Children's Online Privacy Protection Rule

Federal RegisterJan 11, 2024

Ask Donna

What actually matters in this document.

Text

FEDERAL TRADE COMMISSION

16 CFR Part 312

RIN 3084-AB20

Children's Online Privacy Protection Rule

AGENCY:

Federal Trade Commission.

ACTION:

Notice of proposed rulemaking.

SUMMARY:

The Commission proposes to amend the Children's Online Privacy Protection Rule, consistent with the requirements of the Children's Online Privacy Protection Act. The proposed modifications are intended to respond to changes in technology and online practices, and where appropriate, to clarify and streamline the Rule. The proposed modifications, which are based on the FTC's review of public comments and its enforcement experience, are intended to clarify the scope of the Rule and/or strengthen its protection of personal information collected from children.

DATES:

Comments must be received by March 11, 2024.

ADDRESSES:

Interested parties may file a comment online or on paper by following the instructions in the Request for Comment part of the

SUPPLEMENTARY INFORMATION

section below. Write “COPPA Rule Review, Project No. P195404” on your comment and file your comment online at

https://www.regulations.gov

by following the instructions on the web-based form. If you prefer to file your comment on paper, mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex E), Washington, DC 20580.

FOR FURTHER INFORMATION CONTACT:

Manmeet Dhindsa (202-326-2877) or James Trilling (202-326-3497), Division of Privacy and Identity Protection, Bureau of Consumer Protection, Federal Trade Commission.

SUPPLEMENTARY INFORMATION:

I. Background

Congress enacted the Children's Online Privacy Protection Act (“COPPA” or “COPPA statute”), 15 U.S.C. 6501

et seq.,

in 1998. The COPPA statute directed the Federal Trade Commission (“Commission” or “FTC”) to promulgate regulations implementing COPPA's requirements. On November 3, 1999, the Commission issued its Children's Online Privacy Protection Rule, 16 CFR part 312 (“COPPA Rule” or “Rule”), which became effective on April 21, 2000.

Section 6506 of the COPPA statute and § 312.11 of the initial Rule required that the Commission initiate a review no later than five years after the initial Rule's effective date to evaluate the Rule's implementation. The Commission commenced this mandatory review on April 21, 2005.

After receiving and considering extensive public comment, the Commission determined in March 2006 to retain the COPPA Rule without change.

In 2010, the Commission once again undertook a review of the COPPA Rule to determine whether the Rule was keeping pace with changing technology. After notice and comment, the Commission issued final amendments to the Rule, which became effective on July 1, 2013 (“2013 Amendments”).

Children's Online Privacy Protection Rule, Statement of Basis and Purpose, 64 FR 59888 (Nov. 3, 1999), available at

https://www.federalregister.gov/documents/1999/11/03/99-27740/childrens-online-privacy-protection-rule.

Children's Online Privacy Protection Rule, Request for Public Comment, 70 FR 21107 (Apr. 22, 2005), available at

https://www.federalregister.gov/documents/2005/04/22/05-8160/childrens-online-privacy-protection-rule-request-for-comments.

Children's Online Privacy Protection Rule, Retention of Rule Without Modification, 71 FR 13247 (Mar. 15, 2006), available at

https://www.federalregister.gov/documents/2006/03/15/06-2356/childrens-online-privacy-protection-rule.

See

Children's Online Privacy Protection Rule, Statement of Basis and Purpose, 78 FR 3972 (Jan. 17, 2013), available at

https://www.federalregister.gov/documents/2013/01/17/2012-31341/childrens-online-privacy-protection-rule.

The COPPA Rule imposes certain requirements on operators of websites

or online services directed to children under 13 years of age, and on operators of websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age (collectively, “operators”). The Rule requires that operators provide notice to parents and obtain verifiable parental consent before collecting, using, or disclosing personal information from children under 13 years of age.

Additionally, the Rule requires that operators must provide parents the opportunity to review the types or categories of personal information collected from their child, the opportunity to delete the collected information, and the opportunity to prevent further use or future collection of personal information from their child.

The Rule also requires operators to keep personal information they collect from children secure, including by imposing retention and deletion requirements, and prohibits them from conditioning children's participation in activities on the collection of more personal information than is reasonably necessary to participate in such activities.

The Rule contains a “safe harbor” provision enabling industry groups or others to submit to the Commission for approval self-regulatory guidelines that would implement the Rule's protections.

See

Part IV for further discussion of the Commission's proposal to change the term “Web site” to “Web site” throughout the Rule. This Notice of Proposed Rulemaking incorporates this proposed change in all instances in which the term “Web site” is used.

16 CFR 312.3, 312.4, and 312.5.

16 CFR 312.3 and 312.6.

16 CFR 312.3, 312.7, 312.8, and 312.10.

16 CFR 312.11.

The 2013 Amendments

revised the COPPA Rule to address changes in the way children use and access the internet, including through the increased use of mobile devices and social networking. In particular, the 2013 Amendments:

78 FR 3972.

• Modified the definition of “operator” to make clear that the Rule covers an operator of a child-directed website or online service that integrates outside services—such as plug-ins or advertising networks—that collect personal information from the website's or online service's visitors, and expanded the definition of “website or online service directed to children” to clarify that those outside services are subject to the Rule where they have actual knowledge that they are collecting personal information directly from users of a child-directed website or online service;

• Permitted a subset of child-directed websites or online services that do not target children as their primary audience to differentiate among users, requiring them to comply with the Rule's obligations only as to users who identify as under the age of 13;

• Expanded the definition of “personal information” to include geolocation information; photos, videos and audio files containing a child's image or voice; and persistent identifiers that can be used to recognize a user over time and across different websites or online services;

• Streamlined the direct notice requirements to ensure that key information is presented to parents in a succinct “just-in-time” notice;

• Expanded the non-exhaustive list of acceptable methods for obtaining prior verifiable parental consent;

• Created three new exceptions to the Rule's notice and consent requirements, including for the use of persistent identifiers for the support for the internal operations of a website or online service;

• Strengthened data security protections by requiring operators to take reasonable steps to release children's personal information only to service providers and third parties who are capable of maintaining the confidentiality, security, and integrity of such information, and required reasonable data retention and deletion procedures; and

• Strengthened the Commission's oversight of self-regulatory safe harbor programs.

Id.

On July 25, 2019, the FTC announced in the

Federal Register

that it was again undertaking a review of the COPPA Rule, noting that questions had arisen about the Rule's application to the educational technology (“ed tech”) sector, voice-enabled connected devices, and general audience platforms that host third-party child-directed content (“2019 Rule Review Initiation”).

The Commission sought public comment on these and other issues in its 2019 Rule Review Initiation. In addition to its standard regulatory review questions to determine whether the Commission should retain, eliminate, or modify the COPPA Rule, the Commission asked whether the 2013 Amendments have resulted in stronger protections for children and whether the revisions have had any negative consequences. The Commission also posed specific questions about the Rule's provisions, including the Rule's definitions, notice and consent requirements, access and deletion rights, security requirements, and safe harbor provisions.

See

Children's Online Privacy Protection Rule, Request for Public Comment, 84 FR 35842 (July 25, 2019), available at

https://www.federalregister.gov/documents/2019/07/25/2019-15754/request-for-public-comment-on-the-federal-trade-commissions-implementation-of-the-childrens-online.

During the comment period, the Commission held a public workshop on October 7, 2019, to discuss in detail several of the areas where it sought public comment (“COPPA Workshop”).

Specific discussion included such topics as application of the COPPA Rule to the ed tech sector, how the development of new technologies and business models have affected children's privacy, and whether the 2013 Amendments have worked as intended.

See The Future of the COPPA Rule: An FTC Workshop

(Oct. 7, 2019), available at

https://www.ftc.gov/news-events/events/2019/10/future-coppa-rule-ftc-workshop;

84 FR 35842.

In response to the 2019 Rule Review Initiation, the Commission received more than 175,000 comments from various stakeholders, including industry representatives, video content creators, consumer advocacy groups, academics, technologists, FTC-approved COPPA Safe Harbor programs, members of Congress, and individual members of the public. While many of these comments expressed overall support for COPPA,

the comments identified a number of areas where the Commission could provide additional clarification or guidance about the COPPA Rule's requirements. The comments also proposed a number of potential changes to the Rule.

See, e.g.,

Joint Comment of the Attorneys General of New Mexico, Connecticut, Delaware, the District of Columbia, Idaho, Illinois, Iowa, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Nebraska, Nevada, New York, North Carolina, Oregon, Pennsylvania, Tennessee, Vermont, Virginia, and Washington (“Joint Attorneys General”), at 2 (“As more and more of our lives are lived online, and as digital tools make their way into our schools and into our lives at ever-earlier ages, rules like the COPPA Rule must continue not only to exist, but grow and adapt to ever-changing regulatory landscapes”); SuperAwesome Inc. (“SuperAwesome”), at 8 (“As a result of the rapid evolution of the [I]nternet economy and in particular services that rely on user data, the need for the COPPA Rule has never been greater”); Privacy Vaults Online, Inc. (“PRIVO”), at 2 (“In PRIVO's experience, both children and operators benefit when COPPA-compliant processes are in place to permit operators to offer relevant content to children and permit children to engage with that content in an appropriate and permissioned manner”); The LEGO Group (“Lego”), at 3 (“COPPA has played and continues to play an important role in raising awareness of the importance of protecting children's privacy online. COPPA has been effective because of its future-proof language, which has allowed it to protect against real harms today, that were not clear when the Rule was enacted in 1998”); Internet Association, at 1 (“Nearly 20 years after its adoption, COPPA remains an important mechanism for preserving parental choice with respect to the privacy and security of personal information about children under 13”); Consumer Reports, at 5 (“Due to the increase in connected products generally, and children's products specifically, there is only heightened need for the COPPA rules in the coming years”); and Association of National Advertisers (“ANA”), at 3 (“The current COPPA Rule is protective of children's privacy interests and generally workable for businesses. The FTC has given parents the ability to protect children's privacy and entities clear `rules of the road' regarding how to comply with COPPA”).

But see

Committee for Justice, at 2 (“In addition to being ineffective at preventing the personal information of children from being collected without parental consent, [COPPA's] approach has the effect of burdening sites targeted towards children”); International Center for Law & Economics (“ICLE”), at 3 (regarding the aggregate costs and benefits of the Rule, “[t]he benefits are unclear, but the costs—in the form of restricting the ability of family-friendly content creators to monetize their products—are real”); Connected Camps, at 1-3 (stating that COPPA has resulted in a number of unintended consequences based on mistaken assumptions).

Following consideration of the submitted public comments, viewpoints expressed during the COPPA Workshop, and the Commission's experience enforcing the Rule, the Commission proposes modifying most provisions of the Rule. Part II of this notice of proposed rulemaking (“NPRM”) discusses commenters' calls to expand the COPPA Rule's coverage by amending the definition of “website or online service directed to children” or by changing the Rule's actual knowledge standard. Part III of this NPRM discusses commenters' viewpoints on whether the Commission should permit general audience platforms that allow third parties to upload content to the platform to rebut the presumption that all users of uploaded child-directed content are children. Part IV addresses the Commission's proposed modifications to the Rule. Parts V-X provide information about requests for comment, the Paperwork Reduction Act, the Regulatory Flexibility Act, communications by outside parties to the Commissioners or their advisors, questions for the proposed revisions to the Rule, a list of subjects in the Rule, and the amended text of the Rule.

II. Comments on Expanding the COPPA Rule's Coverage

As part of its 2019 Rule Review Initiation, the Commission requested comment on questions regarding whether the Commission should revise the definition of “website or online service directed to children.” In response, the Commission received various comments regarding expanding the COPPA Rule's coverage by either amending the definition of “website or online service directed to children” or by changing the Rule's actual knowledge standard. This Part includes discussion of comments advocating for and against such expansions.

A. Amending the Definition of “Website or Online Service Directed to Children”

In its 2019 Rule Review Initiation, the Commission asked for comment on various aspects of the Rule's definition of “website or online service directed to children.” Among other questions, the Commission asked whether it should amend the definition to address websites and online services that do not include traditionally child-oriented activities but still have large numbers of child users.

Other aspects of this definition are discussed in Part IV.A.5.

Some commenters argued that the definition of “website or online service directed to children” should be modified to include sites and services with large numbers of children, those with a certain percentage of child users, or those that include child-attractive

content.

For example, FTC-approved COPPA Safe Harbor program PRIVO asserted that general audience services with large numbers of children should be required to comply with COPPA, noting that “[s]ervices not targeted to children that have large numbers of children must be addressed as it can result in online harm to the child due to inherent privacy and safety risks.”

PRIVO further argued that the Commission should define thresholds for the number of child users at which COPPA's protections must be provided.

Similarly, Common Sense Media encouraged the Commission to interpret the definition of “website or online service directed to children” to include “sites and services that attract, or are likely to be accessed by, disproportionate numbers of children.”

See, e.g.,

Children's Advertising Review Unit (“CARU”), at 6-7; PRIVO, at 7; Common Sense Media, at 12.

PRIVO, at 7.

Id.

Common Sense Media, at 12, 15-17.

However, other commenters opposed expanding the definition of “website or online service directed to children” in such ways.

For example, The Toy Association opposed the adoption of a numerical or percentage audience threshold as a determinative factor in identifying child-directed websites or online services.

Similarly, panelists during the COPPA Workshop noted that “[a]ttractive to children is very different from targeted to children,”

and that COPPA's statutory language is “child-directed” and not “child-attractive.”

