FTC Regulates Kids' Privacy Online

IQ was first to write "The Children's Online Privacy Protection Act (COPPA) was issued today by the FTC. It kicks in April 2000. The goal is to protect the privacy of the children by requiring "verifiable parental consent". Check out the release text. "

If you have the time you might also want to read the actual rule and public comments. Most online news services have covered it; Wired has a lengthy analysis sourced to an anonymous Republican staffer, but News.com has one without the Republican political spin. Fundamentally, the act regulates those commercial websites that target themselves to children (12 and under) and collect personal information about them - if you aren't commercial, or don't target yourself to children (even if you collect personal information from people) or just don't collect personal data from the kids, you aren't affected. Nevertheless, it is a significant step in privacy regulation - businesses must contact parents before collecting such information from an individual that they have actual knowledge is a child (for instance, by asking their age), but have no duty to ask the age of the general population. Thus most websites, even commercial ones that collect personal information, will have no change in day-to-day operations - they target themselves to a general audience, don't care about their visitors' ages, and need not take any steps under the new regulations.

Sites which do target kids for marketing will have to get parental permission before doing so. Parents also must be offered the option to prevent their kids' information from being shared with third-parties - to prevent the sale of that data, in other words. Parents can also opt-out entirely on behalf of their children and the site must honor their request. In school situations, teachers can give the requisite permission for their students so school activities won't be hampered.

The law and rule are likely to put a significant damper on online marketing to kids aged 12 and under. Specialized kids' sites will have to get parental permission to collect the data that is their primary reason for existence, and presumably many parents will prevent these sites from selling it. How well will they be enforced? That's uncertain. According to EPIC, the FTC has received hundreds of privacy-related complaints and has investigated only three.

"Self-regulation" of privacy concerns is an obvious failure. TrustE, the leading light of the businesses trying to prevent consumer protection on the internet, spends more time covering up privacy breaches by its members than investigating complaints... Will targeted government intervention have any better effect?

Comments

Let Parents Choose

[else...if]

Maybe I'm missing something, but the FTC seems to be thinking it terms of selling a child's address along with marketing data, rather than just reporting demographics to marketers. I don't think prevening demographics collection was the intent of the FTC. Regardless, I'm still opposed to this. Although it's not as bad as most examples, it still takes responsibility over children away from their parents and gives it to the rest of the world. If a parent gives their child unsupervised access to the internet then they should trust their child enough to either make those judgements on their own or ask a parent's permission on their own ("this is important Timmy. Never give anyone on the internet your address or phone number with out Mommy's permission").

Creating a Kids' Website...

[scottsevertson]

I'm working on a kid's website for a client, and the FTC regulations aren't making my work any easier.

The client knew that these regulations have been coming for a while, so we have been actually dealing with these issues for the past two months.

Implementing the parental consent process has actually been quite easy. The hard part is trying to figure out out how to spin things so that the parents want to sign the consent form! Granted, it's kind of hard to put a spin on using kids for market research data.

The strategy we ended up using was the same concept drug sellers use - give the kids a free hit or two on the web site, but to keep using it, they have to register. Hopefully by then, they are addicted.

I'm not sure if I morally agree with the purpose of the web site (no it's not evil or anything, but I don't like tricking kids/parents into revealing their shopping habbits online), but it pays pretty well!


Scott Severtson
Applications Developer

Good idea, but...

[jd]

The implementation is buggier than Windows 2000. Privacy SHOULD be a right, not a concession. Not just to kids, but every single person.

Yes, kids don't necessarily have the skills to avoid marketing traps, but neither do a lot of adults. Why do you think people bother advertising? It's cos they know 99.999% of the population thinks with it's wallet half the time. (The other half doesn't involve the brain, either.)

The legislation is clearly drawn up by someone who has some excellent thoughts and ideas, but is clueless as to how to implement them. The same has been true of most Internet regulation. Some sound ideas, mixed with flawed logic, shoddy reasoning and liquid lunches, half-baked, and left to sit in a mildew-infested cupboard.

IMHO, this is why this kind of regulation should be done IN CO-OPERATION with ISP's and computer specialists. THEY are the ones who know what would work and what wouldn't, and what would be acceptable to the population as a whole.

Legislation by force of arms achieves nothing, least of all it's intended goal, and gets everyone so hostile to the idea, there isn't a hope of anything sensible being implemented for years to come.

Which is more important? The egos of the legislators (in Congress, or wherever), or getting effective, workable, useful legislation where it's NEEDED, in the WAY that it's NEEDED, to achieve the things that are NEEDED?