FTC Seeks Comments on COPPA Rule

• By Dian Schaffhauser
• 07/29/19

The Federal Trade Commission wants to know how effective the Children’s Online Privacy Protection Act (COPPA) Rule is and intends to hold a workshop in October on the subject.

COPPA was first put into effect in 2000, requiring specific websites and online services to notify parents for their consent prior to collecting, using or disclosing personal information from children under 13 years of age. The last time COPPA was revised was in 2013. And while the agency usually waits 10 years between reviews of the rules, this time, it's doing so early because of questions that have arisen in three broad areas:

• How the Rule applies to the educational technology sector;

• How it applies to voice-enabled connected devices; and

• How it applies to general audience platforms that host content by third-parties intended for children.

The discussion will also look at the "costs and benefits" of the Rule and what about it should be retained, removed or changed.

One aspect of the Rule that the discussion will take up is whether COPPA should continue to allow schools to serve as proxies for parents for the sake of consent in the case of educational tech. Commissioners are wondering whether to borrow from FERPA, the Family Educational Rights and Privacy Act, in laying out the requirements for the "school official exception." For example, should the Rule specify who at the school could provide consent? Should operators be able to use the personal data collected from children to improve the product in use or other products and should anonymization be required? And are there instances where "de-identified" data "has been sold or hacked and then re-identified"?

The agency said it also wants to know if parents should be able to tell operators to delete the personal information collected about their children; whether operators should be allowed to require the school to notify parents of operator data practices and, if so, how that would work; and how limited the school's consent authority should be in the case of educational software use (for example, does that consent allow operators to use the data collected to market to students or parents?).

"In light of rapid technological changes that impact the online children’s marketplace, we must ensure COPPA remains effective," said FTC Chairman Joe Simons, in a statement. "We're committed to strong COPPA enforcement, as well as industry outreach and a COPPA business hotline to foster a high level of COPPA compliance. But we also need to regularly revisit and, if warranted, update the Rule."

The full list of questions that the FTC is seeking comment on is included in the Federal Register notice. Written comments must be received on or before October 23, 2019. The commission will hold a public workshop to review the COPPA Rule on October 7, 2019 in Washington, D.C. Prospective panelists for that can submit a statement detailing their expertise on the topics to be addressed and their contact information by August 19, 2019 to [email protected].