Technology TBJ January 2022

Sweeping Changes Proposed FOR COPPA

A LOOK AT UPDATES TO FEDERAL CHILD PRIVACY LAW

Written by Peggy Keene

U.S. Rep. Kathy Castor, of Florida, has proposed widespread changes to the Children’s Online Privacy Protection Act, or COPPA, by introducing updates to the “Protecting the Information of our Vulnerable Children and Youth Act,” or Kids PRIVCY Act.

COPPA Requirements
COPPA is the United States’ most visible privacy law when it comes to federal privacy protection of children. Passed in the 1990s, COPPA applies to websites that market or target their services to children under 13. If the website operator is based in the United States, COPPA requires: (1) a clear and technologycomprehensive online privacy policy; (2) direct notice to parents to obtain verifiable consent; (3) parents be given the choice of consenting to the collection of the child’s information; (4) parents be given access to their child’s personal information to review and/or have deleted; (5) parents be given the opportunity to prevent further use or collection of information; (6) maintenance of the confidentiality, security, and integrity of collected information; (7) the retention of personal information only as long as necessary; and (8) children not be required to give information as a condition of participation in the website’s online activity.

As a result of COPPA, most websites simply prohibit children under 13 from using their services altogether. Castor’s proposed changes to the PRIVCY Act would expand the reach of COPPA in many ways.

Proposed Updates to COPPA and Expansion to PRIVCY Act
Perhaps most significantly, the definition of “personal information” would newly include biometric, health, and education information. The definition would also be expanded to include physical characteristics, contents of messages and calls, and browser search history. It would also be expanded to include a new class to cover teenagers. While teenagers’ personal information would be newly subject to the scope of the law, teenagers would still have control over whether they could provide consent to have their information collected, used, or shared online.

The PRIVCY Act would also expand the reach of COPPA to go beyond sites that are directed or have “actual knowledge” that they collect personal information from children. Instead, it would be expanded to cover sites and services that are “likely to be accessed by children or teenagers,” which means “the possibility of more than a de minimis number of children or teenagers accessing the digital service is more probable than not.” It also prohibits online sites and services from targeting advertising based on information collected on them. While these are not all the proposed changes to COPPA and the PRIVCY Act, it covers some of the most visible changes. ^TBJ

This article, which was originally published on the Klemchuk Ideate Blog, has been edited and reprinted with permission.

PEGGY KEENE is of counsel to Klemchuk. Her practice focuses on intellectual property and internet law, e-commerce, and data privacy. Keene has also served as in-house counsel in the telecommunications industry.