Gadbaw, Tianna

English

Loyola University Chicago, School of Law: LAW eCommons

Children's Legal Rights Journal 
Volume 36 Issue 3 Article 7 
2016 
Legislative Update: Children's Online Privacy Protection Act of 
1998 
Tianna Gadbaw 
Follow this and additional works at: https://lawecommons.luc.edu/clrj 
 Part of the Family Law Commons, and the Juvenile Law Commons 
Recommended Citation 
Tianna Gadbaw, Legislative Update: Children's Online Privacy Protection Act of 1998, 36 CHILD. LEGAL 
RTS. J. 228 (2020). 
Available at: https://lawecommons.luc.edu/clrj/vol36/iss3/7 
This Article is brought to you for free and open access by LAW eCommons. It has been accepted for inclusion in 
Children's Legal Rights Journal by an authorized editor of LAW eCommons. For more information, please contact 
law-library@luc.edu. 
Legislative Update:
Children's Online Privacy Protection Act of 1998
By: Tianna Gadbaw
The growth of the Internet in the early 1990s not only brought about instantaneous
person-to-person connection, but also raised new concerns in regards to privacy and safety
of children. Commentators were chiefly concerned with the Internet because of the ease in
which personal information could be collected from people and how parental oversight of
children's activities could be bypassed without any difficulty Through the increased use of
chat rooms, discussion boards, and promises of gifts, marketers had the ability to readily
gather personal identifying information about children. This personal information was
often organized into databases, which in turn, were sold to third parties.
To address the growing online privacy concerns of children, the Federal Trade
Commission ("FTC") held public forums throughout 1998 in which privacy advocates and
Internet industry representatives were in attendance. Addressing concerns raised in the
public forums, the FTC also conducted a survey of 1,400 popular websites, from which
they discovered:
(1) 85% of the all websites collected personal information;
(2) The majority of websites marketed to children also collected personal
information from children; and
(3) Only a few of the websites marketed to children posted an
adequate privacy policy.
In response to the FTC's findings, Congress passed the Children's Online Privacy
Protection Act ("COPPA") on October 21st, 1998. With COPPAs enactment, Congress
aimed to protect children's privacy online by limiting the collection of personal
information of children under thirteen and enhancing parental involvement in online
activities by requiring parental consent before collecting personal information from
children.
COPPA specifically focuses on websites targeted towards children and general
websites where operators have knowledge that children visit. COPPA has five major
requirements: (1) notice, (2) parental consent, (3) parental review, (4) security, and (5)
limits on the use of games and prizes.
Under the "notice" requirement, websites directed at children must provide notice
of what information they collect from child visitors, how that information is used, and to
whom that information is disclosed. This notice must be a done in a "clear and prominent
manner." Thus, notice can be given on the home page, a specific area of a site directed at
children, or on any page in which personal information is collected.
Parental consent may be obtained through "any reasonable effort." Although
generally required, parental consent is not necessary when a website obtains personal
information for the sole purpose of "responding directly on a one time basis to a specific
request from the child" and that information is "not used to re-contact the child." For
example, if a child were to ask a homework question on a tutoring website and has to
provide an email address for a response, the tutoring website may use the email to respond
only once to the child's original question and cannot re-contact the child after its initial
response.
1
Gadbaw: Legislative Update: Children's Online Privacy Protection Act of 1
Published by LAW eCommons, 2020
Children's Legal Rights Journal
For parental review, websites must provide both a method for parents to review the
information that has been collected and a method for a parent to contact the website
operator to prohibit any further use or maintenance of the child's personal information.
Thus, parents of children who have personal profiles or online blogs can have access to
their children's online profile and can have parts or the whole profile deleted or modified
at any time.
Further, COPPA considers data security as an upmost priority, with Section 312.8
emphasizing the importance of websites establishing and maintaining external security
measures.' Adequate external security measures for COPPA compliance include firewalls,
information deletion, limits on employee access to data, and careful screening of third
parties to whom such information is disclosed.
Finally, COPPA prohibits websites that are focused on children from conditioning
participation in a game or the offering of a prize of another activity by requiring disclosure
of more personal information than necessary to participate. Thus in practice, websites may
not require children to answer invasive questions, such as "What cars do your parents
drive?" or "What's your social security number?" in exchange for the child's ability to
