Inside Privacy - Updates on Developments in Global Privacy & Data Security

The Federal Trade Commission (FTC) has voted unanimously to retain the July 1, 2013 effective date for its revisions to the rule implementing the Children’s Online Privacy Protection Act (COPPA).  As we previously wrote, the FTC adopted significant revisions to the COPPA rule in December 2012 and established a July 1, 2013 effective date.  In recent weeks, nineteen consumer groups signed a letter opposing any delay in the effective date, while approximately twenty industry associations signed a letter arguing in favor of extending the effective date.  In late April, the FTC published updated Frequently Asked Questions on its website to provide additional guidance for complying with the revised COPPA rule.

Today, the Commission responded to the industry associations’ letter and informed them that it would retain the July 1, 2013 effective date.  The Commission acknowledged that the revised rule “does impose new obligations on child-directed sites and services,” but explained that, “in selecting an effective date of July 1, 2013, the Commission determined that six months would be adequate time for such operators to assess whether third parties collect personal information through their site or service.”    

Although the Commission did not extend the effective date, it did pledge to “exercise prosecutorial discretion in enforcing the Rule, particularly with respect to small business that have attempted to comply with the Rule in good faith in the early months” following July 1.

Speaking at a seminar hosted by the International Association of Privacy Professionals, Assistant Director Chris Olsen and Senior Attorney Peder Magee, both of the Federal Trade Commission's Division of Privacy and Identity Protection, provided a useful overview of the FTC's recent enforcement actions and current enforcement priorities.  Based on this discussion, the following infographic identifies the FTC's top four enforcement priorities, and recent and future activity that will inform its path forward:  

Advances in technology present opportunities to improve student learning, allow teachers and students to work more efficiently, and reduce operational costs for educational institutions.  Many schools are taking advantage of these benefits by implementing online course systems and cloud computing services that allow students and teachers to access their programs, e-mails, and documents online from anywhere and almost any device.

As a New York Times article published earlier this week also highlighted, the embrace of educational cloud services also raises interesting and important questions about the privacy and security of student data.  After all, these services by definition involve the movement of student and teacher communications, documents, or other data that used to be stored on-site and managed by school employees to the cloud.  Cloud computing services are operated by third-party vendors, and these vendors have a range of business models and practices with respect to the collection, use and disclosure of data. 

As they work to safeguard student data without inhibiting the benefits of educational technologies, we find that educational institutions increasingly are focusing on regulatory requirements and contractual protections for student data -- and in particular five principles that we describe after the jump.

Continue Reading

The U.S. took the lead in legislating privacy rights for children and parents in the Children’s Online Privacy Protection Act more than a decade ago.  Now the European Union has proposed including privacy protections for children in the Data Protection Regulation under discussion, and Latin American countries have included regulation of children’s privacy in new data protection statutes.  Join the Computers, Freedom & Privacy Conference for an interactive discussion of the state of children’s privacy in the U.S. and abroad.  The panelists for this session are experts in children’s privacy:

• Phyllis Marcus, Senior Staff Attorney, Federal Trade Commission.  Phyllis is one of the primary architects of the FTC’s implementation of COPPA, which was updated significantly in December 2012.  She has been at the FTC in several capacities since 1998, prior to which she was legal director for The Appleseed Foundation.  Phyllis holds a JD from the University of Michigan (1993) and a BA in International Relations from the University of Pennsylvania (1990).
• Angela J. Campbell, Co-Director, Institute for Public Representation and Professor of Law, Georgetown University.  Angela joined the Georgetown faculty in 1988 from the Department of Justice.  She has focused on children’s privacy and related issues in both her legal scholarship and her advocacy.  She is the author, for example, of "Ads2Kids.com: Should Government Regulate Advertising to Children on the World Wide Web?," published in the Gonzaga Law Review, and she recently has represented a coalition of public-interest organizations led by the Center for Digital Democracy in filing complaints alleging COPPA Rule violations against several companies.
• Joseph A. Wender, Legislative Director, Congressman Edward J. Markey (D-Mass).  Joseph takes the lead in handling privacy issues for Congressman Markey, who is a Co-Chair of the Congressional Bi-Partisan Privacy Caucus and co-author of the “Do Not Track Kids Act,” a proposal to strengthen online safeguards for children and teens that has drawn nearly 50 co-sponsors in a tightly divided Congress.

