FTC Proposes Rules to Strengthen Children’s Privacy Law 

The Federal Trade Commission released a notice of proposed rulemaking this week introducing major changes to the Children’s Online Privacy Protection Act (COPPA) rule. COPPA currently requires companies to obtain parental consent to collect data from children under 13, but the proposed rule would significantly strengthen protections for children online. The new rule would: 

• Impose additional restrictions on how companies can collect, use, retain, and disclose children’s data; 
• Limit companies’ ability to monetize children’s personal information; 
• Prohibit targeted advertising to children and require that online service providers obtain separate parental consent before disclosing children’s data to third-party advertisers; 
• Reinforce the existing ban on conditioning a child’s online activity on the collection of personal data; 
• Prohibit using nudges to prompt or encourage children to stay online; 
• Codify the FTC’s existing EdTech guidance, which allows schools and school districts to collect, use, and disclose students’ personal information only for educational purposes, not for commercial purposes; 
• Establish stronger data security requirements to safeguard children’s personal information; and 
• Expand COPPA’s definition of “personal information” to include biometric identifiers. 

EPIC has long advocated for robust children’s privacy protections. EPIC submitted comments to the FTC in 2019 when the agency announced its plan to review and update COPPA rules. EPIC’s comments are favorably cited in the Commission’s proposed rule. 

Recently, EPIC submitted comments to the National Telecommunications and Information Administration focusing on youth privacy, mental health, and safety online. EPIC, the Center for Digital Democracy, and Fairplay also recently submitted a comment to the FTC to argue that an age-estimation technology using biometric and personal data does not meet COPPA’s requirements for the collection of verifiable parental consent. The public may submit comments to the FTC on the proposed rule within 60 days following the publication of the rule in the Federal Register.