Companies Need More COPPA Guidance, Industry Reps Say

A lawsuit challenging the FTC’s updated COPPA rule “would be a winning lawsuit,” said Stu Ingis, Venable lawyer and counsel to the Digital Advertising Alliance: “I think that the commission probably wouldn’t withstand a challenge.” The rule should strive for equilibrium between protecting children online and maintaining the Internet ecosystem, he said. That equilibrium could be restored if the FTC gave “further guidance, further clarity” and reconsidered the role of self-regulatory programs, he said. “If some further changes get made … maybe there won’t be the lawsuit.” Lydia Parnes, former director of the FTC Bureau of Consumer Protection and partner at Wilson Sonsini, was less optimistic about a challenge’s chances of succeeding. “There are very, very, very, very few FTC rules that are challenged, and the success rate is minimal,” she said. It’s “not impossible to challenge and win, but very hard to do so.” Instead of facing a challenge, Parnes said her hope was that “the FTC continues over the next weeks and months to provide more guidance [and] they do this in a more transparent and open way."

The updated definition of personal information is the “linchpin of the rule,” said Kandi Parsons, an attorney with the FTC’s Division of Privacy and Identity Protection. By including persistent identifiers -- such as IP addresses and unique device identifiers -- “the commission is making a very big decision,” Parnes said. “It is kind of essentially a de facto prohibition on interest-based advertising,” she said. “We don’t know what that term means anymore,” said Santa Clara University School of Law Professor Eric Goldman about the phrase “personal information.” Currently, there’s “no coherent definition” that the FTC can offer, he said, suggesting the agency or Congress craft a definition that would provide firmer guidance. “Passive identifiers” such as cookies should not be included in the COPPA rule, Ingis said. As passed by Congress in 1998, the law calls on the FTC to regulate the collection of “an e-mail address or another substantially similar identifier that permits direct contact with a person online.” Cookies are not a substantially similar identifier to email addresses, Ingis said.

The way the new rule treats first and third parties will affect the Internet ecosystem, Ingis said. First parties that are directed to children must be COPPA compliant, while third parties must be COPPA compliant only if they have actual knowledge that their products are embedded on websites directed to children, so “the liability hasn’t been raised to the same level as the first party sites and services,” Parsons said. To avoid creating what “would be a huge loophole in COPPA,” first parties are also responsible for ensuring that third parties that provide a benefit to the first party are COPPA compliant, she said. Child-directed apps and websites will be less likely to integrate third parties if they're liable for the data collection practices of those third parties, Ingis said. The new rule “will either force major changes in the Internet ecosystem … or it will dry up the offerings of many of the companies and their ability to place cookies and derive some of these benefits,” he said. Additionally, third party companies may be unclear what constitutes actual knowledge, making them unwilling to work with first party apps and sites directed at kids, he said.

The fact that the new rule allows general audience sites that are largely, but not primarily, directed at children to screen their users for age is “meant to codify something that was happening in practice anyway,” Parsons said. Before the updated rule was announced and implemented, the FTC would encourage these types of sites to screen users so they could be COPPA compliant with young users without sacrificing data collection from all users, she said. “This was a matter of basic prosecutorial discretion that the commission took before this change anyway.” This system could lead to First Amendment concerns, said ACLU Policy Adviser Gabriel Rottman. If general audience websites take this approach one step further by requiring age verification, the site would be “burdening the First Amendment rights of adults” to visit sites “without abdicating anonymity,” he said.

Digital literacy programs would be a better approach than regulation, said Adam Thierer, senior research fellow at George Mason University’s Mercatus Center. Children should have access to programs on “media literacy and digital citizenship” so they “can deal with the realities of the information age,” he said, applauding the FTC’s OnGuard Online initiative. “We need to be plowing so many more resources into” programs like that one “as opposed to trying to come up with regulatory gimmicks in the short term,” he said. Ultimately, as users and young users get more involved with connected devices and the “Internet of Things,” the COPPA rule “is engaged in an arms race that it cannot possibly win,” he said.