Commenters Urge FTC to Streamline COPPA Rule "Multiple Operator" Provision
Nearly 200 individuals, businesses, and industry organizations recently filed comments with the Federal Trade Commission on proposed revisions to the Children's Online Privacy Protection Act ("COPPA") Rule. COPPA requires operators of certain websites or online services to, among other things, provide notice and obtain parental consent before collecting, using, or disclosing personal information online from children under 13.
The FTC's COPPA Rule currently provides an exception, known as the "multiple operator" provision, which applies in the increasingly common situation where multiple operators offer various applications, games, or other services through a single online platform. The multiple operator provision allows one designated operator to provide notice and respond to parental inquiries on behalf of all operators who collect or maintain personal information of children through a single website or online service. The names of all of the operators collecting or maintaining personal information from children through that website or online service must be listed in the designated operator's notice.
The FTC proposes eliminating this provision and instead requiring the privacy notice for a single website or online service to provide contact information for all the operators on that site or service. However, many of the organizations that addressed this issue in their comments to the FTC regarding its proposed revisions to the COPPA rule unanimously opposed the elimination of the multiple operator provision and, in fact, largely supported streamlined parental notice and consent provisions for multiple operator websites and online services. These commenters included the Association for Competitive Technology, AT&T, the Computer and Communications Industry Association, the Entertainment Software Association, Facebook, the Future of Privacy Forum ("FPF"), Microsoft, the Online Publishers Association, the Software & Information Industry Association, and the Walt Disney Company.
FPF argued that if an application "will only use the personal information provided by the platform for internal operations (including fraud, first party ads, maintaining user settings, etc.) the Commission should allow app developers to rely on platform providers to provide notice and obtain parental consent on their behalf." Similarly, Microsoft supported streamlined parental notice and choice provisions, stating that the Commission should "clarify its rules to permit ad networks and other third-party online service providers to rely on the parental consent that is obtained by the first-party operator of the website or online service as long as the first-party operator clearly discloses to the parent that the child's personal information will be disclosed to third-party online service providers."
The FTC is in the process of reviewing the comments before issuing any final rules.