The FTC’s Proposed COPPA Overhaul: A New Era for Children’s Online Privacy?

In a significant move to modernize children’s online safety, the Federal Trade Commission (FTC) unveiled sweeping amendments to the Children’s Online Privacy Protection Rule (COPPA). These proposed revisions, formally announced in the Federal Register on January 11, 2024, reflect the FTC’s stated commitment to adapting COPPA to the evolving digital landscape. The public comment period, which closed on March 11, 2024, garnered over 175,000 comments from various stakeholders, highlighting the widespread interest and potential impact of these changes.

The Heart of the Proposed Changes

• Granular Parental Consent: The FTC aims to give parents more control by requiring separate, explicit consent for each type of data use. This means companies can no longer combine consent for data collection, third-party sharing, and targeted advertising into a single checkbox. This change would require companies to alter how they interact with parents and potentially require alterations to current consent collection practices.
• School Authorization Exception: EdTech platforms have become essential in education. The FTC proposes to allow schools to authorize data collection for educational purposes, bypassing the need for individual parental consent for every activity. This could streamline EdTech adoption, but critics worry it might open the door to misuse of student data.
• Enhanced Data Security and Retention: Recognizing the increasing sophistication of cyber threats, the FTC wants companies to adopt comprehensive security programs specifically tailored to the sensitive nature of children’s information. Stricter data retention rules would also require companies to proactively manage data lifecycles, in an effort to reduce the potential for long-term misuse.
• Expanded Definition of Personal Information: The proposal recognizes that “personal information” is no longer just names and addresses. Biometric data, like fingerprints and facial recognition, are increasingly common, and the FTC amendments ensure COPPA covers these sensitive identifiers.
• Mixed Audience Services: The FTC attempts to clarify the issue of websites and services that appeal to both children and adults. The proposed rules define “mixed audience” platforms and outline when they must comply with COPPA, potentially affecting a wide range of online businesses.

A Growing Trend: Age-Appropriate Design Codes

The FTC’s move comes amidst a growing trend of legislative action aimed at protecting children’s online privacy. Several states, like California, are developing or have enacted age-appropriate design codes, which go beyond COPPA by mandating that all online services likely to be accessed by children are designed with their best interests in mind. These codes often include stricter requirements on data collection, targeted advertising, and the use of addictive design features.

What Happens Next?

With the public comment period closed, the FTC will now review the substantial feedback received and decide whether to finalize the rules. The timeline for this process remains uncertain, but the significant interest and potential impact of these changes suggest a thorough and deliberate evaluation.

The Chevron Decision and the Future of COPPA

The FTC’s proposed COPPA overhaul coincides with a significant shift in the legal landscape surrounding regulatory authority. The Supreme Court’s June 2024 ruling in Loper Bright Enterprises v. Raimondo, which overturned the “Chevron deference” doctrine, may have substantial implications for the future of COPPA and data privacy regulation. This doctrine previously required courts to defer to federal agencies’ interpretations of ambiguous laws, granting agencies broad discretion in shaping regulations.

Without Chevron deference, courts now possess the authority to independently interpret ambiguous statutory language, potentially leading to challenges to the FTC’s proposed rules. While courts may still consider agency recommendations, they are no longer obligated to accept them.

The Chevron decision is particularly significant in the realm of data privacy, where technology and business practices evolve rapidly. Statutes must be flexible enough to adapt to these changes, and ambiguities inevitably arise. As Congress continues its efforts to pass a comprehensive federal privacy law, the Chevron decision presents a new challenge: crafting legislation that is both adaptable to future developments and specific enough to minimize ambiguity. Striking this balance will be a unique challenge for technology regulation in the years to come.

While the full ramifications of the Chevron decision on COPPA and other data privacy regulations remain unclear, the ruling signifies a new era of legal interpretation. The balance between protecting children’s privacy and fostering technological innovation will be increasingly subject to judicial review. It remains to be seen how this shift will impact the FTC’s ability to adapt COPPA to the evolving digital landscape and the broader landscape of children’s online safety.