Commenters raised additional concerns with expanding the definition to include sites and services that do not include child-oriented activities but have large numbers of children, including because such a change would be inconsistent with the statute,

decrease online offerings for children,

be unduly burdensome to operators of non-child-directed websites or online services,

and lead to regulatory uncertainty.

Some commenters also noted that this amendment would be unnecessary since the definition already includes “competent and reliable empirical evidence regarding audience composition” as a factor to consider in determining whether a site or service is directed to children.

See, e.g.,

Computer & Communications Industry Association (“CCIA”), at 6-7; U.S. Chamber of Commerce, at 3-4; ANA, at 6-7; Network Advertising Initiative (“NAI”), at 3-5; ViacomCBS Inc. (“Viacom”), at 5-6; Internet Association, at 9; Entertainment Software Association (“ESA”), at 8-12; TechFreedom, at 18.

The Toy Association, at 9-10 (adding that “[d]oing so is inconsistent with traditional norms for advertising and risks undermining the intent of the statute by elevating a single factor over others. Such an approach is also entirely inconsistent with how the FTC and advertising self-regulatory bodies handle advertising”).

P. Aftab, Remarks from the

Scope of the COPPA Rule

panel at

The Future of the COPPA Rule: An FTC Workshop

52 (Oct. 7, 2019), available at

https://www.ftc.gov/news-events/events/2019/10/future-coppa-rule-ftc-workshop.

See

D. McGowan, Remarks from the

Scope of the COPPA Rule

panel at

The Future of the COPPA Rule: An FTC Workshop

48 (Oct. 7, 2019), available at

https://www.ftc.gov/news-events/events/2019/10/future-coppa-rule-ftc-workshop.

See, e.g.,

CCIA, at 6; NAI, at 3; ANA, at 6; Viacom, at 5-6; U.S. Chamber of Commerce, at 3-4.

See, e.g.,

ANA, at 7 (noting that “[b]roadening the Rule's scope by making it applicable to websites or online services that do not include traditionally child-oriented activities, but that have large numbers of child users, would negatively impact consumers and children because operators would be disincentivized from producing content, products, and online services that, while not directed to them, have the potential to attract child users”).

See, e.g.,

CCIA, at 7 (noting that “[a]udience metrics alone are a poor basis for determining COPPA applicability because they can shift over time, may be highly responsive to fads, cannot necessarily be predicted by an operator at the outset of (launching a website or online service, and cannot be reliably calculated”).

See, e.g.,

ESA, at 8.

See, e.g.,

CCIA, at 6-7; ANA, at 6-7.

During the Rule review that resulted in the 2013 Amendments, the Commission considered amending the definition of “website or online service directed to children” to cover sites or services that “[b]ased on the overall content of the website or online service, [are] likely to attract an audience that includes a disproportionately large percentage of children under age 13 as compared to the percentage of such children in the general population. . . .”

In response, the Commission received numerous comments raising concerns that such a standard was vague, potentially unconstitutional, and unduly expansive, and could lead to widespread age-screening and more intensive age verification across all websites and online services.

In ultimately declining to adopt this standard, the Commission stated it did not intend to expand the reach of the Rule to include additional sites and services.

Children's Online Privacy Protection Rule, Supplemental Notice of Proposed Rulemaking; Request for Comment, 77 FR 46643, 46646 (Aug. 6, 2012), available at

https://www.federalregister.gov/documents/2012/08/06/2012-19115/childrens-online-privacy-protection-rule.

See

78 FR 3972 at 3983-3984.

The Commission again declines to modify the Rule in this manner. The definition of “website or online service directed to children” includes a number of factors the Commission will consider in determining whether a particular website or online service is child-directed, including consideration of “competent and reliable empirical evidence regarding audience composition.” Because the Commission already considers the demographics of a website's or online service's user base in its determination, the Commission does not believe it is necessary to modify the definition.

Similarly, the Commission also previously considered amending the Rule to set forth that websites and online services with a specified percentage of child users would be considered directed to children. As part of the Rule review that led to the 2013 Amendments, the Institute for Public Representation recommended that the Commission amend the Rule so that a website per se should be deemed “directed to children” if audience demographics show that 20% or more of its visitors are children under age 13.

The Commission determined not to adopt this as a per se legal standard, in part because the Commission noted that the definition of “website or online service directed to children” already positions the Commission to consider empirical evidence of the number of child users on a site.

Children's Online Privacy Protection Rule, Proposed Rule; Request for Comment, 76 FR 59804, 59814 (Sept. 27, 2011), available at

https://www.federalregister.gov/documents/2011/09/27/2011-24314/childrens-online-privacy-protection-rule.

While the Commission continues to believe that there are good reasons not to ground COPPA liability simply on an assessment of the percentage of a site's or service's audience that is under 13, the Commission would like to obtain additional comment on whether it should provide an exemption under which an operator's site or service would not be deemed child-directed if the operator undertakes an analysis of the site's or service's audience composition and determines that no more than a specific percentage of its users are likely to be children under 13. In particular, the Commission seeks comment on (1) whether the Rule should provide an exemption or other incentive to encourage operators to conduct an analysis of their sites' or services' user bases; (2) what the reliable means are by which operators can determine the likely ages of a site's or service's users; (3) whether and how the COPPA Rule should identify such means; (4) what the appropriate percentage of users should be to qualify for this potential exemption;

and (5)

whether such an exemption would be inconsistent with the COPPA Rule's multi-factor test for determining whether a website or online service, or a portion thereof, is directed to children.

Because this exemption would rely on a single factor (

i.e.,

audience composition) to exempt sites or services from being deemed child-directed, the Commission anticipates that the appropriate

percentage to qualify for this exemption would be very low.

B. Changing the COPPA Rule's “Actual Knowledge” Standard

In responding to the Commission's request for comment on the definition of “website or online service directed to children,” a number of commenters recommended that the Commission revise COPPA's actual knowledge standard by moving to a constructive knowledge standard.

Namely, these commenters sought to bring within COPPA's jurisdiction those operators that have reason to know they may be collecting information from a child and those operators that willfully avoid gaining actual knowledge that they are collecting information from a child. Common Sense Media, for example, encouraged the Commission to broaden its view of “actual knowledge” to prevent the “willful disregard that children's personal[ ] information is being collected.”

Other commenters, referencing the California Consumer Privacy Act, similarly recommended that COPPA's actual knowledge standard should cover operators of general audience sites and services that ignore or willfully disregard the age of their users.

Children's privacy advocate 5Rights Foundation further recommended that the Commission should consider current and historic audience composition evidence of both the specific service and similar services in determining whether an operator has met the actual knowledge standard.

See, e.g.,

London School of Economics and Political Science, at 9 (noting that the FTC should re-examine its definition of child-directed websites and online services to include “`constructive knowledge'

i.e.,

what an operator ought to know about its users if they have carried their work in due diligence”) (bold typeface omitted); S. Egelman, at 3-4 (asserting that “actual knowledge” should include third-party recipients of data from a mobile app that can be identified as child-directed); Color of Change, at 4-5 (advocating that the FTC should move from an actual knowledge standard to a constructive knowledge standard); SuperAwesome, at 18 (recommending the Commission amend the definition of “website or online service directed to children” to include situations where an operator has, or should be reasonably expected to have, actual knowledge that it is collecting information from children or from users of a child-directed website or online service).

Common Sense Media, at 12.

5Rights Foundation, at 3-4; Consumer Reports, at 8-9.

5Rights Foundation, at 4.

A number of industry commenters opposed the Commission adopting a constructive knowledge standard. Several of these commenters pointed to the COPPA statute's language

and argued that the Commission lacks authority to change the actual knowledge standard.

Others asserted that a constructive knowledge standard would result in operators collecting additional data from all users, including children, and might lead to a reduction in available online content because operators may decide to withdraw content intended for teenagers and young adults to avoid the risk of interacting with children.

Additionally, the Association of National Advertisers stated that a constructive knowledge standard would conflict with the Commission's long-established position that operators are not obligated to investigate the age of their users

and would increase uncertainty about companies' potential COPPA obligations.

Similarly, Engine, a non-profit policy organization, noted that moving from the “bright-line” standard of actual knowledge to a less clear constructive knowledge standard could disproportionately burden small companies and start-ups.

15 U.S.C. 6502(a)(1) (providing that “[i]t is unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under subsection (b)”).

See, e.g.,

ANA, at 4-5; Interactive Advertising Bureau (“IAB”), at 4-5; internet Association, at 19; Software & Information Industry Association (“SIIA”), at 4; The Toy Association, at 3, 8, 10, 16.

See, e.g.,

Family Online Safety Institute (“FOSI”), at 6 (noting that “[i]f a constructive knowledge standard were imposed, it is likely that all general audience sites and services would start treating all users as children, or turn off any services that might benefit minors clearly older than 13. This would have serious implications for free speech, or could lead to an increase in age gating, which is ineffective and often results—paradoxically—in increased collection of data from all users, including children”); Digital Content Next, at 1 (stating that “[w]e believe that expanding the actual knowledge standard might inadvertently harm the privacy of children in two ways. First, if COPPA were expanded to apply in situations where a company has no actual knowledge that the consumer is under 13 years of age or when the company is not providing services directed to children, companies would need to collect significantly more data from children and their parents or guardians to meet the obligations of COPPA including obtaining consent. Second, in order to avoid COPPA compliance, some companies may decide to withdraw content that is intended for teenagers or young adults in order to avoid the risk of interacting with children”).

See, e.g.,

64 FR 59888 at 59892 (noting that “COPPA does not require operators of general audience sites to investigate the ages of their site's visitors . . .”).

See

ANA, at 5.

Engine, at 5.

The Commission declines to change the Rule to bring operators of general audience sites and services under COPPA's jurisdiction based on constructive knowledge. As the Commission noted in 2011, Congress has already rejected a constructive knowledge approach with respect to COPPA. Specifically, the legislative history indicates that Congress originally drafted COPPA to apply to operators that “knowingly” collect personal information from children, a standard which would include actual, implied, or constructive knowledge.

After consideration of witness testimony, however, Congress modified the knowledge standard in the final legislation to require “actual knowledge.”

This deliberate decision to reject the more expansive approach makes clear that Congress did not intend for the “actual knowledge” standard to be read to include the concept of constructive knowledge. The Commission rejected calls for a move to a lesser knowledge standard for general audience operators while considering the 2013 Amendments,

and the Commission again declines to do so.

See

76 FR 59804 at 59806, n. 26 (citing Senate and House bills), noting that “Under federal case law, the term `knowingly' encompasses actual, implied, and constructive knowledge.”

Id.

(citing

internet Privacy Hearing: Hearing on S. 2326 Before the Subcomm. On Commc'ns of the S. Comm. On Commerce, Science, & Transp.,

105th Cong. 1069 (1998)).

See

76 FR 59804 at 59806.

As noted above, various commenters recommended that the Rule's actual knowledge standard cover operators of general audience sites and services that ignore or willfully disregard the age of their users.

See, e.g.,

Common Sense Media, at 12; 5Rights Foundation, at 3-4; Consumer Reports, at 8-9.

The concept of actual knowledge includes willful disregard.

See, e.g., Glob.-Tech Appliances, Inc.

SEB S.A.,

563 U.S. 754, 766 (2011) (noting that “[i]t is also said that persons who know enough to blind themselves to direct proof of critical facts in effect have actual knowledge of those facts”). Therefore, the Rule already applies to instances in which an operator of a general audience site or service willfully disregards the fact that a particular user is a child.

III. Comments on the Rebuttable Presumption

Operators of websites or online services directed to children that collect personal information from their users must comply with COPPA regardless of whether they have actual knowledge that a particular user is, in fact, a child. Accordingly, as a practical matter, operators of child-directed sites and services must presume that all users are children.

See, e.g.,

78 FR 3972 at 3984 (“The Commission retains its longstanding position that child-directed sites or services whose primary target audience is children must continue to presume all users are children and to provide COPPA protections accordingly”).

Through the 2013 Amendments, the Commission extended COPPA liability to operators that have actual knowledge

they are collecting personal information directly from the users of another website or online service that is child-directed.

Under the Rule, such an operator “has effectively adopted that child-directed content as its own and that portion of its service may appropriately be deemed to be directed to children.”

See

16 CFR 312.2, definition of “website or online service directed to children,” paragraph 2.

78 FR 3972 at 3978.

The Commission sought comments in its 2019 Rule Review Initiation on whether it should permit general audience platforms that allow third parties to upload content to the platform to rebut the presumption that all users of uploaded child-directed content are in fact children. In seeking comment on this issue, the Commission stated that absent actual knowledge that the uploaded content is child-directed, the platform operator is not responsible for complying with the Rule. Therefore, the FTC noted that the platform operator may have an incentive to avoid gaining knowledge about the nature of the uploaded content.

The Commission asked whether allowing general audience platform operators to rebut this presumption, thereby allowing them to treat users under age 13 differently from older users, would incentivize platform operators to take affirmative steps to identify child-directed content and treat users of that content in accordance with the Rule. The Commission also asked about the types of steps platforms could take to overcome the presumption that all users of child-directed content are children.

84 FR 35842 at 35845-35846. In extending liability to operators of general audience sites and services with actual knowledge, the Commission discussed, but expressly rejected, imposing a “reason to know” standard. 78 FR 3972 at 3977-78. Accordingly, the 2013 Amendments do not impose a duty on operators of general audience websites and online services to investigate whether they are collecting personal information from users of child-directed sites or services.