participate in an online game or contest.
In December of 2012, in response to growing changes in technology, the FTC
issued the first major amendments to COPPA since its passing in 1998. These amendments
were intended "to clarify the scope of the Rule and strengthen its protections for children's
personal information." Generally, these new amendments clarify ambiguities from the old
Act and add changes to the Act's requirements. Further, the amendments streamline what
operators tell parents in their privacy policy notices in order for the most essential
information to be quickly communicated to parents.
Specifically, the amendment modifies many definitions under the Act. For
example, the defined term "Operator" now includes any "operator of a child directed site
or service where it allows outside services to collect personal information from its visitors."
This new definition closed a loophole that allowed kid directed apps and websites to permit
third parties to collect information.
In addition, "website or online service directed to children" was redefined to (1)
include "plug-ins or ad networks that have actual knowledge that they are collecting
personal information through a child-directed Web site or online service" and (2) "allow a
subset of child-directed sites and services (those that target children but not as their primary
audience) to 'age screen' their users and require such properties to meet COPPA's notice
and consent obligations only for those users who self-identify as younger than age 13."
Because of this expanded definition, more websites must now comply with COPPA.
Moreover, "personal information" was re-defined to include "geological
information as well as photos, videos, and audio files of a child's image or voice."
Therefore, websites are further prohibited from gaining physical information of children,
closing a significant loophole of the original legislation.
Additionally, the 2012 amendments contain stronger provisions to keep a child's
information secured. Operators are now mandated to keep children's personal information
for only "as long as is reasonably necessary" and once they dispose of it they must take
"reasonable measures to protect against unauthorized access." Operators are further
1 §312.8 of COPPA states, "The operator must establish and maintain reasonable procedures to protect the
confidentiality, security, and integrity of personal information collected from children."
[Vol.36:3 2016]
2
Children's Legal Rights Journal, Vol. 36, Iss. 3 [2020], Art. 7
https://lawecommons.luc.edu/clrj/vol36/iss3/7
Legislative Update
required to take "reasonable steps to release personal information only to service providers
and third parties who are capable of maintaining the confidentiality, security, and integrity
of such information."
The 2012 amendments also provide the FTC with greater oversight over safe harbor
programs. Under the original Act, the safe harbor provision encouraged industry self
regulation by allowing approved industry members to create their own COPPA oversight
programs with their own compliance guidelines. These programs were known as "safe
harbor programs." Website operators who participated in these approved safe harbor
programs were subject only to the provisions of their own self-created and self- regulated
safe harbor program in lieu of FTC enforcement. The 2012 amendments require safe harbor
programs to conduct annual comprehensive reviews of their member's information
practices and submit to the FTC annual reports of the results of these annual reviews.
The 2012 amendments also expanded the methods in which companies could obtain
parental consent. For example, company websites can now obtain parental consent through
electronic scans of signed parental consent forms, videoconferencing, use of government-
issued ID, and alternative payment systems. In addition, due to advancing technology,
businesses can also get new consent methods approved by submitting to a 120-day notice
and comment process conducted by the FTC. Most recently in November of 2015, Riyo
Limited, a business and software development company, received FTC approval of a new
verifiable parental consent method called "face match to verified photo identification."
Under this new method, a parent can use a cell phone or computer to take a picture of his
or her photo identification (ex. driver license) and use the same device to take a picture of
him or herself. These two images are then compared to validate that the person providing
consent is the same person in the photo identification. This process can be completed in
minutes and provides real time parental consent for websites and mobile applications.
Since its passing, COPPA has been subject to many criticisms. One major critique
is that COPPA violates children's right to freedom of speech and expression. Since
COPPA's regulations apply to data collection of children under thirteen, websites often
simply ban users twelve and under instead of attempting to comply with COPPA
regulations. Meanwhile, websites that allow access to children under twelve will often opt
for heavy restrictions on these children's interactions to prevent them from revealing
personal information. Thus it is argued, that COPPA has the practical effect of preventing
kids under thirteen from freely expressing themselves on most social media platforms.
