The Kids Are Alright, but What About the Rest of Us?

Yesterday the Federal Trade Commission (FTC) took an important step towards protecting children’s privacy online when it formally published new rules interpreting the Children’s Online Privacy Protection Act (COPPA). The FTC updated existing definitions to recognize that “personal information” can include elements like Internet Protocol (IP) information and location information. These changes will help ensure that the personal information of kids isn’t collected without parental permission. Perhaps more significantly, it establishes an important precedent for how information on all of us should be treated going forward.

Online information collection has become a multi-billion dollar industry. As our lives have moved increasingly online, personal information has become a preferred currency of Internet advertisers, data aggregators and other actors. These private companies have found new and increasingly stealthy ways of tracking users’ habits online.

IP addresses, which were once considered anonymous, have become key online identifiers and now aid companies in tracking a wealth of personal information. IP addresses—which are a series of numbers associated with a device, like a laptop or mobile phone—now have the same utility as a name, postal address or social security number, thereby creating a direct link between individuals and their online activities. Using IP addresses and a variety of tracking technologies, private companies routinely follow people as they surf the web, sucking up private details about their interests, reading habits, friends and family, financial status, health information, and religious and political affiliation. This personal information is kept in individual profiles largely outside of the control or knowledge of the individual.

An excellent 2010 Wall Street Journal series on online privacy illustrated the extent to which individuals are being tracked and how the invasive practice can cause real harm. They spoke to a recent high-school graduate, who had been identified by advertisers as concerned about her weight. “Every time I go on the Internet,” she said, she sees weight-loss ads. “I’m self-conscious about my weight. I try not to think about it…. Then [the ads] make me start thinking about it.”

Some companies claim to self-regulate by setting limits on the sensitive data that they collect in the interest of protecting Americans’ privacy. The restrictions, however, are arbitrary and voluntary. According to the Wall Street Journal, Healthline says it doesn’t let advertisers track users around the Internet who have viewed sensitive topics such as HIV/AIDS, sexually transmitted diseases, eating disorders and impotence. However, it does let advertisers track people with bipolar disorder, overactive bladder and anxiety, according to its own marketing materials.

The FTC’s inclusion of geo-location information as “personal information” is also an important recognition of the sensitivity of data collected by location-enabled devices. All cell phones register their location with cell phone networks several times a minute, and this function cannot be turned off while the phone is getting a wireless signal. As the federal appeals court in Washington, D.C. explained:

A person who knows all of another’s travels can deduce whether he is a weekly church goer, a heavy drinker, a regular at the gym, an unfaithful husband, an outpatient receiving medical treatment, an associate of particular individuals or political groups—and not just one such fact about a person, but all such facts.

While the FTC’s mission is to protect consumers from private industry, privacy-protecting regulations also defend against overreaching government surveillance. The Privacy Act of 1974 regulates how government collects information on citizens. Since 9-11, however, the government’s desire to collect citizens’ personal information has skyrocketed. To get around this restriction, many agencies simply purchase the information from online data brokers.

By expanding the definition of “personal information” under COPPA to include IP addresses and location information, the FTC has taken an important step in protecting children’s privacy online. While there are some First Amendment concerns with other aspects of the COPPA changes, it’s now critical that Congress and other agencies follow the FTC’s lead and provide these vital privacy protections to the rest of us.

Learn more about your digital rights: Sign up for breaking news alerts, follow us on Twitter, and like us on Facebook.