Before the FEDERAL TRADE COMMISSION Washington, DC 20580 In the Matter of ) ) Request for Public Comment on the ) P104503 Federal Trade Commission’s ) Implementation of the Children’s Online ) Privacy Protection Rule ) COMMENTS OF The Center for Digital Democracy, American Academy of Child and Adolescent Psychiatry, American Academy of Pediatrics, Benton Foundation, Berkeley Media Studies Group, Campaign for a Commercial-Free Childhood, Center for Science in the Public Interest, Children Now, Consumer Action, Consumer Federation of America, Consumer Watchdog, Consumers Union, National Consumers League, Privacy Rights Clearinghouse, Public Health Institute, U.S. PIRG, and World Privacy Forum Of Counsel: Angela J. Campbell, Guilherme Roschke Pamela Hartka Institute for Public Representation James Kleier, Jr. Georgetown University Law Center Raquel Kellert 600 New Jersey Avenue, NW Andrew Lichtenberg Washington, DC 20001 Ari Meltzer (202) 662-9535 Georgetown Law Students Attorneys for CDD et al. June 30, 2010 SUMMARY The Center for Digital Democracy, American Academy of Child and Adolescent Psychiatry, American Academy of Pediatrics, Benton Foundation, Berkeley Media Studies Group, Campaign for a Commercial-Free Childhood, Center for Science in the Public Interest, Children Now, Consumer Action, Consumer Federation of America, Consumer Watchdog, Consumers Union, National Consumers League, Privacy Rights Clearinghouse, Public Health Institute, U.S. PIRG, and World Privacy Forum are pleased that the FTC has begun a comprehensive review of its children’s privacy regulations. In general, the Children’s Online Privacy Protection Act (COPPA) and the FTC rules implementing it have helped to protect the privacy and safety of children online. Recent developments in technology and marketing practices require that the COPPA rules be updated and clarified. When Congress passed COPPA in 1998, computers provided the only means of accessing websites and online services. Today, adults and children have many other ways to access the Internet and online services including mobile phones, gaming consoles, and interactive television. In addition, marketers have developed very sophisticated methods of collecting data and are using that data to target individuals with personalized marketing messages. These developments have increased the risks to children’s privacy. Fortunately, COPPA was drafted broadly and with an eye to the future, so that most of the necessary updates can be made under the FTC’s existing statutory authority. COPPA generally prohibits the operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting information from a child, from collecting personal information without (1) providing notice of what information is being collected, how the operators uses such information, and what the operator’s disclosure practices are, and (2) ii obtaining verifiable parent consent for the collection, use or disclosure of the personal information. The FTC should clarify its understanding of or define several of these key terms in the statute. First, the Commission should update the definition of personal information to reflect the evolving world in which persistent cookies, IP addresses, geolocation data, and even seemingly anonymous combinations of data such as age, zip code, and gender are collected and used to track individuals and to target personalized market messages to them, a practice known as “behavioral targeting.” Second, the Commission should clarify that the language “website located on the Internet or an online service,” covers a broad range of digital threats to children’s privacy. Regardless of the device used to access a website on the Internet (e.g. mobile device, game console, interactive television set), that interaction is covered by COPPA because a “website located on the Internet or online service” is being accessed. COPPA also covers other online services that may not connect to a website on the Internet but nonetheless provide interactivity and collect or use personal information from children. Third, the FTC should clarify the meaning of a website or online service "directed at children." It should use the same definition for websites targeted to children that it employed in its Food Marketing Report, i.e., any website or portion of a website that audience demographic data indicates that 20% or more of visitors are children ages 2-11; prominently features child- oriented animated or licensed characters or a celebrity endorsers highly popular with children; uses language, such as “kid,” “child,” “tween,” or similar words; prominently depicts models or characters who appear to be younger than age 13; or promotes child-oriented themes, activities, incentives, products, or media. The FTC should also clarify that advertisements targeted to iii children based on behavioral indicators meet COPPA’s “directed to children” standard. Moreover, the FTC should clarify that when a website or online service operator, including advertising networks or data exchanges, claims that it can deliver an advertisement to a child in a specific age group, it has actual knowledge that it is collecting or using information from a child. The techniques for collecting and using data for targeted marketing are largely hidden, not well-understood by the public, and frequently change. Thus, the FTC should require major websites, ad networks, social networks, and other online service operators that collect data from an audience with 20% or more children under 13 to periodically inform the FTC about the types of data they are collecting; how they collect it; how they use it; and how they comply with COPPA. Unless hidden data collection practices are disclosed, the FTC cannot assess whether companies are complying with the existing rules or identify where the rules or law may need to be strengthened. The FTC should also evaluate the effectiveness of the safe harbor program. First, it should determine what proportion of child-directed websites and online service operators participate in a safe harbor program. Second, it should assess the effectiveness of the safe harbor programs by requiring annual reports about their enforcement efforts. Third, to ensure that the safe harbor programs are keeping up to date on new threats to children’s privacy, it should require them to apply for recertification every five years. The Commission should instigate prompt investigations any time it receives credible evidence of possible COPPA violations. For example, certain statements made at the June 2, 2010 Roundtable suggest that some operators may be violating COPPA by abusing one of the limited exceptions to parental consent. iv Finally, to provide at least some protection for children under 13 that visit sites intended for teens, and to protect teens, who are also vulnerable to marketing, albeit for different reasons than younger children, the FTC should ensure that teen-oriented sites comply with Fair Information Practices. v TABLE OF CONTENTS SUMMARY.................................................................................................................................... ii TABLE OF CONTENTS...............................................................................................................vi I. Recent Developments in Technology and Marketing Practices Threaten Children’s Privacy ..............................................................................................................6 A. The Number and Variety of Platforms Used to Access Website and Online Services and to Collect Data Has Vastly Expanded ................................... 7 1. Mobile Phones ............................................................................................ 7 2. Video Gaming........................................................................................... 11 3. Interactive Television................................................................................ 15 4. Digital Signage.......................................................................................... 18 B. New Advertising Techniques Present Increased Risks to Children’s Privacy and of Unfair or Deceptive Practices....................................................... 20 1. Behavioral Targeting ................................................................................ 21 2. Advertising Networks, Advertising Exchanges and Data Exchanges ................................................................................................. 22 II. The FTC Should Takes Steps to Ensure the Continued Effectiveness of COPPA in Light of New Developments........................................................................... 24 A. Personal Information............................................................................................. 25 1. Persistent Identifiers.................................................................................. 26 2. Location .................................................................................................... 27 B. Online Service....................................................................................................... 28 C. Operator of a Website or Online Service.............................................................. 29 D. Website or Online Service Directed to Children and Actual Knowledge ............................................................................................................ 31 III. The Commission Should Be More