Why Haven’t the FTC’s New COPPA Rules Made Your Kids Safer Online?

On July 1, new rules from the Federal Trade Commission (FTC) for implementing the Children’s Online Privacy Protection Act (COPPA) went into effect. COPPA requires certain online services to display privacy policies and obtain verifiable consent from a parent or guardian before collecting personal information from children. Under the new rules, the FTC has expanded the number and type of companies that must comply with COPPA, as well as the definition of personal information. While the old rules were already having a negative impact on innovation among online services directed at children, the new rules will further limit innovation and the availability of high quality online content for children, in particular, by restricting online behavioral advertising on many websites.

There are legitimate reasons for COPPA even if its implementation has been poor. First, one of the main concerns about children’s privacy in 1998 (when Congress passed COPPA) was the ease with which anyone with $50 could purchase the names and addresses of children in their neighborhood. Clearly selling this type of data without any regulations in place was a bad idea, and Congress rightly stepped in to prohibit this practice.

Second, COPPA tries to address the issue of consent among minors. Children are too young to be able to consent themselves to the information practices of different websites so parents must provide this consent when it is needed. Under COPPA, the FTC must decide which practices are acceptable without parental permission and which practices are not. The FTC has a wide range of options from allowing virtually any practice to allowing none.

Unfortunately the FTC has skewed much closer to “allowing none” than a reasonable middle ground. COPPA rules should not be written with the goal of making the Internet safe for the children of parents with the most radical privacy preferences, but rather they should be written so as to find a balance between privacy safeguards and other benefits that come from the frictionless exchange of information. Keep in mind that even with a lower “default” privacy setting for children, parents can still choose whether or not to allow their children to use the Internet or particular websites and under what conditions. Regardless of the rules that are put in place, COPPA regulations in no way diminish the need and responsibility for parents to supervise their children’s online activity and teach them about Internet safety.

Unfortunately, the new COPPA rules are an example of regulators putting privacy ahead of innovation. What’s worse, in this case, is it’s hard to see how children come out ahead by almost any metric. Consider common parental concerns:

• Alarmed by the possibility that children might see graphic violence, sex, or profanity on the Internet? COPPA does not address any of those issues (and it probably shouldn’t given the First Amendment).
• Concerned that children are exposed to too much online advertising? COPPA does not prevent sites from displaying ads to children and under the new rules children may actually see more ads (for reasons discussed below).
• Disturbed by the idea of advertisers targeting children based on their interests? You shouldn’t be, but regardless COPPA does not prevent websites from displaying contextual advertising.
• Troubled by the idea of children having their Internet activity tracked and used to deliver them targeted advertising? Again, you shouldn’t be, but COPPA does not prevent children from receiving these types of ads on the Internet; it only prevents websites directed primarily at children from showing these ads.

No matter where you stand on privacy issues, it’s hard to see exactly how children have been made better off under the new rules. And if you are worried that there is not enough free, high-quality educational and entertainment content available for children…well your fears are justified.

The new rules will create at least two negative impacts. First, websites directed at children or knowingly providing access to children will have a diminished ability to earn revenue. Second, the most useful aspects of the Internet—the ability to easily share information with others—will be severely limited, if not eliminated for children’s online services.

The first impact of the new rules will be that online services directed at children (or those who knowingly have users under the age of 13)—including mobile apps and websites—will no longer be able to deliver targeted ads to children without parental consent. Targeted ads generally produce more revenue than other ads because they are more relevant to users.  This change will have a negative impact on revenue for makers of child-directed online content and services, particularly those who do not otherwise need to collect information about their users, such as educational sites. To make up for this, developers might increase the number of ads they show to children or simply move away from advertising-based models to fee-based models. Parents who can afford to pay for online services might not mind this change, but parents who cannot will be out of luck. Or developers may decide to put an age-gate on their products and services or discontinue them to avoid the risk of running afoul of the COPPA rules. The overall impact of these changes will be the further erosion in the quality of free apps and websites available to children. 

The second impact will be a diminished utility among online services available to children. If the current trend continues, increasingly children will only have access to limited functionality on apps and websites. Perhaps the best example of this phenomenon is the popular app SnapChat which allows users to share photos with others. In contrast, the “child-friendly” version of this app does not allow any sharing—and that is the entire purpose of the app!

The original goal of COPPA was to enhance online safety and privacy for children while preserving their access to content and the rich interactivity of the Internet. Not only do the FTC’s new COPPA rules appear to have little to no value for consistently improving children’s privacy and safety online, they also clearly do not take the latter goal of preserving innovation on the Internet to heart. Sadly regulators have taken a very narrow view of what it means to be helping children.