Relying on a variety of arguments, many consumer and privacy advocates opposed the notion of modifying the Rule to allow operators of general audience platforms to rebut the presumption that users of child-directed content uploaded to the platform by third parties are children. For example, a coalition of consumer organizations argued against allowing general audience platforms to rebut the presumption, pointing to the fact that families often share devices, accounts, and apps and that, as a result, many children likely access child-directed content while logged into a parent's account. Because of this, they argued that if the FTC modifies the presumption, “it would lead to widespread mislabeling of children as adults and large numbers of under-protected children.”

Other commenters echoed the concern that because users in a household may share devices that are persistently signed in, operators may incorrectly determine that a user is an adult.

Georgetown University Law Center's Institute for Public Representation submitted a joint comment on behalf of the following nineteen consumer groups: Campaign for a Commercial-Free Childhood; The Center for Digital Democracy; Alana Institute; American Academy of Pediatrics; Badass Teachers Association; Berkeley Media Studies Group; Consumer Action; Consumer Watchdog; Defending the Early Years; Electronic Frontier Foundation; Obligation, Inc.; P.E.A.C.E (Peace Educators Allied for Children Everywhere); Parent Coalition for Student Privacy; Parents Across America; Parents Television Council; Public Citizen; Story of Stuff; TRUCE (Teachers Resisting Unhealthy Childhood Entertainment); and U.S. PIRG (“Joint Consumer Groups”), at iii, 35-36.

See, e.g.,

Consumer Reports, at 19 (“[B]rowsers and other connected services are increasingly using always-logged-in features in order to make the browsing experience more seamless across devices . . . Although this allows the company to easily sync data across devices, it means that if a child then uses that device to go to YouTube [K]ids or another service it will appear that an adult is logged on and viewing the content”); SuperAwesome, at 28 (“Given the prevalence of shared devices, the only current method to safely detect whether a child or an adult is viewing particular content is by virtue of the type of content. E.g., preschool content is mostly likely viewed by preschoolers. We are particularly concerned about logged-in parents on kids' content, where there is a presumption that the adult is enjoying the kids' content. In our experience, this is rarely the case. In the vast majority of situations it is a child using an adult's device. For this reason, the only safe approach is to default to considering the user a child based on a subjective assessment of the content”) (bold typeface omitted).

Another commenter, while acknowledging the “perverse incentive” operators have to avoid gaining actual knowledge, raised concern about operators' ability to effectively establish which of their users are children.

The commenter argued that, until operators are transparent about methods used to determine which users are children and such methods are deemed effective, permitting operators to rebut the presumption may result in children being treated as adults.

5Rights Foundation, at 4 (also arguing that that the most privacy-protective way of addressing the incentive is to make it more difficult for operators to avoid gaining actual knowledge).

See also

Consumer Reports, at 18-19 (raising concern about the lack of transparency as to how general audience services determine the population of children that use the service).

5Rights Foundation, at 4.

One commenter argued that, “in the vast majority of cases,” users of child-directed content are, in fact, children.

This commenter further stated that allowing operators to rebut the presumption would prioritize allowing companies to engage in targeted advertising over ensuring that general audience platforms comply with COPPA.

Another commenter noted that, despite the alleged existence of subcultures of adult viewership of kids' content, the adult viewership of such content is likely very small.

The commenter further argued that protecting those adults' right to receive personalized advertising does not outweigh the risk of collecting personal data from children and tracking them online.

Consumer Reports, at 19.

Id.

SuperAwesome, at 27.

Id. See also

P. Aftab, at 15 (arguing that the convenience of adults accessing child-directed material should not outweigh children's privacy).

A number of State Attorneys General argued that modifying the Rule to allow rebuttal is unlikely to incentivize platforms to identify and police child-directed content.

These commenters claimed that, even with the ability to rebut the presumption, platforms would have a greater incentive not to know about the presence of child-directed content because this would allow them to collect data for targeted ads from all users.

Additionally, an FTC-approved COPPA Safe Harbor program argued that allowing rebuttal would “be complex and unfairly benefit large tech companies who may be the only companies with the wherewithal, rich customer data, and back-end infrastructure to meet the criteria for rebuttal.”

Joint Attorneys General, at 13-14 (adding that they do not support permitting a rebuttable presumption absent robust measures—beyond logged in status or periodic reauthorization—to confirm a user is 13 or older, stating that such measures can include requiring operators to ask during the account creation process whether a child ever uses the account holder's device).

Id.

At 13.

kidSAFE, at 13 (also suggesting that the Rule's existing mixed audience category could potentially serve the underlying purpose of not treating child-directed content audiences as exclusively under 13).

On the other hand, a number of industry commenters supported allowing general audience platforms to rebut the presumption that all users of child-directed content are necessarily children. Google argued that rebuttal “with the appropriate safeguards, would allow those users to benefit from social engagement with the content and would allow content creators to benefit from increased monetization options, supporting continued investment in such content.”

Without the ability to rebut the presumption, Google argued that platforms must degrade adults' user

experience, including by preventing interactivity with other adults. Google also distinguished general audience platforms with third-party content from “static” child-directed websites intended for a single audience, noting that such platforms “have significant adult user bases that engage with traditionally child-directed content.”

Google, at 7-8, 11-12 (also arguing that allowing rebuttal does not require a Rule modification because the presumption is not codified in the COPPA statute or Rule).

Id.

At 8.

Other commenters made similar arguments. One trade association stated that some general audience platforms “have significant adult user bases” and feature child-directed content that may appeal to users of varying ages, such as crafting or science education content.

It claimed that the audience presumption harms adult users of child-directed content by denying them the ability “to find community, learn, and discover new content.”

Another trade association noted that adults might want “to interact with child-directed content for a variety of reasons, including nostalgia or to find content suitable for their children or students.”

SIIA, at 5.

Id.

CCIA, at 13.

A majority of the commenters that support modifying the Rule to permit rebuttal also recommended against the Commission proscribing specific means by which a general audience platform could rebut the presumption, calling instead for a flexible, standards-based approach that would allow platforms to employ a variety of measures to overcome the presumption. For example, citing “advancements in technology and age-screening,” one trade association recommended allowing rebuttal through reliance on a neutral age gate combined with additional steps to confirm identity, such as re-entry of a password.

The commenter also suggested that the Commission allow industry to explore alternative methods such as fingerprint, voiceprint, or device PIN.

Other commenters recommended similar flexibility in approach.

internet Association, at 18-19.

Id.

At 19.

See

Centre for Information Policy Leadership (“CIPL”), at 7 (supporting rebuttal where platforms take reasonable steps such as a neutral age gate plus additional verification, adding that the Commission should permit companies to adopt their own approach as long as they meet certain standards set by FTC); CCIA, at 14 (recommending the FTC adopt an “adaptable standards-based approach” for permitting general audience services to treat adult users interacting with child-directed content as adults, including the use of neutral age screening in conjunction with periodic password reauthorization and “verification methods that may be appropriate in additional contexts, such as submitting a voiceprint or device PIN”); Google, at 10-11 (recommending the FTC adopt a “reasonably calculated” standard similar to the parental consent standard that provides reasonable assurance that the person engaging with the content is an adult, and further suggesting use of a neutral age gate in combination with such mechanisms as password re-authentication, fingerprint, or device PINs); SIIA, at 5 (supporting a “standards-based approach to rebut presumption relying on neutral age gates plus additional steps like password authorization or alternative verification methods”); U.S. Chamber of Commerce, at 7 (supporting an adaptable standards-based approach rather than prescriptive measures); Yoti, at 16 (supporting the various mechanisms suggested in the Commission's 2019 Rule Review Initiation, but adding that because some may not work in certain circumstances, they should be options as opposed to a mandatory list).

Many of the comments supporting rebuttal of the presumption also argued against tying rebuttal to a requirement that the platform investigate and identify child-directed content on the platform. These commenters asserted that such a requirement would change the Rule's actual knowledge standard to a constructive knowledge standard, which would “contravene [c]ongressional intent”

and impose an unreasonable burden on platforms that would chill investment into the production of child-directed content.

One commenter cautioned that requiring the platform operators to identify whether uploaded content is child-directed could raise First Amendment concerns.

CCIA, at 14.

See

U.S. Chamber of Commerce, at 7; ANA, at 5-6; Google, at 11.

Center for Democracy & Technology (“CDT”), at 9 (further adding that the Commission should not consider costs and benefits unrelated to privacy (

e.g.,

exposure to age-inappropriate content) as such concerns fall outside COPPA's statutory focus).

But see

SuperAwesome, at 29 (recommending the Commission consider costs and benefits unrelated to privacy, noting that allowing a rebuttal “will significantly increase the risk of exposing children to inappropriate content, including inappropriate advertising, and potentially dangerous user-generated content”).

After reviewing the submitted comments, the Commission does not propose modifying the Rule to permit general audience platforms to rebut the presumption that all users of child-directed content are children. The Commission finds persuasive the concerns raised in the comments about the practicality of allowing operators of such platforms to rebut this presumption. In particular, the Commission believes that the reality of parents and children sharing devices, along with account holders remaining perpetually logged into their accounts, could make it difficult for an operator to distinguish reliably between those users who are children and those who are not.

The Commission recognizes that allowing platforms to rebut the presumption would permit additional forms of monetization and, in some instances, provide additional functionality and convenience for adults interacting with child-directed content. Such benefits, however, simply do not outweigh the important goal of protecting children's privacy. Moreover, as set forth in the Commission's 2019 Rule Review Initiation, the reason for considering whether to allow platforms to rebut the audience presumption was to create an incentive for them to “identify and police child-directed content uploaded by others.”

Many commenters supporting the addition of this rebuttal expressed strong opposition to such a duty, thereby undercutting the rationale for modifying the Rule.

84 FR 35842 at 35846.

Finally, through its recognition of the “mixed audience” category of websites and online services, the Commission essentially allows operators to rebut the presumption as to the users of a subset of child-directed sites and services that do not target children as their primary audience. For example, where third-party content on a platform is child-directed under the Rule's multi-factor test but the platform does not target children as its primary audience, the operator can request age information and provide COPPA protections only to those users who are under 13. The Commission believes the mixed audience category affords operators an appropriate degree of flexibility.

While it is possible that the sharing of devices between parents and children can lead to complexities in determining the “mixed audience” nature of a website or online service, the Commission believes on balance that there is value in continuing to allow for a mixed audience designation.

IV. Proposed Modifications to the Rule

As discussed in Part I, comments reflect overall support for COPPA and a recognition that it is an important and helpful tool for protecting children's online privacy. Additionally, many comments indicate support for the 2013 Amendments.

See, e.g.,

SuperAwesome; PRIVO; ESA; Electronic Privacy Information Center (“EPIC”); and Joint Consumer Groups.

But see, e.g.,

Skyship Entertainment; J. Johnston (J House Vlogs); H. and S. Jho (Sockeye Media LLC); and ICLE. These commenters, many of whom are content creators on YouTube, opposed the Rule changes and/or the FTC's 2019 enforcement action against Google LLC and its subsidiary YouTube, LLC (“YouTube Case”),

Federal Trade Commission & People of the State of New York

Google LLC & YouTube, LLC,

Case No. 1:19-cv-2642 (D.D.C. 2019),

available at https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3083-google-llc-youtube-llc.

These commenters asserted that the 2013 Amendments and the YouTube Case have affected the availability of children's content on YouTube due to creators' inability to monetize through personalized advertisements. Additional commenters criticized the 2013 Amendments for other reasons, such as

purported negative consequences to industry or beliefs that the 2013 Amendments strayed from the purpose of the COPPA statute.

See, e.g.,

Committee for Justice; TechFreedom; and Competitive Enterprise Institute.

Despite this overall support, the Commission believes it is appropriate to modify a number of the Rule's provisions in light of the record developed through the 2019 Rule Review Initiation—including the COPPA Workshop and the large number of public comments received—as well as the FTC's two decades of experience enforcing the Rule. The Commission intends these modifications to update certain aspects of the Rule, taking into account technological and other relevant developments, and to provide additional clarity to operators on the Rule's existing requirements. Specifically, the Commission proposes modifying most provisions of the Rule, namely the following areas: Definitions; Notice; Parental Consent; Parental Right to Review; Confidentiality, Security, and Integrity of Children's Personal Information; Data Retention and Deletion; and Safe Harbor Programs. In addition, the Commission proposes minor modifications to the sections on Scope of Regulations and Voluntary Commission Approval Processes to address technical corrections.

Additionally, the Commission proposes some revisions to the Rule to address spelling, grammatical, and punctuation issues. For example, as noted above, the Commission proposes to modify § 312.1 regarding the scope of regulations, specifically to change the location of commas. Similarly, the Commission proposes amending the Rule to change the term “Web site” to “website” throughout the Rule, including in various definitions that use this term. This construction aligns with the COPPA statute's use of the term, as well as how that term is currently used in today's marketplace. This NPRM incorporates this proposed change in all instances in which the term “Web site” is used. The Commission does not intend for these proposed modifications to alter existing obligations or create new obligations under the Rule.

A. Definitions (16 CFR 312.2)

The Commission proposes to modify a number of the Rule's definitions in order to update the Rule's coverage and functionality and, in certain areas, to provide greater clarity regarding the Rule's intended application. The Commission proposes modifications to the definitions of “online contact information” and “personal information.” The Commission also proposes modifications to the definition of “website or online service directed to children,” including by adding a stand-alone definition for “mixed audience website or online service.” Additionally, the Commission proposes adding definitions for “school” and “school-authorized education purpose.” These two new definitions relate to the Rule's proposed new parental consent exception—a codification of longstanding Commission guidance by which operators rely on school authorization to collect personal information in limited circumstances rather than on parental consent. Finally, the Commission proposes modifications to the second paragraph of the definition of “support for the internal operations of the website or online service.”

