After a very long process, the Federal Trade Commission (FTC or Commission) announced the finalized updates to the Children’s Online Privacy Protection Act (COPPA) Rule. COPPA was last updated nearly 12 years ago, and much has changed since then. After all, the top song on the radio 12 years ago was the instant classic “Call Me Maybe” by Carly Rae Jepsen, so this rule was due for an update. This blog will take a deep dive into the effects this update will have on targeted advertising and how marketing plans may affect your COPPA compliance. Notably, the vote for the rule changes was unanimous, with Chair Andrew Ferguson issuing a concurring statement.
In the 2024 Notice of Proposed Rulemaking (NPRM), the Commission proposed adding a separate consent requirement for operators that share children’s personal information with third parties. In announcing this change, the NPRM explained that this would “enhance” the ability of parents to make informed decisions about whether to consent to the collection of their child’s personal information. Public comment on this provision was split, with some advocacy groups applauding the transparency and others expressing concerns over “consent fatigue” and creating unnecessary friction online. The Commission included this provision in this update.
The Final Rule states that an operator “must give the parent the option to consent to the collection and use of the child’s personal information without consenting to disclosure of his or her personal information to third parties, unless such disclosure is integral to the website or online service.” In practice this means that in addition to the verifiable parental consent to collection and use, a separate consent must be captured by parents for disclosure of a child’s personal information to third parties. In her statement regarding the Final Rule, then-Chair Lina Khan explained that this means covered entities are prohibited from selling children’s data or disclosing it for targeted advertising unless a parent separately agrees or opts in to these uses. Additionally, website operators may not condition a parent’s consent to collection and use contingent on consent to disclosure. In effect this means an operator may not cut off a child’s access to the website if a parent refuses to consent to disclosure, and behavioral advertising for COPPA-covered sites must be off by default for users under 13. Operators should carefully consider whether they can leverage cookie manager services to comply with verifiable parental consent obligations in relation to targeted advertising and other third-party cookies, pixels, APIs and SDKs.
The COPPA update will also have lasting effects on how marketing plans are created moving forward. COPPA applies to websites that are considered “child-directed” or mixed-audience, but what determines if a website is child-directed? The rule previously explained that the Commission will use a series of factors to determine if a website is child-directed, including things such as subject matter, visual content and use of animated characters. The Commission has previously said that they will consider other “reliable empirical evidence” about the age of the actual or intended audience. As part of this update, the Commission added explicit examples of the types of evidence that may be used to determine if an online service is child-directed, specifically adding “marketing or promotional materials or plans, representations to consumers or to third parties, reviews by users or third parties, and the age of users on similar websites or services” to the definition. So, a marketing plan or promotional strategy that includes references to children or an acknowledgment that children may engage with the online service (including through marketing surveys) would be considered empirical evidence that the online service is child-directed. While reviewing your marketing plans, always keep in mind who the intended audience is and double-check as to whether that audience may include children under the age of 13; if so, you will need to comply with COPPA. Also consider how these marketing plans comport with state privacy law requirements related to processing children’s personal information, which may have nexus with COPPA.
The amended rule is scheduled to become effective 60 days after it is published in the Federal Register, but given changes in the administration, it may be some time before the rule is published.
It is exciting to see COPPA finally grow up after all these years, and this new update brings large changes to the compliance posture for online services. While we gear up for these changes, we will be listening to Jepsen’s classic hit – which, unlike COPPA, needs no updates.
[View source.]
