The State of Play – Issue Brief: COPPA 101
The Children’s Online Privacy Protection Act (COPPA), enacted by Congress in 1998, aims to give parents more control over the information collected about their children online. The law requires operators of games, websites, apps, and other online services catered to users under the age of 13 to obtain permission from a child’s parent before collecting information about them. Protected data includes a child’s personal details, such as name, home address, email address, and phone number; geo-location information; online activity tracking data; and photo, video, and audio files.
Critics argue that COPPA – which predates the invention of social media networks, video sharing websites, and smart phones – has become “hopelessly outdated,” is “toothless,” and “long overdue for improvements.” The most common sources of this criticism are COPPA’s “actual knowledge” requirement and its use of age 13 as the effective “age of adulthood” online. This is not a universal determination; both California and the European Union have recently implemented data protection laws that raise the age of consent for children to 16.
Because of this age determination, most social media companies require users to be 13 to create an account, yet about half of parents of children ages 10-12 and one-third of parents ages 7-9 report their child used social media in the first half of 2021. Social media companies claim it is difficult to know the age of their users; other advocates argue “they have the data.” Regardless, it has “led to millions of kids lying about their age online” and significant fines for YouTube and Musical.ly, the app that became TikTok.
While COPPA may be “long overdue for improvements,” it is the law currently in effect, and operators rely on a mechanism known as Verifiable Parental Consent, or VPC, to remain in compliance. The FTC has approved seven different methods for obtaining consent, including the use of a video conference, signed form, credit/debit card, and photo comparison; while operators are not required to use one of the approved methods, most do out of an abundance of caution to avoid a potential FTC fine and/or lawsuit. However, VPC presents a number of challenges that we will dive deeper into in upcoming issue briefs. Check out this infographic to learn more about VPC and some common friction points.
Interest in children’s online privacy and safety is high and likely to continue to grow in the coming months. Congressional activity is picking up, and the FTC’s latest review of the COPPA rule is ongoing, with a draft rule expected at some point in 2022. Policymakers must understand the current state of play for kids online as they continue to have these important discussions, and we welcome the opportunity to discuss these issues further. Please feel free to contact us here at any time.