1. Online Contact Information

Section 312.2 of the Rule defines “online contact information” as “an email address or any other substantially similar identifier that permits direct contact with a person online, including but not limited to, an instant messaging user identifier, a voice over internet protocol (VOIP) identifier, or a video chat user identifier.” Online contact information is considered “personal information” under the Rule. Under certain parental consent exceptions, the Rule permits operators to collect online contact information from a child for certain purposes, such as initiating the process of obtaining verifiable parental consent, without first obtaining verifiable parental consent.

To improve the Rule's functionality, the Commission proposes amending this definition by adding “an identifier such as a mobile telephone number provided the operator uses it only to send a text message” to the non-exhaustive list of identifiers that constitute “online contact information.” As discussed later in this Part, this modification would allow operators to collect and use a parent's or child's mobile phone number in certain circumstances, including in connection with obtaining parental consent through a text message.

Although the Commission did not raise the issue of adding mobile telephone numbers to the online contact information definition in its 2019 Rule Review Initiation, some commenters supported such a modification in discussing the Rule's parental consent requirement.

One commenter noted that parents increasingly rely on telephone and cloud-based text messaging services,

and another similarly noted that permitting parents to utilize text messages to provide consent would be more in sync with current technology and parental expectations.

Commenters also stated that mobile communication mechanisms are more likely to result in operators reaching parents for the desired purpose of providing notice and obtaining consent, and that sending a text message may be one of the most direct and easily verifiable methods of contacting a parent.

Further, one commenter posited that the chance of a child submitting his or her own mobile number in order to circumvent a valid consent mechanism is no greater than, for instance, a child submitting his or her own email address.

See, e.g.,

kidSAFE, at 3-4. More generally, several other commenters recommended modifying the Rule to allow the use of text messaging in connection with obtaining parental consent.

See

The Toy Association, at 4; ESA, at 24-26; ANA, at 12; Entertainment Software Rating Board (“ESRB”), at 8.

kidSAFE, at 4.

ESA, at 24-25.

kidSAFE, at 3-4; ANA, at 12.

kidSAFE, at 4.

The Commission agrees that permitting parents to provide consent via text message would offer them significant convenience and utility. The Commission also recognizes that consumers are likely accustomed to using mobile telephone numbers for account creation or log-in purposes. For these reasons, the Commission is persuaded that operators should be able to collect parents' mobile telephone numbers as a method to obtain consent from the parent. Therefore, the Commission proposes adding mobile telephone numbers to the definition of “online contact information.”

Modifying the definition in this way, however, will also enable operators to collect and use a child's mobile telephone number to communicate with the child, including—under various parental consent exceptions—prior to the operator obtaining parental consent.

The Commission does not seek to allow operators to use children's mobile telephone numbers to call them prior to the operator obtaining parental consent. Therefore, the Commission proposes including the qualifier “provided the operator uses it only to send a text message” to ensure that operators cannot call the child using the mobile telephone number, unless and until the operator seeks and obtains a parent's verifiable parental consent to do so.

16 CFR 312.5(c)(1), (3), (4), (5), and (6).

Because various parental consent exceptions allow operators to collect a child's “online contact information” without first obtaining verifiable parental consent, the Commission proposes limiting operators from using such information to call a child. However, this proposal does not prevent an

operator from making telephone calls after the operator has obtained consent. Indeed, the definition of “personal information” includes a telephone number under COPPA and the COPPA Rule, and neither the statute nor the Rule includes a prohibition on using that information to make telephone calls.

This proposed modification is a departure from the position the Commission previously took when it declined to include mobile telephone numbers within the definition of “online contact information.” In discussing the 2013 Amendments, the Commission stated that the COPPA statute did not contemplate adding mobile telephone numbers as a form of online contact information, and therefore it determined not to include mobile telephone numbers within the definition.

However, the Commission also stated at that time that the list of identifiers constituting online contact information was non-exhaustive and would encompass other substantially similar identifiers that permit direct contact with a person online.

As part of the 2013 Amendments, the Commission revised the definition to include examples of such identifiers, and the Commission now believes that adding mobile telephone numbers to this list is appropriate.

See

78 FR 3972 at 3975. At that time, the Commission also questioned whether adding mobile telephone numbers would result in greater convenience for parents in providing consent, noting that children might have difficulty distinguishing between a parent's mobile number and a landline number.

See

78 FR 3972 at 3975. This concern seems less significant today given that many more consumers now rely exclusively on their mobile phone.

78 FR 3972 at 3975, citing 76 FR 59804 at 59810.

Specifically, consumers today widely use over-the-top messaging platforms, which are platforms that utilize the internet instead of a carrier's mobile network to exchange messages. These platforms include Wi-Fi messaging applications, voice over internet protocol applications that have messaging features, and other messaging applications. Because a consumer's mobile telephone number is often used as the unique identifier through which a consumer can exchange messages through these over-the- top platforms, mobile telephone numbers permit direct contact with a person online, thereby meeting the statutory requirements for this definition.

15 U.S.C. 6501(12) (providing that “the term `online contact information' means an email address or

another substantially similar identifier that permits direct contact with a person online”

(emphasis added)).

When the Commission enacted the 2013 Amendments, the use of over-the-top messaging platforms was more nascent and growing in adoption. Today, the prevalent and widespread adoption of such messaging platforms allows consumers to use these platforms as their primary form of text messaging. Therefore, the Commission finds it appropriate to propose amending the definition of “online contact information” to include “an identifier such as a mobile telephone number provided the operator uses it only to send a text message.” The Commission welcomes comment on this proposed modification. In particular, the Commission is interested in understanding whether allowing operators to contact parents through a text message to obtain verifiable parental consent presents security risks to the recipient of the text message, especially if the parent would need to click on a link provided in the text message.

2. Personal Information

The COPPA statute defines “personal information” as individually identifiable information about an individual collected online, including, for example, a first and last name, an email address, or a Social Security number.

The COPPA statute also includes within the definition “any other identifier that the Commission determines permits the physical or online contacting of a specific individual.”

See

15 U.S.C. 6501(8).

15 U.S.C. 6501(8)(F). As part of the 2013 Amendments, the Commission used this statutory authority to add several new identifiers to the COPPA Rule's definition of “personal information.”

See

78 FR 3972 at 3978-83. For example, the Commission added a photograph, video, or audio file containing a child's image or voice, and it also included geolocation information sufficient to identify street name and name of a city or town. Additionally, the Commission added persistent identifiers that can be used to recognize a user over time and across different websites or online services, which the Rule had previously only covered when associated with individually identifiable information.

See

64 FR 59888 at 59912.

a. Biometric Data

The Commission proposes using its statutory authority to expand the Rule's coverage by modifying the Rule's definition of “personal information” to include “[a] biometric identifier that can be used for the automated or semi-automated recognition of an individual, including fingerprints or handprints; retina and iris patterns; genetic data, including a DNA sequence; or data derived from voice data, gait data, or facial data.”

The Commission believes this proposed modification is necessary to ensure that the Rule is keeping pace with technological developments that facilitate increasingly sophisticated means of identification.

Given that the Rule's definition of “personal information” currently includes “a photograph, video, or audio file where such file contains a child's image or voice,” the Commission believes facial features, voice, and gait are already covered under the Rule. 16 CFR 312.2, definition of “personal information,” paragraph 8. However, in light of the inherently personal and sensitive nature of data derived from voice data, gait data, and facial data, the Commission proposes to cover this data within the proposed list of biometric identifiers.

The majority of comments addressing the question of whether to expand the Rule's definition of “personal information” supported the addition of biometric data.

These commenters asserted that different types of biometric data can be used to contact specific individuals. For example, a coalition of consumer groups recommended adding biometric data, including genetic data, fingerprints, and retinal patterns, to the Rule's enumerated list of “personal information.”

These commenters cited consumer products' current use of biometrics to identify and authenticate users through such mechanisms as fingerprints and face scans.

They also noted that while some types of personal information may be altered to protect privacy, biometric data collected today may be used to identify and contact specific children for the rest of their lives.

Several other commenters also argued that the permanent and unalterable nature of biometric data makes it particularly sensitive.

Additional commenters noted that many states have expanded the definition of personally identifiable information to include biometric data as have other federal laws and regulations, such as the Department of Education's Family Educational Rights and Privacy Act (“FERPA”) Regulations, 34 CFR 99.3.

See, e.g.,

Attorney General of Arizona, at 2; Joint Attorneys General, at 7; Consumer Reports, at 14; SuperAwesome, at 12; CARU, at 3-5; ESRB, at 5; and kidSAFE, at 6.

Joint Consumer Groups, at 52-53.

Id.

at 53 (citing Heather Kelly,

Fingerprints and Face Scans Are the Future of Smartphones. These Holdouts Refuse to Use Them,

Wash. Post (Nov. 15, 2019)).

Joint Consumer Groups, at 53.

CARU, at 4; H. Adams, at 3; Joint Attorneys General, at 7, 11-12.

Future of Privacy Forum (“FPF”), at 4-5; D. Derigiotis Burns Wilcox, at 1-2.

A small number of commenters urged the Commission to proceed cautiously with respect to adding biometric data to the Rule's personal information definition. These commenters suggested that such an expansion could stifle innovation

or questioned whether biometric data allows the physical or online contacting of a specific individual.

Some commenters also

recommended that, if the Commission does define biometric data as personal information, it should consider appropriate exceptions, for example, where the data enhances the security of a child-directed service

or the operator promptly deletes the data.

The App Association (“ACT”), at 4.

CCIA, at 4; The Toy Association, at 3, 17.

The Toy Association, at 3, 17.

kidSAFE, at 6.

The Commission believes that, as with a photograph, video, or audio file containing a child's image or voice, biometric data is inherently personal in nature. Indeed, the Commission agrees with the many commenters

who argued that the personal, permanent, and unique nature of biometric data makes it sensitive, and the Commission believes that the privacy interest in protecting such data is a strong one.

See, e.g.,

Joint Consumer Groups, at 53; CARU, at 3-5; H. Adams, at 3; Joint Attorneys General, at 11-12.

And, as with some facial and voice recognition technologies, the Commission believes that biometric recognition systems are sufficiently sophisticated to permit the use of identifiers such as fingerprints and handprints; retina and iris patterns; genetic data, including a DNA sequence; and data derived from voice data, gait data, or facial data to identify and contact a specific individual either physically or online.

The Commission notes that the specific biometric identifiers that it proposes adding to the Rule's personal information definition are examples and not an exhaustive list. The Commission welcomes further comment on this proposed modification, including whether it should consider additional biometric identifier examples and whether there are appropriate exceptions to any of the Rule's requirements that it should consider applying to biometric data, such as exceptions for biometric data that has been promptly deleted.

b. Inferred and Other Data

In addition to biometric data, the Commission also asked for comment on whether it should expand the Rule's definition of “personal information” to include data that is inferred about, but not directly collected from, children, or other data that serves as a proxy for “personal information.” Several commenters recommended such an expansion.

100

For example, one commenter stated that inferred data, including predictive behavior, is often incredibly sensitive and that even when it is supplied in the aggregate, can be easily re-identified.

101

The commenter also noted that certain State laws include inferred data in their definitions of personally identifiable information.

102

Another pointed to the ability of analysts to infer personal information that the Rule covers, such as an individual's geolocation, from data that currently falls outside the Rule's scope.

103

100

See, e.g.,

Joint Consumer Groups, at 53-54 (supporting the inclusion of inferred data); London School of Economics, at 1, 9 (supporting the inclusion of inferred data from profiling and other data analytics); SuperAwesome, at 18 (supporting the inclusion of inferred data, health and activity information derived from fitness trackers, and household viewing data from automated content recognition systems in televisions and video streaming devices); C. Frascella, at 2-3 (supporting the inclusion of personal information collected from children through digital reproduction technology); Parent Coalition for Student Privacy, at 5-8 (supporting, among other things, the inclusion of inferred data and proxy data, such as the language spoken at home and the length of time the child has lived in the United States); UnidosUS (“Unidos”), at 5 (urging the Commission to study the use of “cultural cues” as personal information).

See also

CCIA, at 4 (asserting that the COPPA Rule already covers the processing of personal information to derive inferences about a specific user and that the use of aggregated data that does not relate to a specific user is outside the scope of the COPPA statute's definition of “personal information”).

105

See, e.g.,

IAB, at 4; The Toy Association, at 16-17.

106

See

CIPL, at 2; U.S. Chamber of Commerce, at 3; IAB, at 4; internet Association, at 5-6; PRIVO, at 8.

The Commission has decided not to propose including inferred data or data that may serve as a proxy for “personal information” within the definition. As several commenters correctly note, the COPPA statute expressly pertains to the collection of personal information

from

a child.

107

Therefore, to the extent data is collected from a source other than the child, such information is outside the scope of the COPPA statute and such an expansion would exceed the Commission's authority. Inferred data or data that may serve as a proxy for “personal information” could fall within COPPA's scope, however, if it is combined with additional data that would meet the Rule's current definition of “personal information.” In such a case, the existing “catch-all” provision of that definition would apply.

108

107

15 U.S.C. 6502(a)(1).

108

See

16 CFR 312.2, definition of “personal information,” paragraph 10 (defining “personal information” to include “[i]nformation concerning the child or the parents of that child that the operator collects online from the child and combines with an identifier described in this definition”).

c. Persistent Identifiers

In 2013, the Commission used its authority under 15 U.S.C. 6501(8)(F) to modify the Rule's definition of “personal information” to include persistent identifiers that can be used to recognize a user over time and across different websites or online services. Prior to that change, the Rule covered persistent identifiers only when they were combined with certain types of identifying information.

