Here in the US, the FTC is proposing changes to the Children’s Online Privacy Protection Act (COPPA). They recognize (correctly) that changes in data collection methods, as well as technological advancements including geolocation, smartphones, behavioral ad targeting and social networking, make it necessary to revise the rules for kids under the age of 13.
So what do the new rules include?
- Redefining “Online Services:” When COPPA was enacted in 1998, “online services” referred to websites. Now it includes mobile apps “that allow children to play network-connected games, engage in social networking activities, purchase goods or services online… or interact with other content or services.”
- Redefining “Personal Information:” Also called “personally identifiable information” or PII, this included stuff like full name, email address, street address, phone number. It now includes geolocation data and online tracking mechanisms used for behavioral targeting.
- Added flexibility for online services: Kids under 13 can now participate in interactive communities without parental consent as long as the site takes “reasonable measures to delete all or virtually all children’s personal information before it is made public.”
Ok, sounds good.
Wait. “Reasonable measures?”
If you scan the new rules, you’ll see the word “reasonable” everywhere:
“The operator must establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children.”
“Provide a reasonable means for a parent to review the personal information collected from a child and to refuse to permit its further use or maintenance”
“An operator must make reasonable efforts, taking into account available technology, to ensure that a parent of a child receives notice of the operator’s practices with regard to the collection, use, and/or disclosure of the child’s personal information”
“If the operator has not obtained parental consent after a reasonable time from the date of the information collection, the operator must delete such information from its records” (Emphasis mine)
What does “reasonable” mean here? And who gets to define it? Parents? Kids? Lawyers? The FTC? The “operators?”
Until there’s a common definition of “reasonable” for these new rules, we’re still caught between the scylla of unscrupulous advertisers and the charybdis of controlling family activitsts.
What do you think?