Senate lawmakers on Tuesday introduced new bipartisan legislation that gives kids under 16 years old and their parents substantially more control over their data while further limiting the data-collection practices of apps, websites, and online services.
Substantive changes to the Children’s Online Privacy Protection Act (COPPA), introduced by Senators Ed Markey, Democrat of Massachusetts, and Josh Hawley, Republican of Missouri, would expand existing online protections that currently apply only to “children” (under 13) to “minors,” or those ages 13 to 15. These include provisions intended to prohibit, for example, apps and services from making the personal information of children publicly accessible online.
Whereas COPPA currently requires “verifiable parental consent” in cases involving the collection, use, or disclosure of personal information, changes to the law would also require minors to receive special notice and give their personal consent before their information may be used for any purpose.
But perhaps one of the biggest changes to the law is that it would effectively ban, in any case involving a child, the collection or disclosure of personal information for purposes of targeting marketing.
“In 2019, children and adolescents’ every move is monitored online, and even the youngest are bombarded with advertising when they go online to do their homework, talk to friends, and play games,” Senator Markey said in a statement. “In the 21st century, we need to pass bipartisan and bicameral COPPA 2.0 legislation that puts children’s well-being at the top of Congress’s priority list.”
“If we can agree on anything,” he added, “it should be that children deserve strong and effective protections online.”
Another change to COPPA would institute a policy of ignorantia non excusat (“ignorance does not excuse”). The aim of this is to prevent internet companies from skirting the law by intentionally turning a blind eye to a user’s age. Whereas COPPA currently states that under varying circumstances, it is unlawful for companies with “actual knowledge” that a user is under 13 to collect their personal information, the update would enhance protections by altering certain passages to read “constructive knowledge” instead.
Constructive knowledge means that whether a company actually knows that a user is a child or not, they cannot escape liability for violating COPPA if it’s determined they should have known through exercise of what the law calls “reasonable care”—the degree of “caution and attention” an “ordinarily prudent and rational person” would use in similar circumstances (to paraphrase Nolo).
The act to amend COPPA also includes what lawmakers are calling an “eraser button,” or provisions designed to give parents the ability to order that personal information belonging to kids under 16 be deleted upon request. Within a year of the act becoming law, the Federal Trade Commission (FTC) would be required to put into effect new regulations that enable parents to not only delete said personal information, but also receive descriptions of the data collected and, when “reasonable,” review the actual data itself.
“Big tech companies know too much about our kids, and even as parents, we know too little about what they are doing with our kids’ personal data. It’s time to hold them accountable,” Senator Hawley said. “Congress needs to get serious about keeping our children’s information safe, and it begins with safeguarding their digital footprint online.”
The updated law would also include a “Digital Marketing Bill of Rights for Minors,” which effectively outlaws the compiling of personal information of a child for “targeted marketing” purposes altogether, or the sharing of that information with a third-party for the same purpose. In the case of kids between 13 and 15, “verifiable consent” is required before any personal information can be used for targeted marketing purposes.
The FTC has currently outlined a number of methods by which parents can provide verifiable consent. This includes signing a consent form; using a bank card or other online payment system that provides notification of each separate transaction directly to the account holder; providing a copy of a government ID; or using a toll-free number staffed by trained personnel.
“The Markey-Hawley bill rightly recognises that the internet’s prevailing business model is harmful to young people,” said Josh Golin, executive director of the Campaign for Commercial-Free Children. “The bill’s strict limits on how kids’ data and can be collected, stored, and used — and its all-out ban on targeted ads for children under 13 — would give kids a chance to develop a healthy relationship with media without being ensnared by Big Tech’s surveillance and marketing apparatuses.”
Brandi Collins-Dexter, senior campaign director at Colour of Change, called the bill “a big step forward” in curbing “unethical practices of tech giants.”
“We’re pleased to see these changes include prohibiting ad targeting based on race and socioeconomic factors (or its proxies), psychological profile and geo-location on children up to the age of 15,” she added. “Such anti-discrimination measures are an important intervention for children from vulnerable communities, who—from the age of four—are at greater risk for discriminatory advertising, employment, and marketing practices that have expanded into the digital space.”
You can read a full copy of the bill to amend the Children’s Online Privacy Protection Act of 1998 here.