FPF Files COPPA Comments with the Federal Trade Commission
Today, the Future of Privacy Forum (FPF) filed comments with the Federal Trade Commission (Commission) in response to its request for comment on the Children’s Online Privacy Protection Act (COPPA) proposed rule.
As technology evolves, so must the regulations designed to protect children online, and FPF commends the Commission’s efforts to strengthen COPPA. In our comments, we outlined a number of recommendations and considerations that seek to further refine and update the proposed rule, from how it would interact with multiple provisions of a key student privacy law to the potential implications of a proposed secondary verifiable parental consent requirement.
To amplify the questions about how COPPA would interact with the Family Educational Rights and Privacy Act (FERPA), FPF was also one of 12 signatories to a multistakeholder letter addressed to the Commission and Department of Education urging the development of joint guidance.
Considerations Applicable to All Operators
Children today are increasingly reliant on online services to connect with peers, seek out entertainment, or engage in educational activities, and while there is a great benefit to this, there are also risks to privacy and personal data protection, and we applaud the Commission for its ongoing efforts to find a balance between these tradeoffs. Our comments and recommendations focused on areas where we believe there is further opportunity to strike that balance, including:
- Clarifying the separate verifiable parental consent (VPC) step for third-party disclosures, as COPPA already includes a prohibition on conditioning a child’s participation in an online activity, and operators face considerable challenges in implementing the current VPC requirement. Our comments were informed in part by our in-depth report and infographic on the effectiveness of COPPA’s verifiable parental consent (VPC) requirement, published in June 2023.
- Revising definitions in line with how technology has evolved since the last COPPA Rule update, including adding “mobile telephone number” to the definition of online contact information, and clarifying what role text messages can play in the consent process.
- Providing more specificity of what types of processes that encourage or prompt the use of a website are of greatest concern to the FTC, as language in the proposed rule may inadvertently limit positive use cases of prompts and notifications such as homework reminders, meditation apps, and notifications about language lessons.
- Aligning the proposed security program language with the stated goal in the Notice of Proposed Rulemaking (NPRM), which reads that operators need “a written comprehensive security program” (emphasis added) and not a “child-specific” program, which would place an additional burden on companies with no additional benefit to parents or children.
Unique Considerations for Schools and Educational Technology
FPF commends the Commission’s effort to provide better clarity regarding how the rule should be applied in a school context; however, there are several areas where the proposed rule does not fully align with the Family Educational Rights and Privacy Act (FERPA), the primary federal law that governs use and disclosure of educational information. Both laws are complex, and the potential impact of confusion and misalignment is significant for the more than 13,000 school districts across the country and for the edtech vendor community.
With that in mind, our comments related to the proposed rule’s implications for student privacy focused in large part on identifying areas where more alignment and clarity around the interaction between COPPA and FERPA would be particularly instructive for both schools and edtech companies. Our recommendations include:
- Working with the US Department of Education to create and maintain joint guidance, which would detail how operators and schools should interpret their obligations in light of the interaction between COPPA and FERPA. We also recommend that this guidance consider the perspective and expertise of Operators and School stakeholders.
- Aligning the school-authorized education purpose exception to prior parental consent to the requirements of FERPA. We highlight several key areas where the rule needs clearer alignment, including how the definition of school-authorized education purpose aligns with FERPA’s School Official exception, how the use of the term written agreement in the proposed rule differs from how the term is used in FERPA, and how both laws address redisclosures of student data.
To read FPF’s COPPA comments in full, click here.
To download the joint letter to the FTC and U.S. Department of Education signed by FPF and 11 others, click here.
