FTC Regulates Kids' Privacy Online

IQ was first to write "The Children's Online Privacy Protection Act (COPPA) was issued today by the FTC. It kicks in April 2000. The goal is to protect the privacy of the children by requiring "verifiable parental consent". Check out the release text. "

If you have the time you might also want to read the actual rule and public comments. Most online news services have covered it; Wired has a lengthy analysis sourced to an anonymous Republican staffer, but News.com has one without the Republican political spin. Fundamentally, the act regulates those commercial websites that target themselves to children (12 and under) and collect personal information about them - if you aren't commercial, or don't target yourself to children (even if you collect personal information from people) or just don't collect personal data from the kids, you aren't affected. Nevertheless, it is a significant step in privacy regulation - businesses must contact parents before collecting such information from an individual that they have actual knowledge is a child (for instance, by asking their age), but have no duty to ask the age of the general population. Thus most websites, even commercial ones that collect personal information, will have no change in day-to-day operations - they target themselves to a general audience, don't care about their visitors' ages, and need not take any steps under the new regulations.

Sites which do target kids for marketing will have to get parental permission before doing so. Parents also must be offered the option to prevent their kids' information from being shared with third-parties - to prevent the sale of that data, in other words. Parents can also opt-out entirely on behalf of their children and the site must honor their request. In school situations, teachers can give the requisite permission for their students so school activities won't be hampered.

The law and rule are likely to put a significant damper on online marketing to kids aged 12 and under. Specialized kids' sites will have to get parental permission to collect the data that is their primary reason for existence, and presumably many parents will prevent these sites from selling it. How well will they be enforced? That's uncertain. According to EPIC, the FTC has received hundreds of privacy-related complaints and has investigated only three.

"Self-regulation" of privacy concerns is an obvious failure. TrustE, the leading light of the businesses trying to prevent consumer protection on the internet, spends more time covering up privacy breaches by its members than investigating complaints... Will targeted government intervention have any better effect?