The session will be moderated by Kurt Wimmer, co-chair, Global Privacy and Data Security Practice, Covington & Burling, with assistance from Covington colleagues including Matt DelNero, Lindsey Tonsager and other members of the InsidePrivacy.com team.

The session will be held on January 28, 2013, from 10:00 a.m. to noon at Covington & Burling, 1201 Pennsylvania Avenue, N.W., 11th Floor, Washington, D.C.  There is no charge, but please RSVP to Stephanie Herndon (sherndon@cov.com) by January 18 if you wish to attend.

The Federal Trade Commission has released its revised final rule implementing the Children’s Online Privacy Protection Act (“COPPA”), which governs (1) operators of websites and online services that are directed to children under the age of 13 and (2) operators of general audience websites or online services that have actual knowledge that a user is under 13.

The Commission retained the “e-mail plus” consent method and supported a number of new parental consent methods, streamlined the notice requirements, and encouraged the use of automatic filtering tools.  Although the Commission pushed forward with its proposal to define “personal information” to include persistent identifiers, it also broadened the definition of support for internal operations.  Below is a summary of the highlights. 

Continue Reading

By Lindsey Tonsager and Mike Nonaka

On October 2, 2012, the Federal Trade Commission filed a proposed consent decree resolving claims that Artist Arena LLC violated the Children’s Online Privacy Protection Act (COPPA) by collecting and disclosing email addresses, birth dates and other personal information from more than 100,000 children younger than the age of 13 without obtaining proper parental consent.  Artist Arena will pay a civil penalty in the amount of $1,000,000 and comply with monitoring, reporting, and recordkeeping requirements administered by the FTC.

Artist Arena operated websites that served as fan clubs for young musicians, including Justin Bieber, Rihanna, Selena Gomez, and Demi Lovato.  Users could create profiles, communicate with friends, and sign up for musicians’ newsletters through the websites.  The FTC alleged that the websites gathered a host of personal information from children and granted them immediate access to the websites without first providing notice to parents and obtaining parental consent as required by COPPA.  Artist Arena also violated section 5 of the Federal Trade Commission Act by informing parents that the websites would not collect children’s’ personal information until after the adults had given their consent, even though the websites had already procured this information according to FTC officials. 

The FTC’s settlement comes at a time when the agency is deliberating over potential updates to its rule implementing COPPA, as reported in this blog (here, here, here, and here).  According to FTC Commissioner Edith Ramirez, the proposed rules would align requirements under COPPA with enforcement actions such as the one against Artist Arena.  Commissioner Ramirez also stated that the agency would remain vigilant in enforcing COPPA against all companies and not just companies in emerging technologies intended to be captured by the proposed rules.  “Although we are in the midst of updating COPPA to address groundbreaking new technology, we also need to ensure that well-established companies like [Artist Arena] employ familiar online tools in complying with COPPA requirements.  Plainly, more needs to be done to ensure that marketing departments are mindful of COPPA requirements.”

By Lindsey Tonsager and Shel Abramson

Earlier this morning, the FTC proposed additional revisions to the rule implementing the Children’s Online Privacy Protection Act (“COPPA”).  COPPA governs the online collection, use, and disclosure of children’s personal information by (1) operators of websites and online services that are directed to children under the age of 13 and (2) operators of general audience websites or online services that have actual knowledge that a user is under 13.  The FTC initially proposed revisions to the COPPA Rule in September 2011, and based on comments that it received, is proposing additional changes for comment.  Comments to this supplemental proposed rule must be submitted by September 10, 2012.  No final rules were adopted at this time.

The supplemental proposed rule revises the definitions of several key terms, including “operator,” “website or online service directed to children,” “personal information,” and “support for internal operations.” 

• Operator:  The revisions would expand the definition of “operator” to include third parties, such as social plug-ins and ad networks, that know or have reason to know that they collect personal information through child-directed websites and online services.  The FTC previously had rejected a constructive knowledge standard.  The notice suggests that website operators and such third parties would be deemed  “co-operators” that would be jointly responsible for complying with COPPA.  
• Website or Online Service Directed to Children:  The revised definition would allow family friendly websites that are directed to both children and a broader audience to comply with COPPA without treating all users as children, instead providing COPPA protections only to users under the age of 13. 
• Screen and Usernames:  The revisions would clarify that screen or usernames would be covered only where they function as online contact information.   
• Personal Information: The new proposed definition would include persistent identifiers that can be used to identify users over time and across different sites and services.  
• Support for Internal Operations: Activities that are required to manage and operate a site will not be deemed to have collected personal information if they do not use or disclose the information for the purposes of contacting an individual.  

