FTC Releases COPPA Further NPRM

August 1, 2012. The Federal Trade Commission (FTC) released a notice [43 pages in PDF], to be published in the Federal Register, that announces, describes, and recites proposed changes to its rules that implement the Children's Online Privacy Protection Act (COPPA).

The deadline to submit written comments is September 10, 2012.

The COPPA, which is codified at 15 U.S.C. §§ 6501-6506, bans operators of web sites and online services that are directed to children from collecting information from children under thirteen without parental consent.

The COPPA was S 2326 in the 105th Congress. S 2326 was enacted into law as part of a large omnibus appropriations bill in October of 1998. See, TLJ story titled "Internet and Tech Bills Become Law", October 22, 1998. See also, TLJ web page titled "Children's Online Privacy Protection Act" (1998). The FTC adopted implementing rules in 2000.

In September 2011, the FTC issued a notice of proposed rulemaking. See, FR, Vol. 76, No. 187, Tuesday, September 27, 2011, at Pages 59803-59833. See also, story titled "FTC Proposes Changes to COPPA Rule" in TLJ Daily E-Mail Alert No. 2,302, September 21, 2011.

The FTC received over 350 comments. See, FTC web page with hyperlinks to comments. However, the FTC has not yet adopted any rules changes proposed in that 2011 notice. The just released notice is a continuation of that rule making proceeding.

The 2011 notice proposed modifying the definition of personal information to include persistent identifiers and screen or user names other than where they are used to support internal operations, and website or online service directed to children to include additional indicia that a site or service may be targeted to children.

The just released notice states that the FTC "now proposes to modify the definition of operator, and proposes additional modifications to the definitions of website or online service directed to children, personal information, and support for internal operations."

It also states that the FTC "proposes modifying the definition of both operator and website or online service directed to children to allocate and clarify the responsibilities under COPPA when independent entities or third parties, e.g., advertising networks or downloadable software kits (``plug-ins´´), collect information from users through child-directed sites and services."

This notice continues that the FTC "now believes that the most effective way to implement the intent of Congress is to hold both the child-directed site or service and the information-collecting site or service responsible as covered co-operators. Sites and services whose content is directed to children, and who permit others to collect personal information from their child visitors, benefit from that collection and thus should be responsible under COPPA for providing notice to and obtaining consent from parents. Conversely, online services whose business models entail the collection of personal information and that know or have reason to know that such information is collected through child-directed properties should provide COPPA's protections."

This notice also proposes "to modify the previously proposed revised definition of website or online service directed to children to permit websites or online services that are designed for both children and a broader audience to comply with COPPA without treating all users as children."

It also proposes "modifying the definition of screen or user name to cover only those situations where a screen or user name functions in the same manner as online contact information". Also, the FTC notice proposes modifying the revised definition of support for internal operations and the rules' coverage of persistent identifiers as personal information.

Rep. Joe Barton (R-TX) stated in a release that "The potential changes proposed are a great foundation to start the conversation about how to protect our kids online by addressing how personally identifiable information should be used, how we should define a website geared towards children 12 and younger, and further defining the term ``operator.´´"

He added that "These proposed changes to COPPA are a step in the right direction, but I believe that our children need stronger protections included in the Do Not Track Kids Act". Rep. Barton and Rep. Ed Markey (D-MA) introduced HR 1895 [LOC | WW], the "Do Not Track Kids Act", on May 13, 2011. See, story titled "Rep. Markey and Rep. Barton Release Draft of Do Not Track Kids Act" in TLJ Daily E-Mail Alert No. 2,236, May 9, 2011.