Source: https://www.naag.org/publications/naagazette/volume-7-number-8/childrens-online-privacy-protection-act-need-to-know-changes.php
Timestamp: 2019-04-26 02:17:06+00:00

Document:
The Childrenï¿½s Online Privacy Protection Act (COPPA) provides parents with the right to control the collection of personal information from their children online.[i] While the Federal Trade Commission (FTC) is the primary enforcer of COPPA, Congress has also made clear that states have jurisdiction to bring civil actions on behalf of the residents of their states for COPPA Rule violations,[ii] and both Texas and New Jersey have done so.[iii] The FTC recently amended the COPPA Rule to make several important amendments, and this article provides a summary of the key changes as states consider potential enforcement.
strengthens the data security requirements of the Rule, and requires covered operators to adopt reasonable procedures for data retention and deletion.
Below I discuss each of these changes in more detail.
In recognition of the fact that persistent identifiers serve a myriad of functions, many of which do not affect the privacy or safety of children online, the Amended Rule provides for a specific exception to the verifiable parental consent requirement where a persistent identifier is used solely for the support of the internal operations of the website or online service.[xii] The types of activities covered by this exception include contextual advertising, authentication, network communications, and analytics.[xiii] Importantly, however, this exception only applies where the information collected is not used or disclosed to contact a specific individual, including through behavioral advertising, to amass a profile on a specific individual, or for any other purpose.
Mixed-Audience Sites: The Amended Rule also recognizes a new category of website or online service directed to children known as a mixed-audience site. These are online sites or services that meet the criteria set forth in the Rule for being a website or online service directed to children, but where children are not the primary audience.[xvi] For example, a website may primarily target parents or young teens but also have a younger than 13 audience. The Rule now permits operators of these sites or services to age screen users if they (1) do not collect personal information from any user prior to collecting age information, and (2) prevent the collection, use, or disclosure of personal information from users who identify themselves as younger than age 13 without first complying with the Ruleï¿½s parental consent provisions.
The FTC is committed to providing consumer and business guidance, and to that end there are many resources available to provide more specific guidance on the COPPA Rule at the FTCï¿½s business center. This site has links to the Amended Rule, a list of ï¿½Frequently Asked Questions,ï¿½ and other guidance documents, including Childrenï¿½s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business and a 6-minute video that outlines the Amended Rule. Questions about the COPPA Rule can be emailed to coppahotline@ftc.gov.
[i] 15 U.S.C. § 6501-6506.
[iii] See https://www.oag.state.tx.us/oagnews/release.php?id=2288 (Dec. 2007), and http://www.nj.gov/oag/newsreleases12/pr20120606a.html (June 2012).
[iv] See 144 Cong. Rec. S12741 (Oct. 7, 1998) (Statement of Sen. Bryan).
[v] 64 Fed. Reg. 59888 (Nov. 3, 1999).
[vi] 16 C.F.R. Part 312.
[ix] Id. § 312.6, 312.8.
[x] 78 Fed. Reg. 3972 (Jan. 17, 2013).
[xi] 16 C.F.R. § 312.2 (definition of personal information).
[xiii] Id. § 312.2 (definition of Support for the internal operations of the Web site or online service).
[xiv] Id. § 312.2 (definition of Operator).
[xv] Id. § 312.2 (definition of Website or online service directed to children, part (2)); Id. § 312.3.
[xvi] Id. §312.2 (definition of Website or online service directed to children, part (3)).

References: § 6501
 § 312
 § 312
 § 312
 § 312
 § 312
 § 312
 §312