The FTC Finalizes Amendments to the COPPA Rule

Authors: Allison Fitzpatrick , Gary Kibel and Zachary Klein, CIPP/US/E/A, CIPM, FIP

The FTC finally issued its Final Rule amending the requirements of the Children’s Online Privacy Protection Act (COPPA). The announcement, eagerly awaited after the FTC’s proposed changes on December 20, 2023, marks the first amendment to the COPPA Rule since 2013. The online landscape has dramatically changed over the past 12 years, particularly with the explosion of smartphones, social media and artificial intelligence. The FTC made these changes in response to the potential harms created by this new digital landscape.

Key Changes to the COPPA Rule

Below are some of the more salient changes to the COPPA Rule:

Separate verifiable parental consents for targeted advertising.

Operators now need to obtain an additional verifiable consent from parents to disclose children’s data to third-party advertisers unless the disclosure is necessary to support the internal operations of the website or online service. This effectively creates a two-tiered consent requirement for targeted advertising that will require COPPA-covered entities to block third-party behavioral advertising by default unless parents expressly opt in.

Strict data retention requirements.

Operators cannot retain children’s personal information for longer than necessary to fulfill the specific purpose for which it was collected, and the new rule expressly prohibits operators from storing such data indefinitely. Additionally, operators must establish and maintain a written data retention policy specifying the business need for retaining children’s data and the timeframe for deleting it, and this policy must be described in the operator’s online privacy notice.

Expanded definitions of “personal information” and “directed to children.”

The definition of “personal information” now extends to any government-issued identifier, not only Social Security numbers, and includes biometric identifiers “that can be used for automated or semi-automated recognition.” Additionally, the definition of “directed to children” now clarifies that the FTC will consider “marketing or promotional materials or plans, representations to consumers or to third parties, reviews by users or third parties, and the age of users on similar websites or services” as empirical evidence of audience composition and intended audience.

Parental consent via text message.

The FTC incorporated a new “text plus” method for obtaining verifiable parental consent similar to the existing “email plus” method. As with “email plus,” the “text plus” method cannot be used to obtain consent to “disclose” children’s personal information, because “both forms of communication carry a higher risk of a child impersonating a parent than do other approved methods of obtaining verifiable parental consent.”

Increased accountability for Safe Harbor programs.

The FTC-approved “Safe Harbor” self-regulatory programs that implement the protections of the COPPA Rule (which include CARU, ESRB, iKeepSafe; kidSAFE; PRIVO and TRUSTe) must publicly disclose their membership lists and report additional information to the FTC as part of efforts to increase accountability and transparency.

Proposals Not Included in the Final Rule

Some of the FTC’s original proposals were excluded from the Final Rule. Notably, the FTC did not adopt amendments that would have limited the use of push notifications and other engagement techniques, including a prohibition on sending push notifications to children without verifiable parental consent. The FTC also declined to finalize the proposals addressing educational technology with school authorization to avoid conflicts with the Department of Education’s amendments to the Family Educational Rights and Privacy Act (FERPA).?

The Vote

The FTC voted 5-0 approving publication in the Federal Register of the Final COPPA Rule, with outgoing Chair Lina Khan and Commissioner (and newly appointed Chair) Andrew Ferguson issuing separate concurring statements.?The Commissioners disagreed on what changes should have been made to COPPA, with Commissioner Ferguson chastising the “Biden-Harris FTC’s frantic rush to finalize rules on their way out the door,” referring, in part, to the prohibition against retaining information online indefinitely and the exception for collecting children’s personal information for the sole purpose of age verification. In his Concurring Statement, Commissioner Ferguson urged the FTC under President Trump to “fix the mess the outgoing majority leaves in its wake.” As such, it remains to be seen whether the FTC’s Final Rule is actually “final” or whether we will see changes to address Commissioner Ferguson’s concerns.

The Bottom Line

• While the Final Rule does not become effective until 60 days after publication in the Federal Register and operators have an additional year to comply, and the Trump administration has issued an Executive Order enabling new regulations to be paused, operators should begin assessing their current privacy practices now, as it may take some time to come into full compliance.
• Requirements that were ultimately dropped from the Final Rule, such as limitations on push notifications, may still be the subject of enforcement under the Commission’s broad FTC Act Section 5 authority. Companies should be mindful of whether their data practices may still be considered an “unfair trade practice” under the FTC Act despite meeting COPPA’s express requirements.
• Businesses should continue to monitor developments at the U.S. state level, which has seen a proliferation of laws regulating how companies collect and use the personal data of teenage consumers not covered by the COPPA Rule.

Originally published on dglaw.com.