Slashdot Mirror

← Back to Stories (view on slashdot.org)

FTC Strengthens Children's Privacy Protections Online

Posted by Soulskill on from the don't-think-of-the-children-without-parental-consent dept.

An anonymous reader writes "The U.S. Federal Trade Commission today updated the privacy standards that protect children's privacy online. The new rules say companies must gain parental consent before collecting a kid's geolocation data, photos, and videos. It also broadened existing language to include third parties and companies that collect data on users across multiple websites. 'While the new rule strengthens such safeguards, it could also disrupt online advertising. Web sites and online advertising networks often use persistent identification systems — like a customer code number in a cookie in a person's browser — to collect information about a user's online activities and tailor ads for that person. But the new rule expands the definition of personal information to include persistent IDs — such as a customer code number, the unique serial number on a mobile phone, or the I.P. address of a browser — if they are used to show a child behavior-based ads.'"

45 comments

  1. How do you tell if the user is a child? by pclminion · · Score: 4, Interesting

    How do you know the user is a child and thus subject to special rules? By asking them? If so, this is awesome -- I'll just tell everybody I'm a kid and get all the same privacy safeguards (because my "parent" is me, and he'll never give consent).

    1. Re:How do you tell if the user is a child? by Anonymous Coward · · Score: 0

      Are you over 13? Yes/Cancel.

    2. Re:How do you tell if the user is a child? by Anonymous Coward · · Score: 2, Insightful

      How do you know the user is a child and thus subject to special rules? By asking them? If so, this is awesome -- I'll just tell everybody I'm a kid and get all the same privacy safeguards (because my "parent" is me, and he'll never give consent).

      Browser makers should replace "Do Not Track" with "I'm a Child." Does the same thing, but advertisers aren't allowed to ignore it.

    3. Re:How do you tell if the user is a child? by Anonymous Coward · · Score: 0

      unfortunately that would only work for a few years until your fake identity is "old enough".

    4. Re:How do you tell if the user is a child? by kelemvor4 · · Score: 1

      If they were able to determine the age of the fake identify by tracking it they would have broken the law.

    5. Re:How do you tell if the user is a child? by Anonymous Coward · · Score: 0

      Most websites don't allow children under 13 to join.

    6. Re:How do you tell if the user is a child? by Anonymous Coward · · Score: 0

      You might also be getting into trouble if you were pretending to be a child as some people might think that you are trying to pick up underage kids.

    7. Re:How do you tell if the user is a child? by Golddess · · Score: 1

      If they were able to determine the age of the fake identify by tracking it they would have broken the law.

      You don't need to know the age of the user to be able to say "well, this account was created 13 years ago today, so therefore the user must be at least 13 years old by now". At least I think that is what AC was getting at.

      --
      "I'm not sure I like the fugnutish tone you used in your post!" -RogL (608926)-
    8. Re:How do you tell if the user is a child? by Anonymous Coward · · Score: 0

      As a parent I know that children are unlikely to lie about their age when joining sites like facebook. I realize that as a parent I should stand behind his shoulder, or install spying technologies to make sure my child is not doing anything wrong online. But how can this even purport to protect the privacy of children, if the children can't be trusted to be honest about their ages on any given site? Especially when a site requires you to be at least a certain age and the child is determined to join?
      Privacy should be granted to people of any age; period.
      Even though the mass majority these days is too stupid (or ignorant) to realize the importance of their privacy online, and willy-nilly give away the personal details that allow identity theft, account compromises, and stalking, the sites we join should not only take some responsibility in informing the public about the repercussions of their actions, but also help the average user about the issues of divulging too much information about yourself.
      I remember a time when it was a given that you do not use your real name or details for anything online. Now it a part of the terms of service that if you do not provide your real name and information you can be dropped from a site. (facebook/google plus for example).
      Google plus would not let me sign up unless i provided a name that was not obviously an actual name. Things like "nunya bizniss" will not work. If I want to be Nunya Bizniss online, I should have the right to do so. I am not applying for government assistance or buying a house, I am trying to talk to strangers, or friends, online. Why do I have to be the real "me" online, and jeopardize my real-life safety in the process?

