In an effort to strengthen protections relating to the online collection, use, and disclosure of personal information of children and minors, U.S. Senators Edward J. Markey of Massachusetts and Bill Cassidy of Louisiana introduced the Children and Teens' Online Privacy Protection Act (the Act) on May 11, 2021. If signed into law, the bill would amend the Children's Online Privacy Protection Act of 1998 (COPPA) by expanding protections to minors ages 13 to 15. The Act would revise COPPA's "actual knowledge" standard to a "constructive knowledge" standard, requiring operators to obtain consent when they reasonably should know that children and minors are using their services.
To whom would it apply?
- Currently, COPPA protects children under the age of 13. The Act would expand protections to cover minors over 12 and under 16.
- The Act would apply to:
- Operators of commercial websites and online services (including mobile and online applications) directed children and minors that collect, use, or disclose their personal information
- Operators of general audience websites or online services with constructive knowledge that they are collecting, using, or disclosing personal information from children and minors
- Websites or online services that have constructive knowledge that they are collecting personal information directly from users of another website or online service directed to children and minors
- Constructive knowledge would be imputed to Operators that:
- Directly or indirectly collect, use, profile, buy, sell, classify, or analyze data about:
- A user or groups of users to estimate, identify, or classify the age, age range, or proxy thereof
- The nature of the content of the website, online service, online application, or mobile application that estimates, identifies, or classifies the content as directed to users of a particular age range or similarly estimates, identifies, or classifies the intended or likely audience for the content
- Have or receive data or reporting related to the age of users on the website, online service, online application, or mobile application
- Have or receive complaints from parents or other third parties about the age of users using its service, whether through the operators' complaint mechanism, by email, or other means conveniently accessible by the user
- Have or receive data or reporting or information from the operator's internal communications that indicates that data is being collected from users of a particular age range that are using the product or service
- Have publicly available data or reporting regarding the operator's product or service indicating that users of a particular age range are using the product or service
- Communicate to an ad-network that the content is intended for users of a particular age range or likely to appeal to users of a particular age range, whether directly or indirectly
- The Act does not apply to:
- Nonprofit entities that otherwise would be exempt from coverage under Section 5 of the Federal Trade Commission Act
What types of information would it cover?
Under the Act, the term "personal information" would be expanded to include:
- Geolocation information
- Information used for biometric identification
- Information reasonably associated with or attributed to an individual
- Information (including an internet protocol address) that permits the identification of an individual; or any device used by an individual to directly or indirectly access the internet or an online service, online application, or mobile application
- Information concerning a child or minor or the parents of that child or minor (including any unique or substantially unique identifier, such as a customer number) that an operator collects online from the child or minor and combines with an identifier described in this paragraph.
What rights would it create?
The Act would create various consumer rights aimed at protecting children and minors, including:
- Implementation of a "Digital Marketing Bill of Rights for Minors" limiting the collection of personal information from teens
- Building on COPPA's consent requirements by prohibiting internet companies from collecting personal information from minor users who are 13 to 15 years old without the user's consent
- Placing a ban on targeted advertising (as opposed to contextual advertising) directed at children under the age of 13
- The right know what personal information is being collected about the consumer
- The right to request to delete personal information
What obligations would it impose?
- The Act would require:
- Operators with constructive knowledge that children and minors are on their websites to obtain consent from the parents of children or minors themselves before collecting their data
- Operators may, but are not required to, adopt and comply with a Digital Marketing Bill of Rights for Minors consistent with the Fair Information Practices Principles identified under the Act.
- Operators to explain the types of personal information collected, how that information is used and disclosed, and their policies for the collection of personal information
- Operators to create an online "Eraser Button" which permits users to eliminate personal information of a child or teen on Internet-connected devices targeted toward children to meet robust cybersecurity standards
- Manufacturers of connected devices targeted to children and minors to prominently display on their packaging a privacy dashboard detailing how information is collected, transmitted, retained, used, and protected
How would it be enforced?
The FTC and state Attorneys General would enforce the Act. Violation of the Act would be treated as a violation of rules defining an unfair or deceptive act or practice under the Federal Trade Commission Act. A violation may result in civil penalties including damages, restitution, or other relief as a court may consider appropriate.
Further, the Act would establish a first-of-its-kind Youth Privacy and Marketing Division at the FTC, which will be responsible for addressing the privacy of children and minors and marketing directed at children and minors.
When would it go into effect?
If passed, provisions of the Act provide for different effective dates:
- Enforcement provisions would take effect 90 days after the Act is enacted
- The Removal of Content requirement would take effect 180 days after the Act is enacted
- The Digital Marketing Bill of Rights for Minors, Targeted Marking to Children or Minors, and Privacy Dashboard would take effect 180 days after promulgation of regulations
Where does it stand?
This bill is in the first stage of the legislative process.