109

As part of the 2019 Rule Review Initiation, the Commission asked for comment on whether this modification has resulted in stronger privacy protections for children. The Commission also asked whether the modification has had any negative consequences.

109

See

64 FR 59888 at 59912.

A number of commenters, citing a variety of reasons, argued that the amendment to include “stand-alone” persistent identifiers as personal information was incorrect or had caused harm. Several commenters claimed that persistent identifiers alone do not allow for the physical or online contacting of a child, and thus should not be included unless linked to other forms of personal information.

110

Commenters also argued

that the persistent identifier modification harmed both operators and children. Specifically, some commenters pointed to operators' lost revenue from targeted advertising, which requires collection of persistent identifiers, and the resulting reduction of available child-appropriate content online due to operators' inability to monetize such content.

111

One commenter stated that while the 2013 modification “served the widely held goal of excluding children from interest-based advertising,” it created uncertainty for operators' use of data for internal operations.

112

The commenter suggested that the Commission consider exempting persistent identifiers used for internal operations from the Rule's deletion requirements.

113

110

See, e.g.,

TechFreedom, at 8 (“[P]ersistent identifiers on their own can only identify a device, not a `specific person' as the COPPA statute requires”); Competitive Enterprise Institute, at 2 (“[P]ersistent online identifiers do not `permit[] the physical or online contacting of a specific individual' in the sense that Congress contemplated when it enacted COPPA in 1998”); ICLE, at 6 (“Neither IP addresses nor device identifiers alone `permit the physical or online contacting of a specific individual' as required by 15 U.S.C. 6501(8)(F)”); NetChoice, at 3 (“Persistent

identifiers, like cookies, only identify devices—not a person”).

111

See, e.g.,

ICLE, at 7-12. These commenters also included content creators on YouTube.

See, e.g.,

Skyship Entertainment; J. Johnston (J House Vlogs); H. and S. Jho (Sockeye Media LLC).

See also

CARU, at 1 (noting that “[t]he addition of `persistent identifier' to the definition of `Personal Information' has resulted in improved privacy protections for children but has had negative consequences for industry, specifically the lack of robust and creative child-directed content”); IAB, at 4 (noting that this modification may have had the unintended effect of reducing the availability of children's online content).

112

CCIA, at 3.

113

Id.

In contrast, other commenters expressed strong support for the 2013 persistent identifier modification. For example, while acknowledging that it took time for the digital advertising industry to adapt to the new definition, one commenter described the 2013 modification as “wholly positive.”

114

The commenter also noted that the change recognized that unique technical identifiers might be just as personal as traditional identifiers such as name or address when used to contact, track, or profile users.

115

The commenter stated that this change “laid the groundwork for many countries adopting this expanded definition of personal information in their updated privacy laws.”

116

114

SuperAwesome, at 18.

115

Id. See also

Princeton University Center for Information Technology Policy (“Princeton University”), at 4 (“In the most recent COPPA Rule revision, the FTC recognized that `persistent identifiers' are a form of `personal information,' because they enable singling out a specific user through their device for contact. This makes sense; we see no basis in computer science for treating persistent identifiers any differently from other means of directing communications, such as telephone numbers or email addresses. While the technical details differ, the use of the information is the same”).

116

SuperAwesome, at 18. This commenter also recommended that the Commission expand the “personal information” definition's non-exhaustive list of persistent identifiers to include “device ID, [a]dvertising ID or similar” IDs and a “user agent or other device information which, when combined, can be used to create a unique fingerprint of the device.” SuperAwesome, at 17. Because the Rule provides examples of persistent identifiers rather than an exhaustive list, the Commission does not find it necessary to include these elements within the definition.

After reviewing the comments relevant to this issue, the Commission has decided to retain the 2013 modification including stand-alone persistent identifiers as “personal information.” The Commission is not persuaded by the argument that persistent identifiers must be associated with other individually identifiable information to permit the physical or online contacting of a specific individual. The Commission specifically addressed, and rejected, this argument during its discussion of the 2013 Amendments. There, the Commission rejected the claim that persistent identifiers only permit contact with a device. Instead, the Commission pointed to the reality that at any given moment a specific individual is using that device, noting that this reality underlies the very premise behind behavioral advertising.

117

The Commission also reasoned that while multiple people in a single home often use the same phone number, home address, and email address, Congress nevertheless defined these identifiers as “individually identifiable information” in the COPPA statute.

118

The adoption of similar approaches in other legal regimes enacted since the 2013 Amendments further supports the Commission's position.

119

117

78 FR 3972 at 3980.

118

Id.

(citing 15 U.S.C. 6501(8)).

119

See

The European Union's General Data Protection Regulation (“GDPR”), which defines “personal data” as “any information relating to an identified or identifiable natural person . . . [A]n identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as . . . an online identifier.” GDPR, Article 4,

available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016R0679-20160504&qid=1532348683434.

Recital 30 of the GDPR notes that “natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as [I]nternet [P]rotocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags.” Recital 30,

available at https://eur-lex.europa.eu/eli/reg/2016/679.

The California Privacy Rights Act similarly defines “personal information” as “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household,” and includes identifiers such as online identifiers. Section 3, Title 1.81.5 of the CCPA, added to Part 4 of Division 3 of the California Civil Code § 1798.140(v). This approach is also consistent with the FTC's own precedent.

See Protecting Consumer Privacy in an Era of Rapid Change,

Federal Trade Commission (March 2012), available at

https://www.ftc.gov/sites/default/files/documents/reports/federal-trade-commission-report-protecting-consumer-privacy-era-rapid-change-recommendations/120326bprivacybreport.pdf; FTC Staff Report: Self-Regulatory Principles For Online Behavioral Advertising

(February 2009), available at

https://www.ftc.gov/sites/default/files/documents/reports/federal-trade-commission-staff-report-self-regulatory-principles-online-behavioral-advertising/p085400behavadreport.pdf.

Nor does the Commission find compelling the argument that the 2013 persistent identifier modification has caused harm by hindering the ability of operators to monetize online content through targeted advertising. One of the stated goals of including persistent identifiers within the definition of “personal information” was to prevent the collection of personal information from children for behavioral advertising without parental consent.

120

After reviewing the comments, the Commission has determined that the privacy benefits of such an approach outweigh the potential harm, including the purported harm created by requiring operators to provide notice and seek verifiable parental consent in order to contact children through targeted advertising.

121

120

78 FR 3972 at 3979-3981.

121

The Commission received comments from content creators who indicated that the 2013 Amendments resulted in the loss of the ability to monetize content through targeted advertising.

See

Skyship Entertainment; J. Johnston (J House Vlogs); H. and S. Jho (Sockeye Media LLC). As discussed in Part IV.A.2.c., the 2013 Amendments permit monetization through other avenues, such as contextual advertising, or through providing notice and seeking parental consent for the use of personal information for targeted advertising.

Moreover, it bears noting, as the Commission did in 2013, that the expansion of the personal information definition was coupled with a newly created exception that allows operators to collect persistent identifiers from children to provide support for the internal operations of the website or online service without providing notice or obtaining parental consent. One of these purposes is serving contextual advertising, which provides operators another avenue for monetizing online content. The Commission continues to believe that it struck the proper balance in 2013 when it expanded the personal information definition while also creating a new exception to the Rule's requirements.

3. School and School-Authorized Education Purpose

As discussed in Part IV.C.3.a., the Commission proposes codifying current guidance on ed tech

122

by adding an

exception for parental consent in certain, limited situations in which a school authorizes an operator to collect personal information from a child. The Commission also proposes adding definitions for “school” and “school-authorized education purpose,” terms that are incorporated into the functioning of the proposed exception and necessary to cabin its scope. Part IV.C.3.a. provides further discussion about these definitions.

122

Policy Statement of the Federal Trade Commission on Education Technology and the Children's Online Privacy Protection Act,

Federal Trade Commission (May 19, 2022), available at

https://www.ftc.gov/legal-library/browse/policy-statement-federal-trade-commission-education-technology-childrens-online-privacy-protection;ComplyingwithCOPPA:FrequentlyAskedQuestions

(“

COPPA FAQs”

FAQ Section N,

available at

https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions.

4. Support for the Internal Operations of the Website or Online Service

As discussed in Part IV.A.2.c., the 2013 Amendments expanded the definition of “personal information” to include stand-alone persistent identifiers “that can be used to recognize a user over time and across different websites or online services.”

123

The 2013 Amendments balanced this expansion by creating an exception to the Rule's notice and consent requirements for operators that collect a persistent identifier for the “sole purpose of providing support for the internal operations of the website or online service.”

124

The Rule defines “support for the internal operations of the website or online service” to include a number of specified activities and provides that the information collected to perform those activities cannot be used or disclosed “to contact a specific individual, including through behavioral advertising, to amass a profile on a specific individual, or for any other purpose.”

125

123

16 CFR 312.2, definition of “personal information,” paragraph 7.

124

16 CFR 312.5(c)(7).

125

16 CFR 312.2, definition of “support for the internal operations of the website or online service.” The definition includes activities such as those necessary to maintain or analyze the functioning of a site or service; personalize content; serve contextual advertising or cap the frequency of advertising; and protect the security or integrity of the user, site, or service.

A variety of commenters recommended modifying the definition of “support for the internal operations of the website or online service.” Multiple consumer and privacy advocates, academics, and one advertising platform called for the Commission to define “support for the internal operations” narrowly and thereby restrict the exception's use.

126

For example, a coalition of consumer groups argued that the current definition is overly broad, too vague, and allows operators to avoid or minimize their COPPA obligations.

127

These commenters cited the lack of clarity between data collection for permissible content personalization versus collection for impermissible behavioral advertising.

128

To prevent operators from applying the exception too broadly, the coalition recommended a number of modifications to the definition, including limiting “personalization” to user-driven actions and to exclude methods designed to maximize user engagement.

129

126

Joint Consumer Groups, at 48-52; S. Egelman, at 5-6 (stating that, from a technical standpoint, persistent identifiers are not needed to carry out the activities listed in the support for the internal operations of the website or online service definition); Princeton University, at 5-7 (expressing reservations about the scope of the internal operations exception); SuperAwesome, at 5-7 and 19-20 (noting that the industry-standard persistent identifiers are not needed for most internal operations and that the support for the internal operations exception should be significantly narrowed, if not eliminated).

127

Joint Consumer Groups, at 48-52.

128

Id.

at 48-49.

129

Id.

at 50-52.

Several commenters specifically recommended that the Commission exclude the practice of “ad attribution”—which allows the advertiser to associate a consumer's action with a particular ad—from the support for the internal operations definition.

130

A group of State Attorneys General argued that ad attribution is unrelated to the activities enumerated in the definition and that the practice “necessarily involves `recogniz[ing] a user over time and across different [websites] or online services.' ”

131

Another commenter argued that companies should not be able to track children across online services to determine which ads are effective because the harm to privacy outweighs the practice's negligible benefit.

132

130

Joint Attorneys General, at 8; Joint Consumer Groups, at 51-52; Consumer Reports, at 14-15.

131

Joint Attorneys General, at 8.

132

Consumer Reports, at 14-15 (noting that it is unclear whether companies are following COPPA's existing restraints on operators' use of the support for the internal operations exception).

In contrast, many industry commenters recommended that the Commission expand the list of activities that fall under the support for the internal operations definition. With respect to ad attribution, these commenters generally cited the practical need of websites and online services that monetize through advertising to evaluate the effectiveness of ad campaigns or to measure conversion in order to calculate compensation for advertising partners.

133

Some commenters characterized the practice as common and expected, and they argued that reducing the ability to monetize would result in the development of fewer apps and online experiences for children.

134

133

ESA, at 17-18; CARU, at 5; The Toy Association, at 14-15; NCTA, at 10.

See also

Committee for Justice, at 4.

134

See, e.g.,

kidSAFE, at 6.

Several commenters stated that ad attribution already falls within the definition but supported a Rule modification to make this clear.

135

One argued that the definition's prohibition on the collection of persistent identifiers for behavioral advertising “serves as a safeguard to assure that [attribution] is appropriately limited.”

136

135

See, e.g.,

The Toy Association, at 14-15; NCTA, at 10; ESA, at 18; CARU, at 5.

See also

PRIVO, at 8 (noting that “the Commission should make clear whether attribution and remarketing can be claimed to be support for internal operations”).

136

The Toy Association, at 15.

Commenters also recommended that a number of other practices should fall within the definition of “support for the internal operations of the website or online service.” These include additional ad measuring techniques,

137

different types of personalization activities,

138

product improvement,

139

and fraud detection.

140

137

See, e.g.,

ANA, at 11 (recommending including click/conversion tracking, ad modeling, and A/B testing, practices that provide operators with information about the value of their ads, reduce the need for behavioral targeted ads, and allow operators to determine the most “user-friendly” version of a site); Google, at 17 (recommending adding conversion tracking and ad modeling, which allow measuring the relevance and appropriateness of ads); IAB, at 3 (recommending including conversion tracking and advertising modeling because they “are fundamental activities that improve the customer and business experience without creating additional privacy risks to children”); internet Association, at 6-7 (recommending including click/conversion tracking and ad modeling support because they “support child-centered content creation and, in each case, can be undertaken without focusing on a specific child's behavior over time for targeting purposes”).

138

See, e.g.,

NCTA, at 9-10 (recommending including user-driven and user-engagement personalization to allow, for example, “activities to tailor users' experiences based on their prior interactions with a site or service (whether derived from predictive analytics, real-time behaviors, or both)”); Viacom, at 3 (requesting the Commission clarify that the definition includes “enhanced personalization techniques based on operator-driven first-party metrics and inferences about user interaction”); CCIA, at 5-6 (recommending including personalization to a user, such as “the recommendation of content based on prior activity on the website or online service”).