The New Jersey Attorney General and Division of Consumer Affairs have announced a settlement with 24x7digital, the developer of the "TeachMe" mobile apps for preschool through second-grade children, to resolve claims that the company violated the federal Children's Online Privacy Protection Act ("COPPA").   

The state alleged that children were encouraged to submit their full names, along with a photograph, when they created user profiles, and that the apps disclosed the user's full name and the mobile device's unique device identifier ("UDID") to a third-party data analytics company.  According to the state's complaint, 24x7digital ran afoul of COPPA by failing to provide notice or obtain parental consent before collecting, using, and disclosing the children's personal information online. 

Under the statute, a state attorney general may sue for violations of COPPA on behalf of the residents of the state to (i) enjoin the practice; (ii) enforce compliance with the FTC's COPPA rule; (iii) obtain damage, restitution, or other compensation on behalf of the state's residents; or (iv) obtain such other relief as the court may consider to be appropriate.  However, before filing the action, the attorney general typically must notify the FTC and provide a copy of the complaint. The FTC then has the option of intervening in the case. 

Although this is not the first COPPA action that a state has brought (Texas sued three website operators in 2007), most states have left COPPA enforcement to the FTC. With an increased attention on the privacy practices of mobile apps, however, these kinds of cases may become more common. For its part, the New Jersey AG has stated that it will continue to investigate other mobile applications to determine if they are unlawfully sharing users' personal information. 

The FTC has decided not to pursue an enforcement action against Clearwater Aquarium for alleged violations of the Children's Online Privacy Protection ("COPPA") Rule. 

In February 2012, the Children's Advertising Review Unit ("CARU") referred the Clearwater Aquarium's website to the FTC for review under COPPA after the Aquarium reportedly did not respond to CARU's inquiry.  CARU claimed that the site featured a “Kidzone” where visitors could sign up for an e-newsletter by entering their first and last names, mailing and email addresses, and cellphone numbers.  CARU was concerned that the Aquarium collected personally identifiable information from children under the age of thirteen without first obtaining parental consent and that the Aquarium's privacy policy -- which stated that it did not collect information from children under 18 without parental consent -- did not accurately reflect its actual privacy practices.

After reviewing the website, the FTC concluded "that the information collection practices that had triggered CARU's inquiry had been remedied."  The FTC declined to take any further action, instead referring the matter back to CARU. 

CARU, a division of the Council of Better Business Bureaus, is a self-regulatory body that monitors websites for compliance with COPPA.  Although CARU's self-regulatory program is completely voluntary, CARU may refer cases to the FTC if companies refuse to respond to inquiry letters.  The FTC reviews CARU's case referrals to determine whether enforcement action is appropriate.  Although the FTC has initiated enforcement actions in response to CARU referrals in the past, the Clearwater Aquarium case is a reminder that the FTC may decide no further action is necessary.  

The Federal Trade Commission on Feb. 24 announced it had approved a new safe-harbor program for online services that are subject to the Children’s Online Privacy Protection Act (COPPA), a federal law that regulates the online collection of personal information from children under 13. Under COPPA and the FTC’s implementing rule, online services that comply with FTC-approved, industry-developed safe-harbor programs generally are considered by the FTC to be compliant with COPPA. Approval requires an FTC determination that the proposed safe-harbor program will provide at least as much protection as the FTC rule and will be able to encourage and monitor compliance effectively.

The newly approved safe-harbor program, run by Aristotle International, Inc., is the fifth such program approved by the FTC.  The program sets out requirements for the format and content of participants’ privacy policies, parental notices, and procedures for obtaining verifiable parental consent. Among other provisions, COPPA requires websites and other online services that are directed at children or that have actual knowledge that a user is a child to notify a parent and obtain the parent’s verifiable consent before collecting, using, or disclosing personal information from a child.

Continue Reading