    9. Re:How do you tell if the user is a child? by Anonymous Coward · · Score: 0

      I realize that I made many typos that made this post not make much sense (doing to many things at once):

      Corrections:
      unlikely to lie=likely to lie
        Now it a part of the terms of service that if you do not provide= Now it a part of the terms of service that if you provide
        provided a name that was not obviously an actual name= provided a name that was obviously an actual name

    10. Re:How do you tell if the user is a child? by Charliemopps · · Score: 1

      I think this is one of those "You'll know if you're breaking the law."

      Does HBO really need to do anything about this law? No... you just pop up a window "Are you over the age of 13? y/n" and yes goes to the content, and no drops you somewhere not on your site cause you dont even want to deal with them. HBO isn't in the business of profiting off of pre-teens.

      If you're nickelodeon? Well then I guess you'd shut down your behavior tracking, add targeting MMO design teems because society has decided that what you're doing is bullshit.

    11. Re:How do you tell if the user is a child? by mpe · · Score: 1

      Are you over 13? Yes/Cancel.
      Shouldn't this be 21 rather than 13 though...

    12. Re:How do you tell if the user is a child? by mpe · · Score: 1

      I remember a time when it was a given that you do not use your real name or details for anything online. Now it a part of the terms of service that if you do not provide your real name and information you can be dropped from a site. (facebook/google plus for example).

      Which will cause problems when such systems start rejecting people's "real names".

      Google plus would not let me sign up unless i provided a name that was not obviously an actual name. If I want to be Nunya Bizniss online, I should have the right to do so. I am not applying for government assistance or buying a house, I am trying to talk to strangers, or friends, online.

      There's an FAQ covering common mistakes people writing information systems make with respect to names. In many places "Nunya Bizniss" is a valid legal name. Even on a birth certificate.

    13. Re:How do you tell if the user is a child? by Anonymous Coward · · Score: 0

      They need some ID to access the system. In many countries the ID is your social security number.

    14. Re:How do you tell if the user is a child? by modmans2ndcoming · · Score: 1

      Do you want children to never learn how to use the real internet?

  2. This sounds like copying the Europeans! by Anonymous Coward · · Score: 0

    Are they enforcing all their social rules on us? We should be complaining about extra-territoriality!

  3. Automatic: "I've got kids now..." by Anonymous Coward · · Score: 0

    ...don't bug me"

  4. The age is too low! by s.petry · · Score: 2

    Have to say it. 13 is too low of an age limit. It should be at least 16, which is the age of consent in the majority of states. 13 was fine in the early days, before we had all of the bots doing the leg work. Now, it should be higher and more restrictive.

    Look at the bright side, it'll generate lots of revenue for someone to develop all of those restrictions into the bots.

    --

    -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

    1. Re:The age is too low! by Hsien-Ko · · Score: 1

      That would put a huge dent into Xbox Live.

    2. Re:The age is too low! by desdinova+216 · · Score: 1

      you say that like it's a bad thing?

  5. Instagram / Facebook don't care by Swampash · · Score: 4, Insightful

    Allow me to paraphrase Instagram's position on this issue: the USFTC can eat a dick.

    From Instagram's new Terms of Service:

    (Y)ou agree that a business or other entity may pay us to display your username, likeness, photos (along with any associated metadata), and/or actions you take, in connection with paid or sponsored content or promotions, without any compensation to you. If you are under the age of eighteen (18), or under any other applicable age of majority, you represent that at least one of your parents or legal guardians has also agreed to this provision (and the use of your name, likeness, username, and/or photos (along with any associated metadata)) on your behalf.

    Get that? "If you're using this service and you're under 18 we will act as if we have parental consent to share every bit of data we have about you with anyone we want."

    1. Re:Instagram / Facebook don't care by Anonymous Coward · · Score: 0

      The person who agrees to that agreement is over 18 or has parental permission, else they wouldn't have agreed to it.

    2. Re:Instagram / Facebook don't care by s.petry · · Score: 3, Interesting

      I don't think that would hold water in court. It's been a long time since I studied that type of case law, but there is a specific term for that type of contract. Given a couple hours in the law library I would have a solid case against that TOS.

