from and about children online. While the FTC’s original rule prohibited operators
of websites or online services directed at children from collecting personal information from a child, as technology has evolved to expand the ways in which advertisers
can potentially target children, the FTC has updated and expanded the focus of the
COPPA regulations. Specifically, in 2013, the FTC amended the COPPA rule to
expand the definition of “personal information” to include persistent identifiers that
recognize users over time and across different online services, all behavioral advertising on online services directed at children now require parental notice and consent.
Specifically, COPPA requires that children’s websites post privacy policies that
describe “what information is collected from children by the operator, how the
operator uses such information, and the operator’s disclosure practices for such
information”. It applies to operators of online websites or services directed to
children, including makers of mobile apps, and “any operator that has actual
knowledge that it is collecting personal information from a child”. The legislation
also requires internet website operators to obtain a more reliable method of consent if
an operator seeks to disclose a child’s personal information to third parties or to
make it publicly available.
Under the amended rules promulgated by the FTC, which went into effect in
2013, “communications data” includes the following types of information:
A. A child’s first and last name;
B. A home or other physical address including street name and name of a city or
town;
C. Online contact information;
D. A screen or user name that functions as online contact information;
E. A telephone number;
F. A social security number;
G. A persistent identifier that can be used to recognize a user over time and across
different websites or online services;
H. A photograph, video, or audio file, where such file contains a child’s image or
voice;
I. Geolocation information sufficient to identify street name and name of a city or
town; or information concerning the child or the parents of that child that the
operator collects online from the child and combines with an identifier described
above.
Since the FTC promulgated the 2013 policy changes, the agency has issued
additional guidance stating that internet connected toys and other devices intended
for children fall under the provisions of the Act. With respect to COPPA’s data
protection and retention policies, the new changes require that covered website
operators adopt reasonable procedures for data retention and deletion. The legislation also requires that parents have the ability to review personal information
collected about their children and request that it be deleted. COPPA requires that
site operators protection the confidentiality and security of any information that is
collected from children online. Although the FTC has suggested that site operators
require the use of passwords to access personal information on the website, install of
Data Protection in the United States: U.S. National Report
421
of websites or online services directed at children from collecting personal information from a child, as technology has evolved to expand the ways in which advertisers
can potentially target children, the FTC has updated and expanded the focus of the
COPPA regulations. Specifically, in 2013, the FTC amended the COPPA rule to
expand the definition of “personal information” to include persistent identifiers that
recognize users over time and across different online services, all behavioral advertising on online services directed at children now require parental notice and consent.
Specifically, COPPA requires that children’s websites post privacy policies that
describe “what information is collected from children by the operator, how the
operator uses such information, and the operator’s disclosure practices for such
information”. It applies to operators of online websites or services directed to
children, including makers of mobile apps, and “any operator that has actual
knowledge that it is collecting personal information from a child”. The legislation
also requires internet website operators to obtain a more reliable method of consent if
an operator seeks to disclose a child’s personal information to third parties or to
make it publicly available.
Under the amended rules promulgated by the FTC, which went into effect in
2013, “communications data” includes the following types of information:
A. A child’s first and last name;
B. A home or other physical address including street name and name of a city or
town;
C. Online contact information;
D. A screen or user name that functions as online contact information;
E. A telephone number;
F. A social security number;
G. A persistent identifier that can be used to recognize a user over time and across
different websites or online services;
H. A photograph, video, or audio file, where such file contains a child’s image or
voice;
I. Geolocation information sufficient to identify street name and name of a city or
town; or information concerning the child or the parents of that child that the
operator collects online from the child and combines with an identifier described
above.
Since the FTC promulgated the 2013 policy changes, the agency has issued
additional guidance stating that internet connected toys and other devices intended
for children fall under the provisions of the Act. With respect to COPPA’s data
protection and retention policies, the new changes require that covered website
operators adopt reasonable procedures for data retention and deletion. The legislation also requires that parents have the ability to review personal information
collected about their children and request that it be deleted. COPPA requires that
site operators protection the confidentiality and security of any information that is
collected from children online. Although the FTC has suggested that site operators
require the use of passwords to access personal information on the website, install of
Data Protection in the United States: U.S. National Report
421