United States: Enforcement Priorities And Trends In Children's And Minors' Advertising And Privacy

Perspectives from State and Federal Regulators

BakerHostetler's Alan Friel recently interviewed FTC staff lawyer Kandi Parsons and Assistant New Jersey Attorney General Elliot Sibers at the opening session of the Children's Advertising Review Unit ("CARU") of the Advertising Self-Regulatory Council ("ASRC") annual conference in New York. (CARU and ASRC are self-regulatory bodies representing the advertising industry.) The discussion yielded important perspectives of federal and state consumer protection regulators on what they expect of industry with regard to children's and teens' advertising, privacy, and protection. Here are some of the insights they shared:

"Enough time has passed for companies to learn the new rules..."

After a year or so of hiatus from enforcement of the federal Children's Online Privacy Protection Act (COPPA), following significant expansion of its reach, during which time regulators conducted educational outreach on the changes, the FTC recently brought two COPPA enforcement actions, resulting in $750,000 in settlements, against the online review service Yelp and the mobile game company TinyCo. Both Ms. Parsons and Mr. Sibers promised ramped-up enforcement actions, saying enough time had passed for companies, particularly mobile app publishers, to learn the new rules. These cases were characterized as simple low-hanging fruit that would have violated the old version of COPPA, and it was suggested that the next rounds of actions are likely to address more complex compliance issues, such as behavioral advertising, social media plug-ins, geo-location, photos, push notifications, and the new category of "mixed use" services added by the 2013 rule revisions.

"Companies are warned to not get careless when launching mobile versions of their services..."

Notably, Yelp does not target children. However, it is alleged to have made a common mistake of general audience services even under the old rule—to collect user age at registration without blocking, and preventing resubmission attempts by, those indicating they are under 13. Another frequent mistake is to explain to users they must be 13, which is deemed impermissible coaching, or failure to take reasonable measures to prevent additional submission attempts, such as dropping a cookie that prevents submission for a reasonable period. Ms. Parsons indicated that it was not unintentional that one of the first new cases is essentially a reminder that all service operators need to be aware of the COPPA obligations that apply. She further pointed out that Yelp was compliant on its website, but when it published a mobile app version of the service, the company failed to comply with the regulatory requirements. She warned companies to not get careless when launching mobile versions of their services.

Ms. Parson noted, with regard to TinyCo, which operates "freemium" mobile games—free to play but with in-app purchases that enhance the game experience—that the FTC concluded that several of the publisher's games should be considered child-directed because of the "appeal to children by containing brightly colored, animated characters from little animals to zoo creatures to tiny monsters, and by involving subject matters such as a zoo, tree house or resort inspired by a fairy tale... [and] the language used to describe the games in the app stores and the gameplay language is simple and would be easy for a child under 13 to understand." Unlike general audience services, which must comply with COPPA only when they have knowledge that a user is a child or when they are interacting with another service that is child-directed, children's services must assume all users are children until certain notice and parental verification steps are taken, absent narrow exceptions. In this case, the FTC went to great lengths to attach to the documents examples of TinyCo content that it felt was child-directed. Ms. Parsons reinforced the fact that beyond the nature and appeal of the content, attention is given to where and how a property is marketed, the complexity of the marketing and instructional language, the complexity of game play, and determining if content is child-directed.

Mr. Sibers noted that although COPPA is a federal law, it is also within state AGs' jurisdiction to enforce it, and that New Jersey has been and will continue to be active in doing so. He also noted that most state AGs have much broader consumer protection authority than does the FTC, particularly regarding unfair practices. He noted that in 2008, NJ was part of a 49-state AG enforcement actions against Facebook and Myspace concerning tween and teen online safety that resulted in settlement. The settlements required such changes as allowing parents to submit their children's email addresses so the service provider could prevent anyone using those addresses from setting up profiles, making the default setting "private" for profiles of 16- and 17-year-olds, limiting the ability of unrelated adults to directly message minors, promising to respond within 72 hours to inappropriate content complaints, and committing more staff and resources to moderation of photographs and discussion groups. He went on to say that while tween/teen privacy and safety was still a priority, large multi-state impact actions may not serve the same purpose in the fast-moving online and mobile space, and he pointed to the guidance efforts and targeted enforcement actions that several AGs, particularly the California AG, have been making with respect to privacy and online and mobile consumer protection, as a likely trend.

Mr. Friel tried to get Ms. Parsons to comment on whether the Facebook "Like" button qualified for a particular exception to the parental consent obligations of COPPA and could be used on children's websites. She indicated that the Commission was still working through some of the technical issues relating to whether, and under what circumstances, it might qualify, but that it would be premature to elaborate. Clients concerned with this issue should contact Mr. Friel, who can elaborate on private discussions with regulators, Facebook, and safe harbor providers.

"Publishers need to be concerned about the app stores' sales and billing practices, especially concerning children..."

Both Ms. Parsons and Mr. Sibers pointed to the FTC's recently settled cases with Google and Apple in the many millions of dollars for allegedly unfair app store purchases and billing protocols that are alleged to have facilitated charges to parents by actions of their children that were not necessarily authorized by parents, and its ongoing litigation of similar claims against Amazon, to point out that regulators are particularly concerned with what they see as unfair billing practices. In these cases, it was alleged that it was too easy for children to continue to make ongoing in-app purchases after a parent initially approved an earlier transaction, and that it was too difficult for parents to have charges reversed. Mr. Friel pointed out that these actions rely on unfairness authority, which the FTC has been increasingly more willing to exercise in privacy and consumer protection cases. Later during the conference, another FTC official expressed concern that the nature and cost of some in-game, up-sell opportunities for children may be unfair in either sales pressure or unconscionable terms, or both, and warned publishers not to think it is only the app stores that need to be concerned about their sales and billing practices, especially concerning children.

Advertising and sales activities directed at children continue to be important enforcement priorities..."

Finally, Mr. Friel noted that the CARU advertising industry self-regulatory rules judge children's advertising by different standards than those the ASRC's National Advertising Division applies for adults, taking into account the relatively uncontroversial proposition that there is a difference between the ability to appreciate sales pressure and advertising messages for children and for adults. He asked whether since the FTC's KidVid policy disaster of the late 70s, culminating in the FTC Improvement Act of 1980 curtailing its unfairness authority, currently the topic of jurisdictional challenges to FTC authority in the adult data protection area, children's advertising had largely been an area left to industry self-regulation by the regulators. Both Ms. Parsons and Mr. Sibers indicated that their agencies also applied a different standard, taking the likely net impression of typical children and teens into account when evaluating the potential deception or unfairness of advertising or sales activities targeting them, and indicated that child and teen protection, for privacy, advertising, and sales activities, were and would continue to be important enforcement priorities.

A summary by Mr. Friel on COPPA data collection and use obligations and restrictions is available here. His recent blog posts on the FTC's Yelp and TinyCo actions is available here. A blog post on recent California legislation affecting the privacy rights of minors and students is available here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.