Saying that he wanted to give a "very hard time" to companies that "make their living off of grinding out through various technological tricks private information about kids 12 and under," Sen. Jay Rockefeller (D-W.Va.) today introduced toughened new restrictions for online sites that collect data about children.
The toughened rules are part of the Federal Trade Commission's COPPA Rule -- the COPPA standing for Children’s Online Privacy Protection Rule, first adopted in 1998.
The amendments strengthen kids’ privacy protections and give parents greater control over the personal information that websites and online services may collect from children under 13.
At a Capitol Hill news conference, Rockefeller said the FTC "went as far as they could on this one."
"My guess is they would have liked to have gone farther but they couldn't" because of legal restrictions, Rockefeller said, leaving no doubt that he would like to see legislation that allowed even tougher restrictions on exploitation of children by online advertisers, Internet sites, apps and data brokers.
"We can't do anything more about it right now. But to me this is such a no-brainer, it's an absolute priority. Children's privacy is an absolute top-line issue for me. I'm going to do every single thing I possibly can to make it strong, stronger and yet stronger," said Rockefeller, Chairman of the Senate Commerce, Science and Transportation Committee.
The amendments announced today are the result of a review the FTC opened in 2010 to ensure that the COPPA Rule keeps up with evolving technology and changes in the way children use and access the Internet, including the increased use of mobile devices and social networking.
“The Commission takes seriously its mandate to protect children’s online privacy in this ever-changing technological landscape,” said FTC Chairman Jon Leibowitz. “I am confident that the amendments to the COPPA Rule strike the right balance between protecting innovation that will provide rich and engaging content for children, and ensuring that parents are informed and involved in their children’s online activities.”
Rep. Ed Markey (D-Mass.) said COPPA was "not Big Brother, it's Big Mother and Big Father."
"COPPA was put on the books for one reason: to protect the most vulnerable," Markey, ranking member of the House Energy and Commerce Committee, said. "The Internet is our children's 21st century playground. Keeping kids safe on the internet is as important as ensuring their safety in homes, schools and cars. Parents are the best guardians of their chiildren's safety, which is why this update is so important."
- modify the list of “personal information” that cannot be collected without parental notice and consent, clarifying that this category includes geolocation information, photographs, and videos;
- offer companies a streamlined, voluntary and transparent approval process for new ways of getting parental consent;
- close a loophole that allowed kid-directed apps and websites to permit third parties to collect personal information from children through plug-ins without parental notice and consent;
- extend coverage in some of those cases so that the third parties doing the additional collection also have to comply with COPPA;
- extend the COPPA Rule to cover persistent identifiers that can recognize users over time and across different websites or online services, such as IP addresses and mobile device IDs;
- strengthen data security protections by requiring that covered website operators and online service providers take reasonable steps to release children’s personal information only to companies that are capable of keeping it secure and confidential;
- require that covered website operators adopt reasonable procedures for data retention and deletion; and
- strengthen the FTC’s oversight of self-regulatory safe harbor programs.
COPPA requires that operators of websites or online services that are either directed to children under 13 or have actual knowledge that they are collecting personal information from children under 13 give notice to parents and get their verifiable consent before collecting, using, or disclosing such personal information, and keep secure the information they collect from children.
It also prohibits them from conditioning children’s participation in activities on the collection of more personal information than is reasonably necessary for them to participate.
Noting that the FTC had conducted extensive headings and meetings with industry groups as well as children's advocates, Leibowtiz noted that COPPA covers only sites directed to children and which knowingly collect data from children.
"This is a sliver of the Internet, but it's an important sliver," he said.