FTC Restricts Behavioral Targeting of Kids

New rules go into effect next July

Flanked by the leading privacy hawks in Congress, Federal Trade Commission chairman Jon Leibowitz Wednesday unveiled tighter rules to strengthen kids online and mobile privacy.

The new rules amend the Children’s Online Privacy Protection Act (Coppa), a 14-year-old law that requires child-directed websites to obtain parental permission before collecting personal information from kids under 13 or tracking their behavior online.

With only a few exceptions, the new rules announced Wednesday follow the changes the FTC proposed earlier this year. New provisions expand the definition of what is considered personal information in order to trigger parental consent, including location information, videos and photographs and persistent device IDs. Ad networks, social plug-ins and other third parties associated with kids apps and websites are also brought into the equation; these companies may not knowingly collect children's information or track their behavior. App stores like Google Play or the Apple iTunes store, are exempt from the rule.

The new Coppa rules go into effect July 1, 2013.

“Today we bring critical change to the rule by broadening and clarifying the rule,” said Leibowtiz, as Sens. Jay Rockefeller (D-W.Va.) and Mark Pryor (D-Ark.) and Reps. Ed Markey (D-Mass.) and Joe Barton (R-Texas) looked on like proud parents.

The FTC vote was 3-1-1. Commissioner Thom Rosch (R) abstained. Commissioner Maureen Ohlhausen (R) voted no, releasing a statement that she felt the new rules exceeded the scope of the authority granted the FTC by Congress in the original Coppa bill.

Since Coppa was passed, technology has dramatically altered how children interact with smartphones, tablets, websites and other mobile devices, prompting the FTC to initiate a comprehensive review of the law two years ago. Privacy advocates and the lawmakers in the room have been pounding away for updates that would close loopholes created with the rise of social media.

Rockefeller, who has never been a fan of online ad networks, heralded the new Coppa rules for closing the loophole with ad nets and other third parties associated with kids websites and apps. “The old rule never fully appreciated the third-party companies and neither do I. They make their living grinding out through technological tricks, private information about kids and use it commercially to the disadvantage of the nation,” Rockefeller said. “The new Coppa rule captures the new online reality. It puts all online companies on notice."

The ad community lobbied hard to make sure updates to Coppa didn't go too far and chill advertising and innovation in children’s websites and apps. Leibowitz addressed advertisers directly, reassuring the industry that the rules would not kill advertising.

“Let’s be clear about one thing: under this rule, advertisers and even ad networks can continue to advertise, even on sites directed to children,” Leibowitz said. “Business models that depend on advertising will continue to thrive. The only limit we place is on behavioral advertising, and in this regard our rule is simple: until and unless you get parental consent, you may not track children to build massive profiles for behavioral advertising purposes. Period.”

At first blush, advertisers said the new rules addressed a number of their concerns. “Some certainty is good for everybody,” said Lee Peeler, CEO of the Advertising Self-Regulatory Council. “We’ll be working with the industry to make sure they comply.”

"The FTC rejected radical proposals supported by advocacy groups that tried to use the Coppa rule revisions as a way to restrict advertising to children, something Coppa was never intended to do," said Alan Friel, a partner with Edwards Wilman Palmer and chairman of the firm's media and technology practice group. Friel said the FTC adopted many suggestions from the industry "that actually make it easier in many cases for parties to provide entertainment and educational content to kids."

But app developers, many of them small companies with limited resources, were worried about the added cost they could incur to implement the rules, resulting in driving many entrepreneurs out of the marketplace.

Based on the FTC's estimate that the average app or website would need to spend $9,000 to comply with the rules, the Association for Competitive Technology estimated that the extra expense to educational apps alone could add up to $272 million.

"While we appreciate the efforts of chairman Leibowitz, we are particularly concerned with his expectatiion that the industry will simply find a solution to the new rules. It is akin to jumping off a cliff with the plan to build the parachute on the way down. While that may work for big companies, small companies lack the silk and line to build that parahute before they hit the ground," Morgan Reed, executive director of ACT, said in a statement.

There is no doubt that the FTC has been laying the groundwork for stepping up its privacy enforcement next year. Last week the agency issued a study that showed most mobile kids apps have no privacy policy, and this week opened up a broad investigation into the privacy practices of data brokers.

“It’s a multipronged approach but all through the vision of the commission being vigorous in privacy protection,” Leibowitz said.

That has some worried that the new Coppa rules, by expanding personal information to include device IDs like IP addresses, could be a template to expand privacy regulations to crack down on behaviorally targeted advertising.

“This shows a concerted effort to set ground for a greater battle against interest-based advertising,” said Carl Szabo, policy council for NetChoice.