FTC Official Outlines COPPA Changes, Wants Industry Questions

The new rule’s age screening provision is “not an expansion” of the rule’s reach, Kresses said. Under the updated rule, websites that are directed to children but have target audiences that are not children may screen users for age before collecting any personal information. After screening, those websites must treat users under 13 according to COPPA. Although some of the rule’s critics have said the provision will require cautious general audience sites to age-screen all users (CD Dec 26 p10), the provision does nothing “to pull in general audiences as sites directed to children,” Kresses said: Because the rule applies only to child-directed sites, the age screening provision is not a new obligation. It’s a new way to fulfill an already existing obligation, she said. “You always had that obligation to fulfill your COPPA duties” as a child-directed site, she said: “Concerns remain that this is a power grab, but really, frankly, it isn’t."

The FTC is not “imposing an affirmative duty” on plugin operators to investigate whether their products are embedded on child-directed sites, Kresses said. The updated rule requires third-party operators to be COPPA compliant if they have actual knowledge that they are interacting with users on child-directed sites. “Actual knowledge is a very high burden for the commission to meet,” Kresses said. Stu Ingis -- a lawyer who often represents the online ad industry and a partner at Venable, which hosted the event -- asked about the rule’s language that a third party has actual knowledge if “a representative of the online service recognizes the child-directed nature of the content.” This doesn’t mean an email to any inbox at the company constitutes actual knowledge, Kresses said. “It would have to be something that reached a person with sufficient responsibility to do something about it.” That clarification “would give people, I hope, some comfort,” Ingis said.

That the new rule establishes a process by which operators can submit new forms of verifiable parental consent for FTC approval is just the formalizing of what has “always been an open-ended standard,” Kresses said. The agency has always been open to new forms of verifiable parental consent, but few operators have been willing to try new forms, she said. “We understand the concerns [of] folks that don’t want to go out on a limb” and find themselves in trouble with the FTC, she continued. The FTC hopes to encourage operators to find innovative ways to get parental consent, knowing that they have the approval of the agency, she said.

The new rule creates the same process for additions to the definition of “support for internal operations,” for which operators do not need to collect parental consent to collect personal information from child users. Some operators are concerned about this process because it includes a public comment period and could make vulnerable proprietary information or trade secrets, Kresses said. “The commission will work with you to figure out what is proprietary or trade secret that can be redacted from the public version.” That’s so that what’s opened to public comments is “sufficiently detailed,” she said, “while also trying to maintain that proprietary interest."

The FTC will continue to address confusion over the new rule, Kresses said, encouraging anyone with questions to contact the agency, including through events like Monday’s. Through its website, the FTC will attempt to provide clarity and guidance on the new rule with FAQs, she said: “We need the questions as much as you need to ask them.”