As parents, it feels like we have lost the war with social media. We may win a few battles when it comes to our kids and their devices, but let's face it, we are like Sisyphus (minus the trickery and hubris) pushing that big boulder up a steep hill. Just when we think we have a handle on it, we have to figure out the rules of another platform of the day and be told by our tween that they are singularly put upon by our parental constraints.
We are in an era where social media is leaning toward fewer rather than more safety measures, making the safeguarding of children's online privacy even more crucial. Seeing the need for oversight, the Federal Trade Commission (FTC) has finalized revisions to the Children's Online Privacy Protection Act (COPPA). These updates are designed not only to modernize protections around how children's personal data is collected and shared, but also to provide parents reliable tools with which to control and limit what information is shared with third parties.
What is COPPA?
The Children's Online Privacy Protection Act (COPPA) of 1998 was enacted to protect the privacy of children under the age of 13 by regulating the collection, use, and disclosure of their personal information by operators of websites and online services. Operators must provide clear and comprehensive privacy policies, obtain verifiable parental consent before collecting personal information from children, and maintain the confidentiality, security, and integrity of the information collected (among other requirements).
Last week, the FTC announced a Final Rule revising COPPA, following the January 2024 Notice of Proposed Rulemaking which built on the FTC's ongoing review of the COPPA Rule initiated in July 2019. After receiving nearly 300 public comments on proposed changes, the FTC decided against implementing some ideas, including limits on push notifications for children without parental consent and certain regulations aimed at EdTech services in school settings. The FTC emphasized ongoing concerns about digital engagement tactics that keep kids online longer, potentially affecting their mental health.
Once the Final Rule is published in the Federal Register, it will take effect after 60 days. Newly appointed chair of the FTC, Andrew Ferguson who expressed some reservations about the rule in his dissent, will have to review and approve the rule before it moves further.
What are the changes in the Final Rule?
- Expanded definition of personal information to include biometric and government-issued identifiers;
- New definition for websites or online services directed to children but not primarily targeting them;
- Requirement to obtain separate rate verifiable parental consent when disclosing a child's personal information to third parties, such as for targeted advertising;
- New methods for verifiable parental consent;
- Implementation of written security program specifically designed to protect the children's personal information collected by these websites;
- Stronger data retention limitations; and
- Increased accountability for "Safe Harbor" programs, which will now require comprehensive reviews of operators' privacy and security policies.
Under the updated regulations, third parties must obtain explicit (opt-in) consent from parents before serving targeted ads, a key provision in preventing marketers and data brokers from exploiting children's information for profit. Caps on data storage compels companies to securely dispose of children's data once it is no longer needed, reducing the risk of identity theft and other forms of digital exploitation that can arise from large-scale data breaches. These are welcome and reasonable requirements for any website or provider marketing to and collecting the data from kids.
Why This Matters. COPPA rules are vital for parent and child online safety. These rules protect kids from misinformation, exploitation, and reliance on misleading or harmful information. These rules also allow parents to monitor what data is being collected about their children and how it is used, reducing the likelihood that kids will be exposed to unscrupulous advertising campaigns. As online misinformation surges, along with reliance on devices, and fact-checking on social media continues to be inconsistent, it's even more important to understand how children's data is collected and used.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
