New COPPA Rule Expands Children's Online Privacy Protections
Yesterday, the Federal Trade Commission (FTC) released amendments to the Children's Online Privacy Protection Rule. The amended Rule will take effect on July 1, 2013 and could have a dramatic impact on operators of websites or online services that could be used by children. In certain instances, operators may be held responsible for the practices of third parties that place advertising or provide services through the operator's website or app.
The FTC's new Rule implements the Children's Online Privacy Protection Act (COPPA), which generally requires operators of websites or online services that are directed to children under 13 or have actual knowledge that they are collecting children's personal information to give notice to parents and obtain their verifiable consent. The Rule implements and expands upon statutory COPPA provisions that could have a far-reaching impact on covered businesses.
As detailed in our Summary, the new Rule:
- Expands the critical definition of "personal information" that cannot be collected without parental notice and consent to include geolocation information, photographs and videos, as well as persistent identifiers (including IP addresses and mobile device IDs) that can be used to recognize a user over time and across different sites or online services.
- Expands the key definition of "operator" to place strict liability obligations on companies that direct a site or service to a child when a third-party service-such as a plug-in or advertising network-collects personal information from visitors. The FTC characterizes this amendment in a press release as "clos[ing] a loophole."
- Expands the key definition of "website or online service directed to children" to place obligations directly on plug-ins or advertising networks that have actual knowledge of collecting personal information through a child-directed site or service.
- Imposes new "just in time" parental notice requirements.
Imposes requirements to reasonably secure children's personal information, to conduct due diligence before disclosing such information to third parties, and to delete such information after it is no longer "reasonably necessary."