      The equivalent would be to give a contract to an autistic person taking 100% of their profits from their exceptional art talent, and having a statement of "my legal guardians agree to me signing this contract." The contract signed by only the autistic person is legally worth less than toilet paper. The contract is not valid because of that clause and I could sue for not only actual loss but some hefty damages.

      --

      -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

    3. Re:Instagram / Facebook don't care by Swampash · · Score: 1

      Didn't stop them putting that in the Terms though, did it?

    4. Re:Instagram / Facebook don't care by DMUTPeregrine · · Score: 2

      "If you are under the age of eighteen (18), or under any other applicable age of majority, you represent that at least one of your parents or legal guardians has also agreed to this provision (and the use of your name, likeness, username, and/or photos (along with any associated metadata)) on your behalf."

      Conveniently a minor (under the age of eighteen) can't legally agree to such terms, and can't legally make such a representation.

      --
      Not a sentence!
    5. Re:Instagram / Facebook don't care by Anonymous Coward · · Score: 0

      Didn't stop them putting that in the Terms though, did it?

      They've already stated that the wording was poor and are going to re-write it so people like you stop getting their panties wadded up in a knot. The purpose of the clause is to prevent them from getting sued for using the material within their service. They have made multiple public statements that the policy does not give them any ownership rights, and that they are not going to distribute your pictures. So just give it a rest already.

    6. Re:Instagram / Facebook don't care by blackraven14250 · · Score: 1

      They need that language in order to actually, you know, function as a social network. Without having rights to distribute, store, etc. the works you post, how do you expect they give it to your friends? The GP is just wrong too - you can try to put basically anything in a Terms of Service, or any other contract, but what really matters is whether the provision will stand in court.

  6. Next step by Brucelet · · Score: 1

    Great, so now all we have to do is convince the FCC that everyone in America is a child so that we don't get tracked!

    1. Re:Next step by Anonymous Coward · · Score: 0

      How about starting with all the US political bloggers, then move on to US politicians... if they're going to act like spoiled children all the time, they may as well be protected as one.

  7. OK... by Anonymous Coward · · Score: 0

    Nice work, thanks. Now could we possibly bother you to extend this to adults some time?

  8. From Sony...for kids. by Anonymous Coward · · Score: 0

    Except from the TOS for Clone Wars Adventures, a Sony Online Entertainment product targeted at children under the age of 13...

    "...In addition, you acknowledge that any and all character and account data that is stored and is resident on our servers, and any and all communications that you make within The Station or any game (including, but not limited to, messages solely directed at another player or group of players) traverse through our servers, may or may not be monitored by us or our agents (where and to the extent permitted by applicable law), you have no expectation of privacy in any such communications, you expressly consent to such monitoring of communications you send and receive, and you expressly agree to waive any rights of confidentiality that you may have in and to such communications. For example, SOE may monitor chat rooms in certain portions of The Station directed to Children."

    It should be perfectly clear what one should expect from Sony... but, for most people, somehow it isn't...Why is that? How does Sony get away with this crap over and over again?

    1. Re:From Sony...for kids. by fast+turtle · · Score: 1

      because other laws require them to do this to protect children from online predators COPA is just one of them.

      Simply put, in the United States, if they're under 18 They are not legally able to sign any contract unless they've been emancipated by the courts as being competent. So long as they can't vote, anything they do is not binding upon them unless it's murder or other criminal action where they can try them as an adult.

      --
      Mod me up/Mod me down: I wont frown as I've no crown
  9. Great start, but can I we more privacy please? by Anonymous Coward · · Score: 0

    I think it is crazy the amount of power these companies wield by obtaining private information from unbeknownst citizens. These laws may protect children, but how many adults really understand what is really going on behind the scenes? It seems as though every moment of our existence online can be tracked, monitored, and analyzed and sold to the highest bidder. They will know us better than ourselves, if they don't already.

    So let me ask you, if peoples behavior can be graphed, compared to millions of other users, and target ads (and news) to each individual can be deployed based on all this information, doesn't that mean they can use all this information to manipulate the unsuspecting?

    I wasn't as afraid when my computer never left my office, at least I could get away from it, but I think this is especially true as with mobile devices getting smarter, now they can track us everywhere we go too.

