Representatives Edward Markey and Joe Barton recently introduced the “Do Not Track Kids Act of 2011,” which would expand and modernize the Children’s Online Privacy Protection Act (COPPA) and also would introduce new privacy protections for all minors under 18.
COPPA currently prohibits operators of websites and online services from knowingly collecting, using, or disclosing personal information from children under 13 years of age without parental consent. The Do Not Track Kids Act would, among other changes, expand COPPA to cover online and mobile applications and to protect unique device identifiers such as IP addresses.
Separately, the bill would establish new privacy rules to protect minors under 18. If enacted, the bill would prohibit the use of personal information for targeted marketing to minors, require express consent from parents or teens prior to the collection of geolocation information, require operators to provide a means to delete personal information shared publicly by minors, and require covered entities to implement a “Digital Marketing Bill of Rights for Teens” that would be influenced by the Federal Trade Commission.
After the jump is a summary of the bill’s key provisions.
Amendments to COPPA
The bill would make the following key changes to COPPA:
- Scope of Services Covered: COPPA currently applies to operators of websites and online services. The bill would expand COPPA’s reach to include online applications and mobile applications. The bill would continue to apply only if such operators either (1) direct their activities to children or (2) have actual knowledge that a user is under 13.
- Scope of Data Covered: The bill would expand the definition of “personal information” subject to COPPA’s restrictions to include numbers that can be used to identify devices, including IP addresses.
- Required Continuation of Service: COPPA currently permits operators to terminate service to a child if a parent withdraws consent to the use or maintenance of the child’s personal information. The bill would reverse this position — it would prohibit operators from discontinuing service upon withdrawal of parental consent unless it would not be possible to continue the service.
- Expanded FTC Discretion in Defining Key Terms: The bill would provide the FTC authority to define the terms “online,” “online service,” “online application,” “mobile application,” “directed to children,” and “directed to minors.” Each of these terms are key to demarcating COPPA’s scope.
- Telecommunications Carriers and Cable Operators: Although these entities generally are exempt from FTC authority based on their sector-specific regulation by the Federal Communications Commission, the bill would clarify that they are subject to COPPA and the FTC’s authority under that law.
New Privacy Protections for All Minors
The bill establishes the following new privacy protections for minors:
- Prohibition on Targeted Marketing: Covered entities would be prohibited from using, disclosing, or compiling personal information from minors for targeted marketing. The bill defines “targeted marketing” to mean advertising aimed at a specific individual or device based on personal information or a unique device identifier, as a result of the individual’s use or the device’s access to the website, online service, online application, or mobile application.
- Geolocation Data: For children under 13, parental consent would be required to collect geolocation information. For teens, express consent from the user would be required. Covered entities also would have to provide opportunities to access the geolocation information collected.
- Digital Marketing Bill of Rights for Teens: The bill would require covered entities to adopt a “Digital Marketing Bill of Rights for Teens” that balances social media participation against privacy and incorporates seven “Fair Information Practice Principles.”
- Eraser Buttons: Any operator of a website, online service, online application, or mobile application that makes personal information collected from individuals under 18 publicly available — regardless of whether the operator directs its activities to minors or has actual knowledge that it collects personal information from minors — would be obligated, to the extent technologically feasible, to make it possible for users to delete a minor’s personal information.
The FTC and state attorneys general would enforce the bill’s new privacy protections and COPPA amendments.