Critics also note that the 2012 amendments have a detrimental effect on the ability
of certain applications and websites to make revenue. Under the 2012 amendments, sites
directed at children will no longer be able to deliver targeted advertisements to children
without parental consent. Targeted advertisements usually provide more revenue for
websites because they are more relevant to users. To make up for this revenue loss,
developers may increase the number of advertisements shown to children or move away
from advertisement-based income models to fee-based income models. This will impact
the quality of free applications and websites available to children.
Another common criticism is that the age verification systems that websites
implement simply do not work effectively to protect children because it is easy for children
to lie about their age to gain access to a website. Critics posit that children can easily outwit
even the more advanced age verification technologies and get around many parental
consent processes.
230
3
Gadbaw: Legislative Update: Children's Online Privacy Protection Act of 1
Published by LAW eCommons, 2020
Children's Legal Rights Journal
Due to these criticisms, many advocate that the most effective solution to protecting
children online is through the old school approach: education. These advocates feel that by
simply educating parents and children about what is happening online, we can better
protect children then any provision in COPPA.
Despite the above criticisms, it is evident that COPPA is here to stay and will
remain the main legislative source for protection of children's privacy online. Yet, as
technology continues to advance, COPPA will have to stay current by enacting frequent
updates to the law.
Sources
15 U.S.C. § 6502(b)(2)(A) (2012).
Daniel Castro, Why Haven't the FTC's New COPPA Rules Made Your Kids Safer Online?, THE INNOVATION
FILES (July 11, 2013), http://www.innovationfiles.org/why-havent-the-ftcs-new-coppa-rules-made-your-
kids -safer-online/.
FTC Grants Approval for New COPPA Verifiable Parental Consent Method, FED. TRADE COMM'N (Nov.
19, 2015), https://www.ftc.gov/news-events/press-releases/2015/1 1/ftc-grants-approval-new-coppa-
verifiable-parental-consent-method.
Joshua Warmund, Can COPPA Work? An Analysis of the Parental Consent Measures in the Children's
Online Privacy Protection Act, 11 FORDHAM INTELL. PROP. MEDIA & ENT. L.J. 189, 205 (2000).
Justine Gottshall, COPPA and Recent Amendments to the COPPA Rule: A Comprehensive Guide, INFO. LAW
GRP. (Dec. 7, 2013),
http://www.infolawgroup.coni201 3/1 2/articles/regulations/coppa-and-recent-amendments-to-the-coppa-
rule-a-comprehensive-overview.
Larry Magid, Magid: Protecting Children Online Needs to Allow for Their Right to Free Speech,
SILICONVALLEY.COM, (Aug. 29,2014, 1:21 PM),
http://www.siliconvalley.com/larry-magid/ci-26432286.
Laurel Jamtgaard, Big Bird Meets Big Brother: A Look at the Children's Online Privacy Protection Act, 16
SANTA CLARA HIGH TECH. L.J. 385, 388-90 (2000).
Lauren A. Matecki, Update: COPPA is Ineffective Legislation! Next Steps for Protecting Youth Privacy
Rights in the Social Networking Era, 5 Nw. J. L. & SOC. POL'Y 369
(2010), http://scholarlycommons.law.northwestern.edu/njlsp/vol5/iss2/7.
Lesley Fair, FTC's Revised COPPA Rule: Five Need-to-Know Changes for Your Business, FED. TRADE
COMM'N, (Dec. 19, 2012, 12:01 PM),
https://www.ftc.gov/news-events/blogs/business-blog/20 12/1 2/ftcs-revised-coppa-rule-five-need-know-
changes -your-business.
Melanie L. Hersh, Is COPPA A Cop Out? The Child Online Privacy Protection Act As Proof That Parents,
Not Government, Should Be Protecting Children's Interests on the Internet, 28 FORDHAM URB. L.J. 1831,
1854-55 (2000).
Nicole Perlroth, Verifying Ages Online is a Daunting Task, Even for Experts, N.Y. TIMES, (June 17, 2012),
http://www.nytimes.conim2012/06/18/technology/verifying-ages-online-is-a-daunting-task-even-for-
experts.html?pagewanted=all&_r=0.
RIYO Verified Limited, GBR Bus.,
[Vol.36:3 2016]
4
Children's Legal Rights Journal, Vol. 36, Iss. 3 [2020], Art. 7
https://lawecommons.luc.edu/clrj/vol36/iss3/7
Legislative Update 232
https://www.gbrbusiness.com/company/Riyo-Verified-Limited (last visited Feb. 28,
2016).
Sara M. Grimes, Revisiting the Children's Online Privacy Protection Act, THE JOAN CLOONEY CTR. (Mar.
25, 2013),
http://www.joanganzcooneycenter. rg/201 3/03/25/revisiting-the-childrens-online-privacy-protection-act.
Sasha Grandison, The Child Online Privacy Protection Act: The Relationship Between Constitutional Rights
and the Protection of Children, 14 U. D.C. L. REv. 209, 210-12 (2011).
Nancy L. Savitt (2002) A Synopsis of the Children's Online Privacy Protection Act, 16 J. C.R. AND ECON.
DEV. 631, 632 (2002),
http://scholarship.law.stjohns.edu/jcred/vo16/iss3/7.
5
Gadbaw: Legislative Update: Children's Online Privacy Protection Act of 1
Published by LAW eCommons, 2020


Legislative Update: Children\u27s Online Privacy Protection Act of 1998

bepress Legal Repository

https://lawecommons.luc.edu/cgi/viewcontent.cgi?article=1135&amp;context=clrj

Legislative Update: Children\u27s Online Privacy Protection Act of 1998

Abstract

Similar works

Full text

Available Versions

Loyola University Chicago, School of Law: LAW eCommons

bepress Legal Repository