The Federal Trade Commission (FTC) has finalized changes to the Children's Online Privacy Protection Rule (COPPA), introducing new requirements for the collection, use, and disclosure of children's personal information. These changes aim to provide parents with enhanced tools and protections to manage data shared with third parties about their children.
One significant update in the rule mandates that parents must opt-in for third-party advertising. This move addresses evolving methods of data collection and usage by companies, particularly concerning children's data sharing and monetization. FTC Chair Lina M. Khan stated, "The updated COPPA rule strengthens key protections for kids’ privacy online," emphasizing the prohibition on platforms from sharing or monetizing children's data without parental consent.
In January 2024, proposed changes were introduced to ensure COPPA remains relevant in a rapidly changing marketplace since its last update in 2013. Initially implemented in 2000, COPPA requires websites and online services to obtain verifiable parental consent before collecting personal information from children under 13. It also grants parents rights such as demanding operators delete their child's collected information.
Among several amendments soon to be published in the Federal Register are:
- Opt-in consent is required for targeted advertising: Operators covered by COPPA must obtain separate parental consent before disclosing children's personal information for advertising or other purposes.
- Data retention limits: Operators can only retain personal information as long as necessary for its intended purpose.
- Transparency in Safe Harbor programs: FTC-approved self-regulatory programs must disclose membership lists publicly and report additional details to enhance accountability.
Amendments also expand definitions within the rule, now including biometric identifiers and government-issued identifiers as personal information.
After reviewing nearly 300 comments on proposed changes, some suggestions were not adopted. These included limiting push notifications directed at children without parental consent and certain educational technology company requirements. Despite this, concerns remain about engagement techniques potentially harming children's mental health.
The final rule was approved unanimously by a 5-0 vote from the Commission. Separate concurring statements were issued by Chair Lina Khan and Commissioner Andrew Ferguson; Commissioners Alvaro Bedoya and Rebecca Slaughter provided a joint statement. The rule will take effect 60 days post-publication in the Federal Register, with entities given one year to comply fully unless specified otherwise.
James Trilling and Elizabeth Averill led this matter within the FTC’s Bureau of Consumer Protection.
The FTC's mission is to promote competition while protecting consumers through education efforts against frauds or scams via resources like consumer.ftc.gov or ReportFraud.ftc.gov.
