In comments (PDF) on the FTC's Review of the rules implementing the Children's Online Privacy Act (COPPA), I urge the FTC to consider ten values that should guide their consideration of revisions to the rules:
- Power of Parental Control. Parents should have the opportunity, and means, to decide how much sharing of personal information based on their own values and judgments about privacy, safety and exposure to marketing.
- Simplicity of Parental Control. Parents should be able to exercise such control as easily as possible.
- Privacy & Security. While it might seem obvious that COPPA should enhance, rather than undermine children's privacy and the security of data collected about children, COPPA could, if revised imprudently, result in the collection of more data about children, and increase the risk of exposing that data to those who might mis-use it.
- Education & Citizenship. Digital media should offer children a vehicle for developing as informed citizens of an information society and economy. Using sites and services appropriate for their developmental maturity ensures that they will be well-prepared later on in life, and that our educational system can make effective use of digital tools.
- Expression. Digital media should empower children to express themselves, subject to parental control.
- Abundance. Digital media should be abundant, much like the broader Internet.
- Diversity. Digital media should be diverse, much like the broader Internet.
- Affordability. Digital media should cost as little as possible without compromising quality.
- Innovation. Digital media should, like the rest of the web, constantly improve in quality, sophistication, and interactivity.
- Competition. Competition in digital media and low barriers to entry will promote abundance, affordability and innovation.
Unfortunately, some of the changes proposed by the FTC in the name of promoting parental control, privacy and security might, despite their noble intentions, make choice more difficult, while also driving up prices, reducing the quality and quantity of children’s content, and diminishing competition. There is no free lunch, even when it comes to children’s content.
If COPPA is to aid parental authority effectively, while promoting these other values in children’s digital media, the FTC must carefully consider the unintended consequences of revising COPPA. In particular, the FTC should:
- Retain email plus as a mechanism for verifying parental consent, or at least:
- Avoid subjecting network and platform operators to more burdensome consent requirements; and
- All data collected under previous standards will be “grandfathered in” such that no new consent need be obtained.
- Consider holding a public workshop on alternative mechanisms for verifying parental consent.
- Consider how to promote the development of consent management platforms by which operators of platforms that support other applications and services can obtain consent on behalf of those third parties for strictly limited purposes.
- Not include persistent identifiers in the definition of personal information, or at least:
- Add an exception in paragraph (h) equivalent to that in paragraph (g): internal uses of information gathered using a persistent identifier may be gathered and used within an analytics or advertising platform without requiring parental consent;
- Clarify that no platform shall be considered an operator subject to COPPA (thus needing recourse to such a definition exception in the first place) by virtue of the fact that its content may be embedded on such a child-directed site; and
- Clarify that such analytics and advertising networks and content platforms are exempt from COPPA’s access and deletion provisions.
- Replace the current 100% deletion requirement with a ‘‘reasonable measures’’ standard, as proposed.
For more information, see my 2009 paper with Adam Thierer: COPPA 2.0: The New Battle over Privacy, Age Verification, Online Safety & Free Speech.