In 1998, a nifty little search engine business called Google was founded, the iMac was unveiled, and the Children’s Online Privacy Protection Act was created. Now, 14 years and a technological lifetime later, the Federal Trade Commission is updating those rules (PDF). While privacy advocates and all manner of organizations concerned about marketing to kids have been pushing for further restrictions, companies such as Walt Disney and Facebook are already angling for exemptions.
Coppa, as the existing regulation is called, requires websites aimed at kids to get parental consent before gathering information about those users who are under 13. But data brokers and the companies they work for have found a way around that. Software installed on kids’ websites can collect personal information without parents’ approval. The companies operating the sites can argue that they aren’t responsible for what the brokers are doing. Now the FTC wants to hold both the brokers and the sites responsible for getting permission from parents to track their kids online.
“We think that sharing responsibility between data collectors and site operators is important,” says Iona Rusu, the regulatory counsel at the Consumers Union. “The companies are the ones allowing it, and they should be the ones who have to give notification.”
Here’s the other reality the FTC is trying to catch up to: Twenty-two percent of 5- to 8-year-olds use a computer at least once a day, and another 46 percent use it at least once a week, according to a 2011 study (PDF) by Common Sense Media, a nonprofit in San Francisco that studies media’s impact on children. More than a third of all children 8 or younger have used a cell phone, iPod, iPad, or similar device to play games, use apps, or watch videos, TV shows, or movies. By the time they’re in the 5- to 8-year-old age range, half have done so at one point.
“The FTC’s recommended rules will help ensure that parents have better information and tools and that parents—not third-party ad networks and data brokers—get to decide when their children’s personal information can—and can’t—be collected, shared, and sold,” wrote James Steyer, the founder of Common Sense Media, in an e-mail.
Without knowing it, these kids are leaving important clues for marketers all over the place. “Marketers want psychographic data—algorithms that can track the mood and emotional profile of a child,” says Joel Bakan, a lawyer and author of Childhood Under Siege: How Big Business Targets Children. “Reaching kids is all about getting at their emotions, titillating them, scaring them. What makes kids different from adults is that they can’t get outside their emotions and reflect on them. They are incredibly vulnerable to this kind of emotional manipulation.”
He says that past enforcement of Coppa has been fairly lax and fines fairly minimal. “A change in law is necessary, but there has to be a change in enforcement, too,” Bakan says. The biggest penalty to date, according to the Wall Street Journal, was a $3 million fine paid by a subsidiary of Disney last year to settle charges that it illegally collected and disclosed personal information from hundreds of thousands of kids without their parents’ approval.
“We have tried to be strategic in our enforcement efforts,” says Mary Engle, director of the FTC’s advertising practices division. “We have ratcheted up civil penalties. We do a lot that is invisible to the public: hand-holding, providing advice to companies, explaining the rules. Our goal is compliance.”
The FTC asked for comments on the proposed rules and received hundreds. Among them were ones from Facebook and Disney. Facebook argued that software such as its “Like” button should be exempt since it isn’t used to target ads. Disney wants its site to be exempt because it’s aimed at families and not just kids. “We are concerned about the lobbying of the Walt Disney Co. and others to secure an exemption,” says Jeffrey Chester, executive director of the Center for Digital Democracy, the organization that led the campaign in 1998 for regulation.
Engle says she expects the FTC will hear from other companies, too. “We’re always trying to balance the need to implement our rules in a way that is sensitive to what’s feasible and practical for industry and provides protection.” The FTC is accepting comments until Sept. 10.