ADventures in Law

Home | ADventures in Law

It feels like it has been ages since we had one of those exciting public Federal Trade Commission (FTC or Commission) meetings. You may remember them – when the few remaining commissioners talked about issues and matters of varying degrees of importance. Well, the latest meeting oddly did not discuss something particularly new but instead featured presentations that focused on the Commission’s recently announced <a href="https://www.ftc.gov/news-events/news/press-releases/2023/12/ftc-proposes-strengthening-childrens-privacy-rule-further-limit-companies-ability-monetize-childrens">proposed changes</a> to the Children’s Online Privacy Protection Act (COPPA) Rule as well as the recently announced and finalized <a href="https://www.ftc.gov/news-events/news/press-releases/2023/12/ftc-announces-cars-rule-fight-scams-vehicle-shopping">Combating Auto Retail Scams (CARS) Rule</a>. Having read about both those announcements a few weeks ago, we were hoping the meeting would shed some new insights on these rules. Results were mixed on that note, but FTC staff provided really good overviews of the issues.

core/paragraph

First up, COPPA. For the FTC, “Child’s Play” isn’t just a movie – it’s serious business. In the era of tablet kids, COPPA has stood as a legislative guardian since its inception in 1998. The FTC made significant updates to COPPA in 2013 and voted to change those protections in December 2023. An FTC staffer provided a helpful and detailed discussion of the changes that the FTC has proposed in the COPPA Rule. There is a lot to the proposed updates, including:

Requiring a separate opt-in for targeted advertising. At the heart of the latest reform effort is a two-pronged approach to tighten third-party sharing requirements. The FTC’s proposed amendments aim to fortify children’s privacy by requiring a second, verifiable consent for behavioral advertising and disclosures to third parties. Under the proposed language, operators may not condition access to a website on such consent; therefore, if a parent declines to accept behavioral advertising, the company must still provide the child with the service.

core/list-item

Strengthening the data security and data retention requirements. Additionally, the proposed language would require advertisers to provide specific categories or identities of the third parties to which the personal information will be disclosed, including (1) whether the information will be made publicly available, (2) the purposes of such disclosure, and (3) whether the parents can consent to the collection and use of the child’s personal information without consenting to the disclosure of such information, except to the extent that disclosure is integral to the nature of the website or online service. The Commission also proposes limitations on data retention; specifically, that personal information collected from children can only be kept as long as it serves its primary purpose and must be accompanied by a publicly available data retention policy. This policy would outline the specifics of data collection and the business necessity for its retention and establish a concrete timeline for data deletion to avoid indefinite storage.

Imposing limits on “nudging” children without parental consent. Addressing the subtleties of online engagement, the FTC is setting its sights on “nudges” – design elements that encourage prolonged interaction with a service. The Commission is clear: Consent cannot be engineered or exploited to keep children online, and any such tactics must be explicitly declared in the operator’s online notices. The FTC is primarily getting at this by limiting the ability to use persistent identifiers for such purposes.

Increasing accountability for operators using the support for internal operations (SFIO) exception. The FTC is calling for increased responsibility for operators using the SFIO exception. This includes collecting identifiers without parental consent only when it does not infringe on the privacy of other personal information. The proposed language would require clear online notices explaining the use of such identifiers, ensuring they are not a back door to behavioral advertising or profile building. The protective umbrella expands to the educational sphere as well, with the Commission seeking to restrict the surveillance capabilities in schools unless they are for authorized educational purposes and backed by direct notices and written agreements with educational institutions.

core/list

The FTC also remarked on additional changes, such as heightened transparency for the safe harbor program, with biannual disclosures of membership lists and reports every six months on the program’s technological robustness and the evaluation of operators’ fitness. Moreover, the proposed updates require operators to establish and enforce robust security programs tailored to the sensitivity of children’s data and reflecting the size and complexity of their operations.

As the digital terrain evolves, so does the dialogue around these pivotal changes. The comment period is currently open, inviting stakeholders to contribute their perspectives until March 11.

The commissioners had a lot to say about the proposal – because we all want to protect kids. Chair Lina Khan talked about sophisticated tactics that exist and the need to revise and strengthen the COPPA Rule and praised the move to substantiative protections that go beyond mere procedural requirements. Commissioner Rebecca Slaughter stated that as a parent she is passionate about how hard it is to manage kids’ online lives and wants to make sure that the burden is on companies that collect kids’ data rather than on parents. She emphasized the need to avoid overcollection. Commissioner Alvaro Bedoya touted the wave of recent privacy cases that the FTC has brought overall. He also stated that the focus on the perceived harm of behavioral advertising is consistent with the core concern from 1998 that collecting kids’ information allowed the creation of commercial relationships with kids and preyed on their trust and vulnerability without parental knowledge. Bedoya also drew attention to his detailed statement on the COPPA Rule, which can be found <a href="https://www.ftc.gov/system/files/ftc_gov/pdf/BedoyaStatementonCOPPARuleNPRMFINAL12.20.23.pdf">here</a>.

As for the CARS Rule, we should note that right after the meeting, the FTC announced that the rule is <a href="https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-pauses-cars-rule-effective-date">temporarily on hold pending legal challenges</a>. Given the changes in the status of the rule, we won’t give you a detailed overview, but suffice it to say that this rule – if it comes into effect – would provide a wide range of restrictions on and requirements for auto dealers throughout the country. In short, the rule would prohibit pricing and cost misrepresentations, address the issue of “worthless” add-ons and require clear consent for charges.

The meeting kicked off with public participation, and there was a lot of activity this week. We heard from Rep. <a href="https://en.wikipedia.org/wiki/Mary_Peltola">Mary Peltola</a>, who raised concerns about a pending grocery merger, and other consumers discussed similar concerns. The Consumer Federation of America praised the new CARS Rule, and a few other consumers discussed it as well. Other issues raised included health privacy, right-to-repair issues, the recently announced revised <a href="https://www.ftc.gov/news-events/news/press-releases/2023/12/federal-trade-commission-justice-department-release-2023-merger-guidelines">merger guidelines</a>, frauds focused on seniors and allegations that the FTC is putting European interests ahead of American interests. We also heard about other FTC rulemaking issues, with one person alleging that the FTC has been shortcutting the Mag Moss procedural requirements that Congress put in place. In particular, it was alleged that a <a href="https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-issues-notice-regarding-requests-click-cancel-informal-hearing">recent hearing on the proposed Negative Option Rule</a> was “perfunctory” and at odds with the Mag Moss requirements. Another caller raised concerns about the FTC’s <a href="https://apnews.com/article/openai-chatgpt-investigation-federal-ftc-76c6218c506996942282d7f5d608088e">OpenAI investigation that leaked</a> back in 2023. (Note for the record: This leak was a big deal and should not have happened.)

The Times They Are COPPA-Changing! FTC’s Latest Public Meeting Discusses Proposed Updates to Children’s Privacy Rules