Sweeping Changes Proposed for COPPA
Proposed Updates to COPPA
Representative Kathy Castor has proposed widespread changes to the Children’s Online Privacy Protection Act (“COPPA”) by introducing updates to the “Protecting the Information of our Vulnerable Children and Youth Act” (“Kids PRIVCY Act”).
COPPA Requirements
COPPA is the United States’ most visible privacy law when it comes to federal privacy protection of children. Passed in the 1990’s, COPPA currently applies to websites that market or target their services towards children under the age of 13. If the website operator is based in the United States, COPPA requires: 1) a clear and comprehensive online privacy policy; 2) direct notice to parents to obtain verifiable consent; 3) parents be given the choice of consenting to the collection of the child’s information; 4) parents be given access to their child’s personal information to review and/or have deleted; 5) parents be given the opportunity to prevent further use or collection of information; 6) maintenance of the confidentiality, security, and integrity of collected information; 7) the retention of personal information only as long as necessary; and 8) children not be required to give information as a condition of participation in the website’s online activity.
As a result of COPPA, most websites simply prohibit children under 13 from using their services altogether. Representative Castor’s proposed changes to the PRIVCY Act would expand the reach of COPPA in many ways.
Proposed Updates to COPPA and Expansion to PRIVCY Act
Perhaps, most significantly, the definition of “personal information” would newly include biometric, health, and education information. The definition would also be expanded to include physical characteristics, contents of messages and calls, and browser search history. It would also be expanded to include a new class to cover teenagers. While teenagers’ personal information would be newly subject to the scope of the law, teenagers would still have control over whether they could provide consent to have their information collected, used, or shared online.
The PRIVCY Act would also expand the reach of COPPA to go beyond sites that are directed or have “actual knowledge” that they collect personal information from children. Instead, it would be expanded to cover sites and services that are “likely to be accessed by children or teenagers,” which means “the possibility of more than a de minimis number of children or teenagers accessing the digital service is more probable than not.” It also prohibits online sites and services from targeting advertising based on information collected on them. While these are not all the proposed changes to COPPA and the PRIVCY Act, it covers some of the most visible changes.
Key Takeaways to Proposed Updates to COPPA
Representative Castor has proposed changes to the expand the reach of the PRIVCY Act, which would update COPPA to:
Include a new, broader definition of “personal information;”
Newly cover teenagers; and
Expand from sites that “target” children to sites that are “likely to be accessed” by children and teenagers.
For more information on technology and data privacy services, see our Technology & Data and Industry Focused Legal Solutions pages.