The Federal Trade Commission (FTC) outlined proposed changes to the Children’s Online Privacy Protection Act (COPPA) on Sept. 15 that would expand the law to impact companies collecting data from individuals under 13 years of age to serve behaviorally targeted ads online or via mobile devices.
The FTC would require companies such as site publishers, app developers and ad networks to implement mechanisms to notify parents if a child’s personal information is being collected.
COPPA defines personal information as a child’s first and last name, home or physical address, email address, phone number, Social Security number and “any other identifier that the commission determines permits the physical or online contacting of a specific individual.”
The FTC suggested that personal information also include a “persistent identifier,” such as a cookie, IP address or unique device ID, that is “used for functions other than or in addition to support for the internal operations of the website or online service;” geolocation information; photos, videos or audio files containing a child’s image or voice.
Companies collecting a child’s personal information would be required to notify the child’s parents and obtain consent via mail, fax, a credit-card transaction, the submission of an electronically scanned consent form, video chat or by collecting information from a parent’s government-issued ID.
The FTC would have companies notify parents of the personal information that has been obtained, how the parents can consent or nullify to the collection, and how the information collected is to be used.
The companies would also be required to include a hyperlink to an online description of its information practices to the parental notice. The hyperlink would also need to be included “on the home or landing page or screen of its website or online service, and [sic], at each area of the website or online service where personal information is collected from children.” The online description would feature a company’s name, address, phone number and email address, as well as details of the information it collects and how that information is used.
Companies would not be required to notify parents if a child’s personal information is collected to protect the child, such as to prevent the serving of ads deemed harmful to children.
The FTC estimated that the proposed changes would affect approximately 2,000 companies.
U.S. Reps. Ed Markey (D-Mass.) and Joe Barton (R-Texas) introduced an amendment to COPPA on May 13 that would prevent companies from collecting minors’ personal information for targeted marketing.
Also that month, Disney Enterprises subsidiary Playdom settled with the FTC to pay $3 million after the commission found Playdom had violated COPPA.