    Thoughts? Any suggestions on how to keep your identity truly private in the online world?

  10. down side? by BradleyUffner · · Score: 2

    "While the new rule strengthens such safeguards, it could also disrupt online advertising."

    So what you are saying is, there is no down side?

    1. Re:down side? by Black+Parrot · · Score: 1

      "While the new rule strengthens such safeguards, it could also disrupt online advertising."

      So what you are saying is, there is no down side?

      You've got a funny notion of whose benefit this country is supposed to be run for.

      --
      Sheesh, evil *and* a jerk. -- Jade
    2. Re:down side? by VortexCortex · · Score: 1

      The downside is that little folks like me have to jump through more hoops trying to provide their services in accordance with the laws, when we don't track you for advertising purposes anyway, (GEO-IP lookup to find you a good low latency server to play on), will simply end up frustrating you needlessly with "Enter Your Birthday" every page load or every time you start the program because: How the fuck else can we comply with a law that says we must not store underage kids info without parental consent except via cookies, and yet I'm trying not to track any needles data from anyone? Re-install, or clear your cache? "Enter Your Birthday" Oh, but wait, I can't even store you consent to the hard drive. What if you're playing a game, and then you let you kid use it? Now I have to ask your birthday EVERY TIME YOU CONNECT TO THE SERVER, or else I have to track the fuck out of you and require an online account -- Whelp, there goes your anonymity. This law essentially MANDATES COOKIES (or logins that use cookies) be applied to any visitor who is over 13, and would like to click any link on the site without seeing another "Enter Your Birthday" prompt. Every damn web host logs recent requests w/ IP address info: IP address give us your Geo DATA, some shared hosts don't have the ability to turn off this simple log -- In fact, your government wants them to keep such Geo Data saved so they can request logs! "DON'T TRACK KIDS! KEEP LOGS OF EVERYTHING THOUGH!" Well screw me...

      URL Munging is just another form of cookie, same as browser fingerprinting, content cache IDs, etc. Don't like these? Then you shouldn't like these new rules, they're the only way I can comply with the new ridiculous regs without annoying the majority of users. The web was not designed to be stateful, but you want it to be, and yet you don't want any tracking... Damn, now these regs just mandated tracking MUST exist. I can't even provide a site that doesn't track you now. Without the IP (and thus "geo data" see also: load balancing) how can I even reply to a request to serve the page with the age form on it? The added frustrations are more work for me, and turn away traffic from legitimate services that aren't even advertising based, e.g. simply to run a forum and servers for my games. Meanwhile the big guys don't give a fuck and just write horrible invasive privacy policies that assume if you continue to use the site, you've gotten your parent's permission. See above poster who quotes the Instagram privacy policy which says just this.

      So, instead of the FTC stepping up and saying: Parents, if you have children, IT'S YOUR JOB TO POLICE THEM ONLINE (protip: your 13 year old kid will say they're 18 to view porn, or anything else they want), or consulting some actual technically inclined individuals for a solution (Mandatory compliance with DNT header w/ new value for Children? "DNT: 13" header perhaps? I could comply with that! I have all the data in the request header I need to comply!), they instead buckle to lazy paranoid parents and institute laws that DO NOT ACHIEVE WHAT THEY WANT because the wording is daft as fuck and drafted by morons.

    3. Re:down side? by BradleyUffner · · Score: 1

      It was supposed to be a joke about anything that disrupts online advertising being a good thing, but apparently my sense of humor is incompatible with Slashdot.

    4. Re:down side? by Anonymous Coward · · Score: 0

      You see, here's the thing.

      I'm a parent. I am a very technologically aware parent, and I understand the various means by which advertisers track users from site to site at a technical level. I could go into great detail and explain how to implement each of them. And I despise advertising so much that I am well motivated to educate anybody who cares to listen about the toxic stain these advertisers have forced upon the internet - especially my children.

      And yet I, with as much technical knowledge about how this whole mess works, have absolutely no idea *who* my personal information is ultimately being made available to. Popular websites use multiple advertisers; the advertisers then on-sell whatever datasets they can scrape together to third parties; these third-parties then on-sell to even more parties. All of the parties that have their grubby hands on this data then attempt database consolidation to build ever-more perfect profiles of exactly who is doing what and where.

