third-party ad network to remain profitable and able to innovate should do, now that under the updated rule they are responsible for third parties that collect personal information from child users. Quaresima said he doesn’t “see the ramifications as being quite so large” because apps can continue to advertise to children: Under the new rule, contextual advertising is included in the definition of “internal support.” Operators just can’t track children across time and across websites to provide behavioral advertising, he said: “When you're essentially individualizing what’s going on to the user … that’s where you need parental consent.” One way to ensure that apps aren’t unduly harmed in the process is “to move forward quickly with a parental consent mechanism” through app stores, Halpert said. “There isn’t that much time to innovate to get this done."

The gains in children’s online privacy are questionable and definitely not worth the costs, Sparapani said: “Who loses? Certainly parents. Certainly teachers. Certainly kids.” The alliance “would give a failing grade to the FTC” on COPPA, because the agency failed “to understand the dynamism of the innovative cycle,” he said.