[RFC] FTC Seeks Comment on Children's Online Privacy Protections; Questions Whether Changes to Technology Warrant Changes to Agency Rule

Press Release March 24: "In light of rapidly evolving technology and changes in the way children use and access the Internet, the Federal Trade Commission is seeking public comment on the costs and benefits of an FTC rule designed to protect children online.

"The FTC’s Children’s Online Privacy Protection Act (COPPA) Rule became effective on April 21, 2000. COPPA imposes requirements on operators of Web sites or online services that are aimed at children under 13 years of age, or that knowingly collect personal information from children under 13. Among other things, the Rule requires that online operators notify parents and get their permission before collecting, using, or disclosing personal information from children. It also requires that the operators keep the information they collect from children secure, and prohibits them from requiring children to turn over any more personal information than is reasonably necessary to participate in activities on their Web sites.

"In 2005, the FTC initiated a congressionally required review of the Rule, and after considering extensive public comment decided to retain it without change. However, the Commission believes that changes to the online environment over the past five years, including children’s increasing use of mobile technology to access the Internet, warrant reexamining the Rule.

"In a Federal Register notice to be published shortly, the FTC poses its standard regulatory review questions and identifies several areas where public comment would be especially useful. Among other things, the FTC asks:

• What implications for COPPA enforcement are raised by mobile communications, interactive television, interactive gaming, or other similar interactive media.
• For input on the use of automated systems – those that filter out any personally identifiable information prior to posting – to review children’s Web submissions.
• Whether operators have the ability to contact specific individuals using information collected from children online, such as persistent IP addresses, mobile geolocation data, or information collected in connection with behavioral advertising, and whether the Rule’s definition of “personal information” should be expanded accordingly.
• Whether there are additional technological methods to obtain verifiable parental consent that should be added to the COPPA Rule, and whether any of the methods currently included should be removed.
• Whether parents are exercising their right under the Rule to review or delete personal information collected from their children, and what challenges operators face in authenticating parents.
• Whether the Rule’s process for FTC approval of self-regulatory guidelines – known as safe harbor programs – has enhanced compliance, and whether the criteria for FTC approval and oversight of the guidelines should be modified in any way.

"Copies of the Federal Register Notice and the public comments received will be posted on the FTC’s Web site at: http://www.ftc.gov/privacy/privacyinitiatives/childrens.html.

"The 90-day comment period will end on June 30, 2010. The Commission also will hold a public roundtable on the COPPA Rule review on Wednesday, June 2, 2010, at the FTC Conference Center, 601 New Jersey Avenue, N.W., Washington, DC.

"Interested parties can submit written comments electronically or in paper form, by following the instructions in the Invitation To Comment part of the “Supplementary Information” section. Comments in electronic form should be submitted using the following Web link: https://public.commentworks.com/ftc/2010copparulereview (and following the instructions on the web-based form). Comments in paper form should be mailed or delivered to: Federal Trade Commission, Office of the Secretary, Room H-135 (Annex E), 600 Pennsylvania Avenue, N.W., Washington, DC 20580.