      And I have no knowledge or control over any of it. My personal data. My viewing habits. I, literally, have no visibility about which companies know what about me. If someone with my technical understanding of these issues is as in the dark as I am about this, how the hell is Joe public supposed to be able to protect their or their children's privacy? With "parenting"? Are you joking?

      DNT is a sham. No advertiser was ever going to honour it. The broohaha kicked up by the advertisers over the IE implementation was just a convenient scapegoat for this fact. It was the most cynical attempt at self-regulation by an industry not in short supply of cynicism. "DNT: 13" you propose is equally useless.

      My only option is to not visit websites that engage in these practices, which these days effectively means not using the world wide web at all. "Policing" my child is reduced to the same thing - don't want to be tracked, don't use the web. What a great message for children. The greatest knowledge base of human endeavor ever conceived; the only cost being the complete and total surrender of one's basic right to privacy.

      That's shitty. That's beyond shitty. That is shameful.

      So with all due respect, this is not one of those problems that can be solved with magic "do parenting" dust. This is a problem the advertisers and marketers - and those who have modeled their businesses so as to be dependent on them - have pushed the ethical boundaries on for so long that it is impossible to evade. I am not a lazy parent, or a paranoid parent, but I am an angry parent. I am angry at the greedy motherfuckers who created the panopticon my children will grow up in. They will never experience the freedom I had as a child.

      It's time for stronger regulation. I hope these rules cripple as many of these bastards as possible.

    5. Re:down side? by modmans2ndcoming · · Score: 1

      with all due respect...you have no idea who has your personal data collected through means outside the internet.

      The internet actually made collecting private information more transparent because you know it is happening. pre-internet you had no idea.

  11. And this took so long... by Black+Parrot · · Score: 1

    ...why?

    --
    Sheesh, evil *and* a jerk. -- Jade
  12. But Think of The Chil.. by rueger · · Score: 2

    "However, no parental notice and consent is required when an operator collects a persistent identifier for the sole purpose of supporting the website or online service's internal operations, such as contextual advertising, frequency capping, legal compliance, site analysis, and network communications,"

    In legal terms that's what you call a Loophole Big Enough To Drive A Truck Through.

    Seriously, how would this work anyhow? Surely kids will figure out pretty fast to lie about their age - who's going to follow up and prove them wrong? Or they'll just click the "Yes, I'm the Parent and Approve this Activity" Button. Think Facebook is going to try to track down Mommy or Daddy to confirm that it really was them that gave approval?

    --
    Three Squirrels
    1. Re:But Think of The Chil.. by alexgieg · · Score: 1

      Think Facebook is going to try to track down Mommy or Daddy to confirm that it really was them that gave approval?

      Just wonder about the possibilities! All signup forms would have an additional field for one to submit a scan of an official ID card. Failure to provide it would set your account to kid status and cut you out of basically everything. Providing it would destroy any resemblance of anonymity, everywhere, for everyone.

      Then, at a later stage, website operator could become frustrated enough to require the establishment of a central identification service. Managed by the government, of course. Something OpenID-based or -inspired. Universal single sign on, and absolutely everything you do linked to your real identity!

      Oh, the unending joys of "think of the children!"...

      --
      Conservatism: (n.) love of the existing evils. Liberalism: (n.) desire to substitute new evils for the existing ones.
  13. Anything potentially disrupting advertising by Anonymous Coward · · Score: 0

    I'm in favour of anything potentially disrupting advertising. Even thought I block everything, I think anything that makes it more diffucult to push ads and tracking is a fine manoeuvre.

  14. Contextual advertising OK by Anonymous Coward · · Score: 0

    However, no parental notice and consent is required when an operator collects a persistent identifier for the sole purpose of supporting the website or online service’s internal operations, such as contextual advertising, frequency capping, legal compliance, site analysis, and network communications.

    So basically, you can track for the purpose of advertising to kids all you want. We're fine with that.

  15. Yes! Do want! by Anonymous Coward · · Score: 0

    This idea is so fucking awesome!

    Oh, A.C., why can't you be one of those douches with +5 karma? Everyone needs to see this.

    I so want this feature in my web browser.