Back in the waning years of the Clinton administration, Congress quietly enacted an important internet privacy bill (the passage of which was overshadowed by other, more salacious developments). The Children’s Online Privacy Protection Act (“COPPA”) requires any website “target[ing]” children under the age of 13 to notify a child’s parent and receive verifiable consent before collecting personal information from that child. A lot of COPPA is about controlling online marketing activities involving young children, who may not appreciate the dangers in disclosing sensitive personal information to commercial entities.
The ACLU has long been strongly supportive of COPPA. It is an important first step on the road to universal baseline privacy protections that ensure that every American—young and old—has meaningful control over their personal information online. However, the Federal Trade Commission (“FTC”), the agency responsible for enforcing COPPA and for setting the implementing regulations that govern how the law will be enforced, recently proposed expanding the scope of COPPA in a troubling direction. Monday, we submitted comments expressing our concerns.
Right now, only sites or services that know they are targeting very young children (like Disney’s Club Penguin, which is a model of COPPA compliance), or know they are collecting information from young children (“actual knowledge”), have to do the notice-and-consent thing.
Under the FTC’s proposal, however, COPPA could apply to sites and online services that cater largely or even exclusively to adults or older teenagers. Crucially, the proposed changes would expand COPPA’s scope to sites or services that are “likely to attract an audience that includes a disproportionately large percentage of children under age 13 as compared to the percentage of such children in the general population.” Note that “disproportionately large” is inherently ambiguous, so most sites or services that could potentially attract a relatively small number of children relative to their overall audience are going to err on the side of caution (note that children under 13 make up about 18.5% of the population of the United States).
So, why is this a problem?
The ACLU protects privacy and free speech simultaneously, and the two interests are rarely at cross-purposes. Right now, COPPA is a great law and it does both effectively. But, if expanded in the direction proposed, COPPA will put the government in the business of influencing online content, and that it cannot do. The FTC should leave what is not just good enough, but extremely good, alone.