The Federal Trade Commission isn’t kidding around.
In late December, right before the holidays, the FTC announced a notice of proposed rulemaking to update its Children’s Online Privacy Protection (COPPA) Rule.
And it’s been a long time coming.
Passed in 1998, COPPA is a US federal law that restricts what data online service providers can collect, use and disclose about children under the age of 13. In 2000, the FTC, which is tasked with enforcing COPPA, implemented the first version of the COPPA Rule, which specifies what companies need to do to comply with the law.
More than 20 years have passed since COPPA went into effect, and the rule was last updated in 2013.
In 2019, the FTC announced it was seeking comments from the public about whether the rule needed to be updated again to reflect the pace of technological change. According to the FTC, it received 175,000 comments in response to its call, so, yeah, it’s pretty clear the rule needs an update.
Exceptions
What could change?
Rather than reboiling the ocean, I’m going to glom on to a specific aspect of the rulemaking: the “support for internal operations exception.”
(If you want a fuller rundown on the FTC’s proposed changes to its COPPA Rule, read any of these excellent legal blogs or the full notice of proposed rulemaking itself.)
The aforementioned exception is a narrowly defined carve-out of the COPPA Rule added in 2013 that allows companies to collect personal information from a child without parental consent if the data is used to support the internal operations of a site or service.
Authenticating users, protecting security, ensuring regulatory compliance, personalizing site content, frequency capping and serving contextual advertising are all examples of activities that would qualify.
Because contextual advertising doesn’t rely on cookies or other personal identifiers, it’s the monetization method of choice for many child-directed websites and services with “actual knowledge” that they’re collecting personal information from a child, like YouTube.
In its notice of proposed rulemaking, the FTC noted it still believes it “struck the proper balance” when creating the exception in 2013, which includes a safe harbor for contextual advertising.
But the FTC also poses an interesting question for feedback in its COPPA Rule proposal:
Given the sophistication of contextual advertising today, including that personal information collected from users may be used to enable companies to target even contextual advertising to some extent, should the commission consider changes to the rule’s treatment of contextual advertising?
I’ve been noodling on something similar. Contextual targeting today is way more advanced than what was available a decade ago.
So I asked a few experts: What could the FTC’s COPPA Rule proposal mean for contextual advertising to kids? Here’s what they had to say:
Allison Fitzpatrick, partner, Davis+Gilbert
The FTC appears to understand that without contextual advertising, many online services could not survive because they would not be able to make any money.
I believe contextual advertising to children will survive the most recent changes to the COPPA Rule, but it may be subject to additional limitations. What concerns the FTC is how contextual ads have changed over the years and how lines between contextual and targeted ads have become more blurred given the sophistication of contextual advertising practices, such as the impact of AI.
A clearer definition as to what constitutes “contextual advertising” and what types of data can and cannot be used may help address the FTC’s concerns.
Daniel Goldberg, partner, Frankfurt Kurnit Klein & Selz
The FTC did not change the support for internal operations exception, which expressly allows operators to collect persistent identifiers, such as IP addresses, as necessary to serve contextual advertising on their websites or online services.
That said, the proposed COPPA Rule does add new disclosure requirements. Operators will now be required to disclose the specific internal operations for which they collect persistent identifiers and the means taken to ensure such identifiers are not used or disclosed to contact specific individuals.
Jamie Lieberman, chief legal officer, Mediavine
If the FTC were to find that contextual advertising no longer fits into the internal operations exemption of COPPA, advertisers would have to alter their strategies where children are the intended audience. This would be a significant change and likely result in many advertisers ceasing this type of advertising or drastically changing their strategies.
Jason Williams, CEO, Kidoz
From the reading I’ve done on the FTC COPPA Rule revisions, contextual advertising will become stronger than ever. More companies will be forced to reduce their dependence on data targeting practices, and more internal operations will embrace contextual-first practices as the gray area for data collection and sharing becomes far narrower.
Answers have been lightly edited and condensed.
🙏 Thanks for reading! And good luck to everyone with their New Year’s resolutions. Does this count as doing exercise? As always, feel free to drop me a line at [email protected] with any comments or feedback.