139

See, e.g.,

ANA, at 11; kidSAFE, at 7; Khan Academy, at 2-3 (noting that it is important to preserve the operator's ability to use data for educational research, product development, and to analyze the functioning of a product).

140

See, e.g.,

SIIA, at 5 (recommending amending (1)(v) of the definition to “[p]rotect the security or

integrity of the user, [website], or online service of the operator or its service providers”).

See also

kidSAFE, at 7 (recommending expanding the definition to include customer or technical support, market research and user surveys, demographic analysis, “or any other function that helps operate internal features and activities offered by a site or app”).

By expanding the definition of “personal information” to include stand-alone persistent identifiers, while at the same time creating an exception that allowed operators to collect such identifiers without providing notice and obtaining consent for a set of prescribed internal operations, the Commission struck an important balance between privacy and practicality in the 2013 Amendments.

141

After careful consideration of the comments that addressed the Rule's support for the internal operations definition, the Commission does not believe that significant modifications to either narrow or expand the definition are necessary.

141

See

78 FR 3972 at 3980 (noting that “the Commission recognizes that persistent identifiers are also used for a host of functions that have little or nothing to do with contacting a specific individual, and that these uses are fundamental to the smooth functioning of the internet, the quality of the site or service, and the individual user's experience”).

With respect to ad attribution, which generated significant commentary, the Commission believes the practice currently falls within the support for the internal operations definition. When it amended the definition in 2013, the Commission declined to enumerate certain categories of uses, including payment and delivery functions, optimization, and statistical reporting, in the Rule, stating that the definitional language sufficiently covered such functions as activities necessary to “ `maintain or analyze' the functions” of the website or service.

142

The Commission believes that ad attribution, where a persistent identifier is used to determine whether a particular advertisement led a user to take a particular action, falls within various categories, such as the concept of “payment and delivery functions” and “optimization and statistical reporting.” When used as a tool against click fraud, ad attribution also falls within the category of “protecting against fraud or theft,” an activity that served as a basis for the Commission's creation of the support for the internal operations exception.

143

That said, as the definition makes clear, the Commission would not treat ad attribution as support for the internal operations of the website or online service if the information collected to perform the activity is used or disclosed “to contact a specific individual, including through behavioral advertising, to amass a profile on a specific individual, or for any other purpose.”

144

142

Id.

at 3981.

143

76 FR 59804 at 59812; 77 FR 46643 at 46647-46648.

144

16 CFR 312.2, definition of “support for the internal operations of the website or online service,” paragraph 2. This restriction applies to each of the activities enumerated in the definition.

The definition's use restriction is an important safeguard to help ensure that operators do not misuse the exception that allows them to collect a persistent identifier in order to provide support for the internal operations without providing notice and obtaining consent.

145

The Commission appreciates the concerns expressed by some commenters that there is a lack of clarity in how operators implement the support for the internal operations exception and that certain operators may not comply with the use restriction. To increase transparency and to help ensure that operators follow the use restriction, the Commission proposes modifying the online notice requirements in § 312.4(d) to require any operator using the support for the internal operations exception to specifically identify the practices for which the operator has collected a persistent identifier and the means the operator uses to comply with the definition's use restriction.

146

145

16 CFR 312.5(c)(7).

146

See

Part IV.B.3. for further discussion of these proposed changes.

With respect to the other proposed additions, the Commission does not believe additional enumerated activities are necessary. Other proposed additions—such as personalization, product improvement, and fraud prevention—are already covered.

147

As the Commission noted in developing the 2013 Amendments, the Commission is cognizant that future technical innovation may result in additional activities that websites or online services find necessary to support their internal operations.

148

Therefore, the Commission reminds interested parties that they may utilize the process permitted under § 312.12(b) of the Rule, which allows parties to request Commission approval of additional activities to be included within the support for the internal operations definition based on a detailed justification and an analysis of the activities' potential effects on children's online privacy.

147

See, e.g.,

77 FR 46643 at 46647 (noting that “[b]y carving out exceptions for support for internal operations, the Commission stated it intended to exempt from COPPA's coverage the collection and use of identifiers for authenticating users, improving site navigation, maintaining user preferences, serving contextual advertisements, protecting against fraud or theft, or otherwise personalizing, improving upon, or securing a [website] or online service”).

148

78 FR 3972 at 3981.

Although the Commission does not find it necessary to modify the definition's enumerated activities, it does propose modifications to the definition's use restriction. Currently, the use restriction applies to each of the seven enumerated activities in the definition, and it states that information collected for those enumerated activities may not be used or disclosed to contact a specific individual, including through behavioral advertising, to amass a profile on a specific individual, or for any other purpose.

149

However, certain of these activities likely necessarily require an operator to contact an individual, for example in order to “[f]ulfill a request of a child as permitted by §§ 312.5(c)(3) and (4).”

150

Therefore, the Commission proposes clarifying language to indicate that the information collected for these enumerated activities may be used or disclosed to carry out the activities permitted under the support for the internal operations exception.

149

16 CFR 312.2, definition of “support for the internal operations of the website or online service,” paragraph 2.

150

16 CFR 312.2, definition of “support for the internal operations of the website or online service,” paragraph (1)(vii). For example, § 312.5(c)(3) allows an operator to “respond directly on a one-time basis to a specific request from the child.” The Commission notes that the exceptions set forth in §§ 312.5(c)(3) and (4) are limited to responding to a child's specific request. Such a response would not include contacting an individual for another purpose, including through behavioral advertising, amassing a profile on a specific individual, or for any other purpose.

In addition, the Commission proposes expanding its non-exhaustive list of use restrictions. The Commission agrees with commenters who argued that the support for the internal operations exception should not be used to allow operators to maximize children's engagement without verifiable parental consent. Therefore, the Commission proposes prohibiting operators that use this exception from using or disclosing personal information in connection with processes, including machine learning processes, that encourage or prompt use of a website or online service. This proposed addition prohibits operators from using or disclosing persistent identifiers to optimize user attention or maximize user engagement with the website or online service, including by sending notifications to prompt the child to engage with the site or service, without verifiable parental consent.

The Commission welcomes comment on whether there are other engagement

techniques the Rule should address. The Commission also welcomes comment on whether and how the Rule should differentiate between techniques used solely to promote a child's engagement with the website or online service and those techniques that provide other functions, such as to personalize the child's experience on the website or online service.

5. Website or Online Service Directed to Children

The Commission proposes a number of changes to the definition of “website or online service directed to children.” Overall, the Commission does not intend these proposed changes to alter the definition substantively; rather, the changes will provide additional insight into and clarity regarding how the Commission currently interprets and applies the definition.

a. Multi-Factor Test

The first paragraph of the definition sets forth a list of factors the Commission will consider in determining whether a particular website or online service is child-directed. The Commission received a significant number of comments regarding the Rule's multi-factor test. Several industry commenters encouraged the FTC to continue relying on a multi-factor test to determine whether a site or service is directed to children, balancing both context (

e.g.,

intent to target children, promoted to children, and empirical evidence of audience) and content (

e.g.,

subject matter, animation, and child-oriented activities) factors.

151

These commenters discouraged the FTC from relying on a single factor taken alone, arguing that a multi-factor evaluation allows flexibility and takes into account that some factors may be more or less indicative than others.

152

151

See, e.g.,

Google, at 15 (“By equally balancing both content and context factors in applying the multi-factor test, operators—including creators, developers and platforms—are less likely to be over- or under-inclusive in making determinations about child-directed services, particularly when decisions are being made at the margins. We are concerned that pulling out a single factor as a litmus test for child-directedness can lead to bad outcomes, resulting in the application of COPPA obligations to general audience content where it doesn't make sense to apply the same protections we'd apply to children's services”); internet Association, at 9 (“The Commission should continue to consider these factors holistically, with no single factor taking precedence over others. Reliance on a comprehensive multi-factor test that includes audience composition as one of many factors balances both content and context inputs and provides the flexibility needed to apply the Rule in the context of new technology and evolving platforms such as interactive media”).

152

See, e.g.,

internet Association, at 9; CIPL, at 3-4; Google, at 15-16; Pokémon Company International, Inc. (“Pokémon”), at 1-2; ESA, at 3-8.

See also

TechFreedom, at 19 (“The FTC should reinforce its prior decision to apply a `totality of circumstances' test in determining whether content is child-directed”).

At the same time, commenters also recommended that the Commission reevaluate the test's existing factors, claiming that some are outdated and no longer seem indicative of child-directed websites or online services. For example, several industry members noted that content styles such as animation are not necessarily determinative of whether a service is child-directed.

153

In addition, several industry members recommended that the FTC consider giving more weight to particular factors when determining whether a website or online service is directed to children or that it create a sliding scale for existing factors to provide more guidance for operators.

154

For example, a number of commenters recommended that the Commission weigh more heavily operators' intended audience as opposed to empirical evidence of audience composition.

155

153

See, e.g.,

ANA, at 8 (noting that animated content is often adult-oriented rather than child-oriented); Pokémon, at 2 (noting that popular adult animated content such as “Family Guy” or “South Park” illustrates that the use of animation is no longer a clear indicator that the use of animated characters is targeted to children); ESA, at 6 (asserting that the use of animated characters should not be given weight in video game and similar media contexts because video games are computer-generated media and therefore inherently utilize animated characters).

154

See, e.g.,

Pokémon, at 2 (suggesting “weighting” the factors); TRUSTe, LLC (“TRUSTe”), at 2 (noting that, while not dispositive, audience composition and target market factors will have a higher likelihood of determining that the service is child-directed); SuperAwesome, at 11 (suggesting the establishment of a roadmap for the Rule's scope to evolve from “content-based” to “user-based” factors, noting that “[t]oday, the best (and highly imperfect) method for determining whether a user is a child is by categori[z]ing the content being accessed,

e.g.

is it child-directed or not. In the near future, new technologies will make it possible to identify whether a user is a child on any website or app, and without collecting more personal information to verify age”).

155

See, e.g.,

ANA, at 8; J. Johnston (J House Vlogs), at 14; The Toy Association, at 10.

See also generally

Screen Actors Guild-American Federation of Television and Radio Artists (“SAG-AFTRA”), at 4-5 (asserting that, when applying the COPPA Rule to content creators who distribute their content on general audience platforms, the Commission should consider the content creators' knowledge and intent).

Several FTC-approved COPPA Safe Harbor programs suggested adding new factors to the Rule to help guide operators, including by adding an operator's self-categorization to third parties. One such program, for example, recommended considering marketing materials directed to third-party partners or advertisers, claiming that such materials can provide insights on the operator's target and users.

156

Another supported consideration of “whether an operator self-categorizes its website or online service as child-directed on third[-]party platforms.”

157

A third FTC-approved COPPA Safe Harbor program recommended requiring operators to periodically analyze the demographics of their audience or users and to consider consumer inquiries and complaints.

158

156

TRUSTe, at 1-2.

157

kidSAFE, at 7 (also recommending the addition of “video content” to the existing factor of “music or other audio content”).

158

CARU, at 6-7 (suggesting that such factors would be particularly relevant to sites or services that were not originally directed to children, but where the audience has reached a threshold level such that COPPA protections should apply).

Some commenters cautioned against relying on an operator's internal rating system or a third party's rating system as a factor.

159

One such commenter argued that relying on operators' internal rating systems would potentially punish those that engage in good faith, responsible review activities and might violate section 230 of the Communications Decency Act.

160

The commenter also argued that a third party's ratings do not constitute competent and empirical evidence regarding audience composition or evidence regarding the intended audience, and further argued that relying on such ratings increases an operator's risk of unexpected liability, particularly if the rating system may have been developed for a purpose unrelated to the COPPA Rule's factors.

161

159

See, e.g.,

ANA, at 8; ESRB, at 7.

160

ANA, at 8 (stating that “Section 230 of the Communications Decency Act explicitly states that no provider of an interactive computer service shall be held liable for `any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable.' As such, considering content moderation actions taken by companies to oversee content on their platforms as a basis for liability may be impermissible pursuant to the Communications Decency Act”).

161

ANA, at 8-9.

The Commission continues to believe that the Rule's multi-factor test, which applies a “totality of the circumstances” standard, is the most practical and effective means for determining whether a website or online service is directed to children. The determination of whether a given site or service is child-directed is necessarily fact-based and requires flexibility as individual factors may be more or less relevant depending on the context. Moreover, a requirement that the Commission, in all cases, weigh more heavily certain factors could unduly hamper the Commission's law enforcement efforts. For example, it is

not hard to envision operators circumventing the Rule by claiming an “intended” adult audience despite the attributes and overall look and feel of the site or service appearing to be directed to children.

162

Additionally, a rigid approach that prioritizes specific factors is unlikely to be nimble enough to address a site or service that changes its characteristics over time.

162

Indeed, the Commission has previously acknowledged that a website or online service with the attributes, look, and feel of a property targeted to children would be deemed directed to children even if an operator claims that was not the intent. 78 FR 3972 at 3983.

The Commission does not propose eliminating any of the existing factors or modifying how it applies the multi-factor test.

163

However, the Commission proposes modifications to clarify the evidence the Commission will consider regarding audience composition and intended audience.

163

With respect to animation as a factor, the Commission recognizes that a variety of adult content uses animated characters. By the same token, animation can be an important characteristic of child-directed sites and services. Accordingly, as with the other enumerated factors, animation continues to be one of several potentially relevant considerations the Commission will take into account in determining whether a specific site or service is directed to children.

