Back in the waning years of the Clinton administration, Congress quietly enacted an important internet privacy bill (the passage of which was overshadowed by other, more salacious developments). The Children’s Online Privacy Protection Act (“COPPA”) requires any website “target[ing]” children under the age of 13 to notify a child’s parent and receive verifiable consent before collecting personal information from that child. A lot of COPPA is about controlling online marketing activities involving young children, who may not appreciate the dangers in disclosing sensitive personal information to commercial entities.
The ACLU has long been strongly supportive of COPPA. It is an important first step on the road to universal baseline privacy protections that ensure that every American—young and old—has meaningful control over their personal information online. However, the Federal Trade Commission (“FTC”), the agency responsible for enforcing COPPA and for setting the implementing regulations that govern how the law will be enforced, recently proposed expanding the scope of COPPA in a troubling direction. Monday, we submitted comments expressing our concerns.
Right now, only sites or services that know they are targeting very young children (like Disney’s Club Penguin, which is a model of COPPA compliance), or know they are collecting information from young children (“actual knowledge”), have to do the notice-and-consent thing.
Under the FTC’s proposal, however, COPPA could apply to sites and online services that cater largely or even exclusively to adults or older teenagers. Crucially, the proposed changes would expand COPPA’s scope to sites or services that are “likely to attract an audience that includes a disproportionately large percentage of children under age 13 as compared to the percentage of such children in the general population.” Note that “disproportionately large” is inherently ambiguous, so most sites or services that could potentially attract a relatively small number of children relative to their overall audience are going to err on the side of caution (note that children under 13 make up about 18.5% of the population of the United States).
So, why is this a problem?
First, there’s the chance that general purpose sites like YouTube will make their content more mature (by deleting, say, the Sesame Street channel) to avoid attracting young children. This raises a whole spectrum of First Amendment concerns, including the fact that the government here would be indirectly influencing the content of online speech, and the danger that the expansion could actually reduce the amount of child-friendly online content.
Second, under the new regulations, a site would be able to avoid COPPA liability if it age-screened every visitor. It is unclear, however, just what level of screening is appropriate. Some sites may feel pressured to actually verify a person’s identity before allowing them to access the site or service. In a series of cases litigated by the ACLU concerning the Child Online Protection Act (“COPA,” not to be confused with COPPA), courts, including the Supreme Court, explained that age-screening measures requiring adults to identify themselves before accessing protected information may chill speech such that they violate the First Amendment. The Supreme Court also found that verification measures restrict far more speech than is necessary to protect kids, which is a separate constitutional issue. Both of these concerns apply to the proposed COPPA changes.
The ACLU protects privacy and free speech simultaneously, and the two interests are rarely at cross-purposes. Right now, COPPA is a great law and it does both effectively. But, if expanded in the direction proposed, COPPA will put the government in the business of influencing online content, and that it cannot do. The FTC should leave what is not just good enough, but extremely good, alone.
