New guardrails would be placed on the use of children’s personal data and a company’s ability to profit from using that information under proposed changes to the Children’s Online Privacy Protection Rule, or COPPA Rule, announced Wednesday by the Federal Trade Commission.
The COPPA Rule currently imposes certain requirements on websites or online service providers that target and knowingly collect the personal information of children under 13 years old. Specifically, these providers must notify and obtain parental consent before collecting, using or disclosing their children’s data. The rule also limits how long online service providers can retain the data, which must be securely stored.
The FTC said in a statement that its proposal “aims to shift the burden from parents to providers to ensure that digital services are safe and secure for children.”
“Kids must be able to play and learn online without being endlessly tracked by companies looking to hoard and monetize their personal data,” said FTC Chair Lina Khan in a statement. “The proposed changes to COPPA are much-needed, especially in an era where online tools are essential for navigating daily life—and where firms are deploying increasingly sophisticated digital tools to surveil children.”
Some of the FTC’s proposed changes include:
- Allowing schools and school districts to authorize ed tech providers to collect, use and disclose students’ data — but only for school-authorized purposes and not for commercial use.
- Strengthening COPPA’s data security requirements.
- Implementing further limits on retaining data and prohibiting operators from using retained information for secondary purposes or storing the data indefinitely.
- Requiring online service providers to obtain verifiable parental consent to send data for targeted advertising to third parties.
- Outright banning the collection of “more personal information than is reasonably necessary” for a child to participate in online activities, including playing games and collecting prizes.
- Limiting the exception for internal operations support by requiring operators who use the exception — which allows them not to obtain parental consent — to provide an online notice stating how they will use the collected personal information and how it will not be used to contact a specific individual, including through targeted advertising.
- Prohibiting operators from using online contact information to send push notifications to children that encourage them to stay online and use the service more.
FTC's proposal will be open to public comment for 60 days after publication in the Federal Register.
Dive Awards