Specifically, the Commission proposes adding a non-exhaustive list of examples of evidence the Commission will consider in analyzing audience composition and intended audience. The Commission agrees with those commenters that argued that an operator's marketing materials and own representations about the nature of its site or service are relevant. Such materials and representations can provide insight into the operator's understanding of its intended or actual audience and are thus relevant to the Commission's analysis. Additionally, the Commission believes that other factors can help elucidate the intended or actual audience of a site or service, including user or third-party reviews and the age of users on similar websites or services. Therefore, the Commission proposes adding “marketing or promotional materials or plans, representations to consumers or to third parties, reviews by users or third parties, and the age of users on similar websites or services” as examples of evidence the Commission will consider. Because many of these examples can provide evidence as to both audience composition and intended audience, the Commission also proposes a technical fix to remove the comma between “competent and reliable empirical evidence regarding audience composition” and “evidence regarding the intended audience.”

b. Operators Collecting Personal Information From Other Websites and Online Services Directed to Children

The second paragraph of the definition of “website or online service directed to children” states “[a] website or online service shall be deemed directed to children when it has actual knowledge that it is collecting personal information directly from users of another website or online service directed to children.”

164

The Commission added this language in 2013, along with parallel changes to the definition of “operator,” in order “to allocate and clarify the responsibilities under COPPA” of third parties that collect information from users of child-directed sites and services.

165

The changes clarified that the child-directed content provider is strictly liable when a third party collects personal information through its site or service, while the third party is liable only if it had actual knowledge that the site or service from which it was collecting personal information was child-directed.

166

164

16 CFR 312.2, definition of “website or online service directed to children,” paragraph 2.

165

78 FR 3972 at 3975. The 2013 Amendments added a proviso to the definition of “operator” discussing the circumstances under which personal information is collected or maintained on behalf of an operator.

See

16 CFR 312.2, definition of “operator.”

166

The Commission stated that “for purposes of the [COPPA] statute” the third party “has effectively adopted that child-directed content as its own and that portion of its service may appropriately be deemed to be directed to children.” 78 FR 3972 at 3978.

Because the second paragraph of this definition specifies that the operator must have actual knowledge that it is collecting personal information “directly” from users of another site or service, the Commission is concerned that entities with actual knowledge that they receive large amounts of children's data from another site or service that is directed to children, without collecting it directly from the users of such site or service, may avoid COPPA's requirements. For example, the online advertising ecosystem involves ad exchanges that receive data from an ad network that has collected information from users of a child-directed site or service. In the same spirit of avoiding a loophole that led the Commission to amend the Rule in 2013, the Commission proposes modifying the current language by deleting the word “directly.” The Commission did not seek comment in the 2019 Rule Review Initiation on this aspect of the Rule's definition of “website or online service directed to children” and therefore welcomes comment on this proposed modification.

c. Mixed Audience

The 2013 Amendments established a distinction between child-directed sites and services that target children as a “primary audience” and those for which children are one of multiple audiences—so called “mixed audience” sites or services. Specifically, the Rule provides that a website or online service that meets the multi-factor test for being child-directed “but that does not target children as its primary audience, shall not be deemed directed to children” so long as the operator first collects age information and then prevents the collection, use, or disclosure of information from users who identify as younger than 13 before providing notice and obtaining verifiable parental consent.

167

This allows operators of mixed audience sites or services to use an age-screen and apply COPPA protections only to those users who are under 13.

167

16 CFR 312.2, definition of “website or online service directed to children,” paragraph 3.

Although there appears to be general support for the mixed audience classification, a number of commenters cited confusion regarding its application and called on the Commission to provide additional clarity on where to draw the line between general audience, primarily child-directed, and mixed audience categories of sites and services.

168

One commenter noted that the mixed audience definition is confusing and the language “shall not be deemed directed to children”

suggests that such sites or services are not within the definition of child-directed websites or online services.

169

Others recommended the Commission use a specific threshold for making the determination or provide additional guidance based on the Rule's multi-factor test.

170

168

See, e.g.,

ANA, at 9 (“Although the ability to age screen users has helped businesses ascertain those users to which COPPA applies, children could benefit from the FTC providing additional guidance on the threshold for determining whether a website or online service is

primarily

directed to children”); Google, at 13 (“We support the retention of the mixed audience category, which appropriately recognizes that it is reasonable to treat age screened users as adults when the underlying child-directed content is also directed to adult audiences . . . At the same time, we believe that the definition of mixed audience as currently drafted requires significant clarification, especially with respect to its distinction from primarily child-directed and general audience content”); Lego, at 7 (“[F]urther clarity on how content for mixed audience and adults could be interpreted by regulatory and self-regulatory authorities would increase our ability to provide clearer direction internally on content development”); The Toy Association, at 9 (suggesting the Commission amend the Rule “to establish that a mixed audience site or service, including apps or platforms, is one that offers content directed to children, but whose target audience likely includes a significant number of tweens, teens or adults”) (bold typeface omitted); Internet Association, at 7 (“While it can be fairly straightforward to identify sites and services that are directed primarily to children, the concept of mixed audience sites is not clearly defined and the implications of this concept are unclear and unpredictable”).

169

kidSAFE, at 7-8 (“How can a site or service be `directed to children' for purposes of the factors' test, yet not be `deemed directed to children' for purposes of compliance?”).

170

See, e.g.,

The Toy Association, at 9 (“[The Toy Association] suggests that the FTC consider revising the Rule to establish that a mixed audience site or service, including apps or platforms, is one that offers content directed to children, but whose target audience likely includes a significant number of tweens, teens or adults, even if segments other than children do not comprise 50% or more of the audience”) (bold typeface omitted); CIPL, at 3-4 (“In its application of the COPPA Rule, the Commission has increasingly blurred the lines between services that are `primarily directed to children,' services that target children as one but not the primary audience (`mixed audience'), and general audience sites that don't target children as an audience. The FTC should issue guidance based upon the multi-factor test in COPPA to ensure that content creators, app developers and platforms understand how the rules apply to their products and services”); SIIA, at 4 (“As the way people consume content online continues to evolve, additional guidance is needed on the line between child-directed and mixed audience services”); ESRB, at 6-7 (recommending the Commission provide clarity on the “directed to children” analysis through rulemaking or guidance); and J. Johnston (J House Vlogs), at 16 (requesting an “[e]mergency [e]nforcement [s]tatement from the FTC providing . . . [c]larity on the lines between child-directed, mixed-audience, and general audience content”).

Commenters also questioned the effectiveness of age screening, with some arguing that children have been conditioned to lie about their age in order to circumvent age gates.

171

Others expressed support for the current approach,

172

and some warned against specifying proscriptive methods for age screening, as it could prevent companies from innovating new methods.

173

171

See, e.g.,

SuperAwesome, at 21; PRIVO, at 7-8; Joint Attorneys General, at 9; CARU, at 8.

172

See, e.g.,

CCIA, at 7-8; U.S. Chamber of Commerce, at 4-5; ANA, at 9; Internet Association, at 9.

173

See, e.g.,

CCIA, at 8; ANA, at 9.

Through the 2013 Amendments, the Commission intended mixed audience sites and services to be a subset of the “child-directed” category of websites or online services to which COPPA applies. A website or online service falls under the mixed audience designation if it: (1) meets the Rule's multi-factor test for being child-directed; and (2) does not target children as its primary audience. Unlike other child-directed sites and services, mixed audience sites and services may collect age information and need only apply COPPA's protections to those users who identify as under 13. An operator falling under this mixed audience designation may not collect personal information from any visitor until it collects age information from the visitor. To the extent the visitor identifies themselves as under age 13, the operator must provide notice and obtain verifiable parental consent before collecting, using, and disclosing personal information from the visitor.

174

16 CFR 312.2, definition of “website or online service directed to children,” paragraph 3.

To make its position clearer, the Commission proposes adding to the Rule a separate, stand-alone definition for “mixed audience website or online service.” This definition provides that a mixed audience site or service is one that meets the criteria of the Rule's multi-factor test but does not target children as the primary audience.

175

Current staff guidance notes that operators should carefully analyze the intended audience, actual audience, and, in many instances, the likely audience for the website or online service in determining whether children are the primary audience or not.

COPPA FAQ

s, FAQ D.5.

The proposed definition also provides additional clarity on the means by which an operator of a mixed audience site or service can determine whether a user is a child. First, the Commission agrees with the comments that recommend it allow operators flexibility in determining whether a user is a child. To that end, the proposed definition allows operators to collect age information or use “another means that is reasonably calculated, in light of available technology, to determine whether the visitor is a child,” reflecting a standard used elsewhere in the Rule.

176

Although currently collecting age information may be the most practical means for determining that a user is a child, the proposed definition allows operators to innovate and develop additional mechanisms that do not rely on a user's self-declaration.

177

176

Compare

proposed definition of “mixed audience website or online service” (as quoted in the text accompanying this footnote)

with

16 CFR 312.5(b)(1) (“Any method to obtain verifiable parental consent must be reasonably calculated, in light of available technology, to ensure that the person providing consent is the child's parent.”).

177

Indeed, the Commission supports the development of other means and mechanisms to determine whether the user is a child. Other jurisdictions, such as the United Kingdom, have conducted research that indicates that mechanisms other than self-declaration may be a more effective means of age assurance. Specifically, the research states that parents found the self-declaration method “easy to circumvent,” with many parents “open about themselves and their children lying about their ages.”

Families' attitudes towards age assurance,

Research commissioned by the United Kingdom's Information Commissioner's Office and Ofcom (Oct. 11, 2022), at 19, available at

https://www.gov.uk/government/publications/families-attitudes-towards-age-assurance-research-commissioned-by-the-ico-and-ofcom.

Additionally, consistent with long-standing staff guidance,

178

the proposed mixed audience definition specifically requires that the means used for determining whether a visitor is a child “be done in a neutral manner that does not default to a set age or encourage visitors to falsify age information.” This, for instance, would prevent operators from suggesting to users that certain features will not be available for users who identify as younger than 13.

178

COPPA FAQs,

FAQ D.7.

To further clarify the obligations of an operator of a mixed audience site or service, the Commission also proposes amending paragraph (3) of the definition of “website or online service directed to children” by stating that such operators shall not be deemed directed to children with regard to any visitor not identified as under 13.

B. Notice (16 CFR 312.4)

The Commission proposes a number of modifications to the Rule's direct notice and online notice provisions.

1. Direct Notice to the Parent (Paragraph (b))

Section 312.4(b) requires operators to make reasonable efforts to ensure that parents receive direct notice of an operator's practices with respect to the collection, use, or disclosure of children's information. The Commission proposes adding references to “school” in § 312.4(b) to cover the situation in which an operator relies on authorization from a school to collect information from a child and provides the direct notice to the school rather than to the child's parent. As discussed in Part IV.C.3.a., the Commission is proposing to add an exception to the Rule's parental consent requirement where an operator, in limited contexts, obtains authorization from a school to collect a child's personal information. For purposes of authorization, “school” includes individual schools as well as local educational agencies and State educational agencies, as those terms are defined under Federal law.

179

See

Part IV.C.3.a. for further discussion on the proposed school authorization exception. This proposed definition is intended to preserve the ability of local and State educational agencies to contract on behalf of multiple schools and school districts. This definition aligns with current staff guidance providing that “[a]s a best practice, we recommend that schools or school districts decide whether a particular site's or service's information practices are appropriate, rather than delegating that decision to the teacher.”

COPPA FAQs,

FAQ N.3.

Just as notice is necessary for a parent to provide informed and meaningful consent, a school must also obtain information about an operator's data

collection and use practices before authorizing collection. Therefore, as part of the proposed school authorization exception, an operator must make reasonable efforts to ensure that the school receives the notice that the operator would otherwise provide to a child's parent.

2. Content of the Direct Notice (Paragraph (c))

Section 312.4(c) details the content of the direct notice required where an operator avails itself of one of the Rule's exceptions to prior parental consent set forth in § 312.5(c)(1)-(8). The Commission proposes several modifications to § 312.4(c). The first is to delete the reference to “parent” in the § 312.4(c) heading. This modification is to accommodate the proposed new § 312.4(c)(5), which specifies the content of the direct notice where an operator relies on school authorization to collect personal information.

Next, the Commission proposes modifying language in § 312.4(c)(1) and a number of its paragraphs. As currently drafted, this section sets forth the required content of direct notice when an operator collects personal information in order to initiate parental consent under the parental consent exception listed in § 312.5(c)(1). The Commission proposes revising the heading of § 312.4(c)(1) by adding the phrase “for purposes of obtaining consent, including . . .” after “[c]ontent of the direct notice to the parent” and before “under § 312.5(c)(1).” This change would clarify that this direct notice requirement applies to all instances in which the operator provides direct notice to a parent for the purposes of obtaining consent, including under § 312.5(c)(1).

In its current form, § 312.4(c)(1) presumes that an operator has collected a parent's online contact information and, potentially, the name of the child or parent. However, operators are free to use other means to initiate parental consent, including those that do not require collecting online contact information. For example, an operator could use an in-app pop-up message that directs the child to hand a device to the parent and then instructs a parent to call a toll-free number. The modification is intended to clarify that even where the operator does not collect personal information to initiate consent under § 312.5(c)(1), it still must provide the relevant aspects of the § 312.4(c)(1) direct notice to the parent.

Because the Commission's proposed changes to § 312.4(c)(1) would expand the scope of when an operator must provide this direct notice, the Commission proposes modifications to indicate that §§ 312.4(c)(1)(i) and newly-numbered 312.4(c)(1)(vii) may not be applicable in all instances.

