Child Web Privacy Law Gets Updated

originally appeared in The Wall Street Journal:

In a move to update rules governing children's privacy online to cover new areas like smartphones, U.S. regulators broadened decade-old policies, but amid pressure from the technology industry backed away from proposals that could have made companies like Facebook Inc. and Apple Inc. more responsible for violations.

The Federal Trade Commission said it would change how it implements the Children's Online Privacy Protection Act of 1998, or Coppa, to reflect the growth of social networks and smartphone apps among children.

The commission also expanded the types of information it considers personal under the law. Kids' apps and websites will now have to obtain parental consent before gathering photos, videos or geographic location, and before tracking kids' online behavior and passing along the data to other companies.

But in a departure from rule changes the government proposed in August, the FTC explicitly exempted app stores like those run by Apple and Google Inc. from responsibility for privacy violations by the games and other software that are sold there.

The updated rules, which go into effect July 1, also make clear that software such as Facebook's "Like" button and ads placed by advertising networks will only have to meet child online privacy regulations if companies have "actual knowledge" that they're collecting information through a website or app that targets kids.

The commission's move ended one chapter in the long-running Washington debate over how closely the government should regulate online privacy, but set the stage for new battles.

Consumer advocates said they would continue their push to make Apple and Google more responsible for the data-gathering practices of the apps they distribute, while several members of Congress are pushing legislation to further tighten limits on online tracking of children and teenagers.

Just last week, the FTC put a spotlight on gaps in kids' online privacy with a report that found hundreds of popular kids' apps were collecting data without parental consent.

Coppa governs how companies must proceed when collecting personal data from children under the age of 13. Enforcement falls to the FTC, which has been reviewing how it should approach the law in the age of smartphones and social media for two years. Kids' entertainment and Internet companies have lobbied heavily to blunt the impact of the update.

Apple, for example, met with FTC officials five times this fall, in particular contesting the possibility that the updated rules might hold it responsible for the data-collection practices of the third-party apps it distributes on the iPhone and iPad. Google made a similar point in a filing with the commission.

Google said it was evaluating the changes and would continue to work on effective ways to protect children's privacy and security. Facebook said it was pleased with the FTC's decision on so-called plug-ins, such as the "Like" button.

In several cases, the industry got what it wanted. Reversing a prior proposal, the commission agreed to continue to allow parental consent to be obtained by email as long as apps and websites only collect data for internal use.

The FTC's Chairman said the final rules strike the right balance between protecting innovation that will provide rich and engaging content for children, and ensuring that parents are informed and involved in their children's online activities.

While Apple, Google and Facebook scored partial victories, some smaller developers were disappointed. The president of the Application Developers Alliance, said that the new regulations could prove so burdensome that talented and responsible developers will abandon the children's app marketplace.

One FTC commissioner voted against the updated rules. She argued the commission went too far with the update by holding websites responsible when third parties like advertising networks gather personal data from children.

But some government officials made clear Wednesday they would like to place additional regulations on technology companies. Sen. John D. Rockefeller IV (D., W.Va.), a leading advocate on privacy issues, said he viewed the Coppa regulations as a step toward legislation that gives Americans more control of how they are tracked online.

The executive director of the Center for Digital Democracy and a consumer advocate who has been involved in the Coppa debate for years, said the FTC's decision was a step in the right direction but left loopholes for companies to mine kids' data inappropriately.

He said he would continue to push for more scrutiny of the role of the Internet giants that distribute kids' apps.

The FTC's chairman has made monitoring online privacy one of his priorities at the commission. At Wednesday's news conference announcing the revised rules, he repeatedly held up what he said was his 15-year-old daughter's white iPhone to illustrate how much technology has changed in the past decade.

It was enormously difficult for me to pry this away from my child today, he said.