180

Additionally, because §§ 312.4(c)(1)(i) and newly-numbered 312.4(c)(1)(vii) apply to scenarios in which an operator is obtaining parental consent under the parental consent exception provided in § 312.5(c)(1), the Commission proposes making minor modifications to those sections to align language with that exception. Specifically, that exception permits operators to collect a child's name or online contact information prior to obtaining parental consent, and the proposed notice would require the operator to indicate when it has collected a child's name or online contact information.

180

As discussed in Part IV.B.2., the Commission proposes expanding § 312.4(c)(1) to include instances in which operators collect information other than online contact information to obtain consent. The modifications to §§ 312.4(c)(1)(i) and newly-numbered 312.4(c)(1)(vii) address those instances in which an operator may not have collected a parent's or child's online contact information to obtain consent.

The Commission also proposes adding a new paragraph (iv) to require that operators sharing personal information with third parties identify the third parties as well as the purposes for such sharing, should the parent provide consent. This new paragraph (iv) will also require the operator to state that the parent can consent to the collection and use of the child's information without consenting to the disclosure of such information, except where such disclosure is integral to the nature of the website or online service.

181

For example, such disclosure could be integral if the website or online service is an online messaging forum through which children necessarily have to disclose their personal information, such as online contact information, to other users on that forum. The Commission believes that this information will enhance parents' ability to make an informed decision about whether to consent to the collection of their child's personal information. In order to minimize the burden on operators, and to maintain the goal of providing parents with a clear and concise direct notice, the proposed modification allows operators to disclose the categories of third parties with which the operator shares data rather than identifying each individual entity. The Commission welcomes further comment on whether information regarding the identities or categories of third parties with which an operator shares information is most appropriately placed in the direct notice to parents required under § 312.4(c) or in the online notice required under § 312.4(d).

181

This proposed modification effectuates current requirements under the Rule, namely § 312.5(a)(2), which states that “[a]n operator must give the parent the option to consent to the collection and use of the child's personal information without consenting to disclosure of his or her personal information to third parties.”

Additionally, the Commission proposes a number of clarifying changes. First, the Commission proposes clarifying that the information at issue in the first clause of § 312.4(c)(1)(ii) is “personal information.”

182

Second, in § 312.4(c)(1)(iii), the Commission proposes clarifying that the direct notice must include how the operator intends to use the personal information collected from the child. For example, to the extent an operator uses personal information collected from a child to encourage or prompt use of the operator's website or online service such as through a push notification, such use must be explicitly stated in the direct notice. Additionally, the Commission further proposes to change the current use of “or” to “and” to indicate that the operator must provide all information listed in § 312.4(c)(1)(iii). Lastly, the Commission also proposes removing the term “additional” from § 312.4(c)(1)(iii) because this paragraph no longer applies solely to instances in which the operator collects the parent's or child's name or online contact information.

182

This clause currently uses the term “such information.” 16 CFR 312.4(c)(1)(ii).

In addition to the proposed modifications to § 312.4(c)(1), the Commission proposes adding § 312.4(c)(5) to identify the content of the direct notice an operator must provide when seeking to obtain school authorization to collect personal information.

183

While tailored to the school context, the requirements in this new provision generally track the proposed modifications to § 312.4(c)(1).

184

183

The Commission is aware that ed tech operators may enter into standard contracts with schools, school districts, and other education organizations across the country. This direct notice requirement is not meant to interfere with such contractual arrangements. Operators may employ various methods to meet the proposed direct notice requirement without interfering with the standard contract, such as by appending the direct notice to the contract.

See

Part IV.C.3.a. for further discussion of the direct notice required under this exception.

184

For instance, proposed § 312.4(c)(5)(iii) requires the operator to provide the information collected from the child, how the operator intends to use such information, and the potential opportunities for disclosure. Similarly, to the extent the operator discloses information to third parties, proposed § 312.4(c)(5)(iv) requires the operator to

provide the identities or specific categories of such third parties and the purposes for such disclosures.

3. Notice on the Website or Online Service (Paragraph (d))

The Commission proposes two additions to the Rule's online notice requirement. These additions pertain to an operator's use of the exception for prior parental consent set forth in § 312.5(c)(7) and the proposed exception set forth in new proposed § 312.5(c)(9).

185

The Commission also proposes certain modifications to the Rule's existing online notice requirements.

185

Given that these proposed disclosures may be longer and somewhat technical in nature, the Commission believes their appropriate location is in the operator's online notice rather than the direct notice.

First, the Commission proposes adding a new paragraph, § 312.4(d)(3), which would require operators that collect a persistent identifier under the support for the internal operations exception in § 312.5(c)(7) to specify the particular internal operation(s) for which the operator has collected the persistent identifier and describe the means it uses to ensure that it does not use or disclose the persistent identifier to contact a specific individual, including through behavioral advertising, to amass a profile on a specific individual, in connection with processes that encourage or prompt use of a website or online service, or for any other purpose, except as permitted by the support for the internal operations exception.

186

The Commission also proposes requiring operators to implement a data retention policy as part of the requirements for § 312.10.

See

Part IV.G. for a discussion of this proposed change.

Currently, an operator that collects a persistent identifier pursuant to § 312.5(c)(7) is not required to provide notice of the collection. The Commission finds merit in the concerns expressed by some commenters about a lack of transparency in how operators implement the support for the internal operations exception and the extent to which they comply with the exception's restrictions.

187

The Commission believes that the proposed disclosure requirements will provide additional clarity into the use of § 312.5(c)(7), will enhance operator accountability, and will function as an important tool for monitoring COPPA compliance.

187

See

Part IV.A.4. for a discussion of these concerns.

Second, as discussed in Part IV.C.3.b., the Commission proposes a new parental consent exception, codifying its law enforcement policy statement regarding the collection of audio files.

188

Consistent with this codification, the Commission also proposes a new § 312.4(d)(4) requiring that an operator that collects audio files pursuant to the new § 312.5(c)(9) exception describe how the operator uses the audio files and to represent that it deletes such files immediately after responding to the request for which the files were collected.

188

See

Part IV.C.3.b.

The Commission also proposes a number of other modifications to the Rule's online notice requirements. Specifically, the Commission proposes modifying § 312.4(d)(2) to require additional information regarding operators' disclosure practices and operators' retention policies.

189

As discussed earlier, the Commission believes that this information will enhance parents' ability to make an informed decision about whether to consent to the collection of their child's personal information. The Commission notes that the COPPA Rule's online notice provision requires that operators describe how they use personal information collected from children.

190

For example, to the extent an operator uses personal information collected from a child to encourage or prompt use of the operator's website or online service such as through a push notification, such use must be explicitly stated in the online notice. The Commission also proposes adding “if applicable” to current § 312.4(d)(3) (which would be redesignated as § 312.4(d)(5)) in order to acknowledge that there may be situations in which a parent cannot review or delete the child's personal information.

191

189

The Commission proposes requiring operators to implement a data retention policy as part of the requirements for § 312.10.

See

Part IV.G. for a discussion of this proposed change.

190

16 CFR 312.4(d)(2).

191

As discussed in Part IV.D., operators utilizing the school authorization exception would not be required to provide parents the rights afforded under § 312.6(a) for information collected under that exception.

Lastly, the Commission proposes to delete the reference to “parent” in the § 312.4(d) introductory text. This proposal is to align with the Commission's new proposed direct notice requirement to accommodate the proposed new school authorization exception found in § 312.5(c)(10).

4. Additional Notice on the Website or Online Service Where an Operator Has Collected Personal Information Under § 312.5(c)(10) (New Paragraph § 312.4(e))

The Commission also proposes adding a separate online notice provision applicable to operators that obtain school authorization to collect personal information from children pursuant to the proposed exception set forth in § 312.5(c)(10). These disclosures are in addition to the requirements of § 312.4(d). The Commission believes these proposed disclosures will convey important information to parents regarding the limitations on an operator's use and disclosure of personal information collected under the school authorization exception, and the school's ability to review that information and request the deletion of such information.

192

The school's ability to review information and request the deletion of such information are addressed in Part IV.D. in connection with the proposed modification to § 312.6.

C. Parental Consent (16 CFR 312.5)

The verifiable parental consent requirement, in combination with the notice provisions, is a fundamental component of the COPPA Rule's ability to protect children's privacy. The Rule requires operators to obtain verifiable parental consent before they collect, use, or disclose a child's personal information.

193

Operators must make “reasonable efforts to obtain verifiable parental consent” and any parental consent method “must be reasonably calculated, in light of available technology, to ensure that the person providing consent is the child's parent.”

194

Although the Rule sets forth a non-exhaustive list of methods that the Commission has recognized as meeting this standard, the Commission encourages operators to develop their own consent mechanisms provided they meet the “reasonably calculated standard” required by § 312.5(b)(1). In addition to the enumerated consent mechanisms listed in § 312.5(b)(2), § 312.5(c) provides several exceptions pursuant to which an operator may collect limited personal information without first obtaining parental consent and, in some cases, without providing notice.

193

Operators must also obtain such consent for “any material change in the collection, use, or disclosure practices to which the parent has previously consented.” 16 CFR 312.5(a)(1).

194

16 CFR 312.5(b)(1).

The Commission requested comment in its 2019 Rule Review Initiation on the efficacy of the Rule's consent requirements, including whether the Commission should add to the list of approved methods and whether there are ways to encourage the development of new consent methods. The Commission also requested comment on whether the Commission should consider additional exceptions to the consent requirement, including with respect to the collection of audio files

containing a child's voice and in the educational context where a school authorizes the operator to collect personal information.

The Commission proposes modifying the Rule's consent requirements in a number of ways. First, the Commission proposes requiring the operator to obtain separate verifiable parental consent before disclosing personal information collected from a child. The Commission also proposes modifying the consent method set forth in § 312.5(b)(2)(ii) and incorporating into the Rule two previously approved consent mechanisms submitted through the § 312.12(a) voluntary process. Lastly, the Commission proposes modifying the parental consent exceptions set forth in § 312.5(c)(4), (6), and (7) and adding exceptions for where an operator relies on school authorization and for the collection of audio files that contain a child's voice.

1. General Requirements (Paragraph (a))

Section 312.5(a)(1) provides that an operator must obtain verifiable parental consent before collecting, using, or disclosing personal information from a child. While the Commission does not propose modifications to this paragraph, it seeks to make a clarification. This requirement applies to any feature on a website or online service through which an operator collects personal information from a child. For example, if an operator institutes a feature that prompts or enables a child to communicate with a chatbot or other similar computer program that simulates conversation, the operator must obtain verifiable parental consent before collecting any personal information from a child through that feature. While the Commission is not proposing modifications to this paragraph, it welcomes comment on it.

Section 312.5(a)(2) currently states that “[a]n operator must give the parent the option to consent to the collection and use of the child's information without consenting to disclosure of his or her personal information to third parties.” The Commission proposes bolstering this requirement by adding that operators must obtain separate verifiable parental consent for disclosures of a child's personal information, unless such disclosures are integral to the nature of the website or online service.

195

Under the proposed language, operators required to obtain separate verifiable parental consent for disclosures may not condition access to the website or online service on such consent.

195

This exception aligns with previous staff guidance, in which FTC staff has stated that operators are not required to provide parents with a separate option to consent to the disclosure of the child's personal information where such disclosures are integral to the site or service. The guidance requires the operators to make clear when such disclosures are integral.

See COPPA FAQs,

FAQ A.1. For example, such disclosure could be integral if the website or online service is an online messaging forum through which children necessarily have to disclose their personal information, such as online contact information, to other users on that forum.

In the preamble of the 1999 initial COPPA Rule, the Commission noted that “disclosures to third parties are among the most sensitive and potentially risky uses of children's personal information. This is especially true in light of the fact that children lose even the protections of [COPPA] once their information is disclosed to third parties.”

196

The Commission remains concerned about the disclosure of personal information collected from children. Indeed, one commenter noted that “[c]hildren today face surveillance unlike any other generation—their every movement online and off can be tracked by potentially dozens of different companies and organizations.”

197

196

64 FR 59888 at 59899.

197

Common Sense Media, at 3.

The Commission believes that information sharing is a pervasive practice. Therefore, the Commission finds it appropriate to provide parents with greater control over the disclosure of their children's information by clarifying that § 312.5(a)(2) requires operators to obtain separate verifiable parental consent for disclosures. This includes disclosure of persistent identifiers for targeted advertising purposes, as well as disclosure of other personal information for marketing or other purposes. The Commission did not seek comment on this particular aspect of the Rule's verifiable parental consent requirements in the 2019 Rule Review Initiation and welcomes comment on this proposed modification.

2. Methods for Verifiable Parental Consent (Paragraph (b))

The Commission received numerous comments related to the methods by which operators can obtain parental consent. Many commenters criticized particular approved parental consent methods. Some characterized the methods as outdated or counterintuitive.

198

Others complained that the methods failed to serve unbanked or low-income families who may lack access to the means to provide consent, such as a credit card.

199

Some commenters suggested that the use of credit card data and government-issued IDs are too privacy-invasive,

200

while one advocate claimed that the current methods are better indicators of adulthood than parenthood.

201

198

See, e.g.,

FOSI, at 4-5 (describing current method of requiring submission by facsimile as outdated, staffing a toll-free number as expensive, and requiring a credit card number for a service that should be free as counter-intuitive); ESA, at 24 (“For example, the collection of a driver's license or credit card in connection with a transaction may appear particularly cumbersome in the context of a free mobile app that does not require registration and that collects and uses only limited types of information within the app”).

199

See, e.g.,

internet Association, at 13; CIPL, at 5; Net Safety Collaborative, at 2; Connected Camps, at 2.

200

See, e.g.,

P. Aftab, at 12-13;