In December the Federal Trade Commission issued a report entitled "Mobile Apps For Kids: Disclosures Still Not Making the Grade." It stated that "many apps included interactive features or shared kids’ information with third parties without disclosing these practices to parents."
In February mobile messaging app Path paid an $800,000 fine to settle allegations that it collected personal information from children without parental consent.
And now, the FTC is expanding the rules. Updates to the Children’s Online Privacy Protection Act are slated to take effect in less than three months. Attorneys and trade groups, however, say more time is needed for companies to properly comply.
The changes both expand the type of data that fall under the law as well as who is liable for illegal storage and tracking. Attorneys say guidance from the FTC on the original COPPA is helpful, but that with less than 10 weeks before the updates take effect and no new guidance, there is not enough time to prepare.
Last week two trade groups, the Interactive Advertising Bureau and the Application Developers Alliance, sent separate letters to the FTC requesting a six-month delay in implementing the changes to COPPA, which were initially finalized in December. The groups are asking to have until at least Jan. 1, 2014.
It is not unprecedented for the FTC to delay the implementation, said privacy and data security attorney Tracy Shapiro, of counsel at Wilson Sonsini Goodrich & Rosati in San Francisco. "A lot of companies see the deadline looming and want more guidance. We’re spending a lot more time on COPPA issues," Shapiro said.
COPPA, passed in 1998 and effective in 2000, governs online data collection for children under the age of 13. The original law was geared toward websites and required parental consent before a site could track or share a child’s email, address or phone number. The updates now extend to IP addresses, location data, video, audio and photos. Websites and apps are now also liable for the conduct of third parties, including advertisers and plug-ins.
James DeGraw, a corporate technology partner at Ropes & Gray in San Francisco, is also hoping for more direction from regulators. "With the July 1 changes taking effect soon, people are not quite sure how to fully comply."
One thing is certain: More companies will be affected by COPPA than before. "There are a fair number of sites that walk the line and say we don’t track [users'] information and are not geared towards children," DeGraw said. "It’s a bit of a wink-wink, nudge-nudge situation. Any teenager can get access to most any website."
This lack of clarity has made it difficult for attorneys to advise their clients. "We’re still struggling to tell our clients what data cannot be tracked without parental consent," said Steven Chinowsky, a San Diego Latham & Watkins partner who is part of the firm’s transactions and emerging companies practice groups.
The means for parental consent are also expanding under the new COPPA iteration. Currently the primary methods include mailing back a signed form, a credit card transaction and a call-in number. The most used method though, known as "email plus," is a system where parents give permission and set up their own account in their child’s name. The latter only allows websites and apps to track and store data for use internally.
Now, consent can come through methods including electronic scans of signed parental consent forms, videoconferencing, use of government-issued identification and credit cards.
Those new methods could prove difficult. "Trying to figure out parental consent has [also] always been a struggle," Chinowsky said. "While there are some new ways now, they really aren’t practical or economically feasible."
For example, credit card numbers are not typically allowed for personal identification when no payment is being made, Chinowsky added.
Some fear that the new rules go too far and are drastic enough to put some app developers and content providers out of business.
In its letter to the FTC, the Application Developers Alliance wrote: "The rule changes are so significant and the penalties so severe that, absent delay, many developers and publishers will simply stop publishing, placing their entire business at risk."
Chinowsky agrees, saying the changes will "chill the creation of sites and services for kids."
DeGraw, though, is not too worried. "There will be a short-term economic rebalancing, but people will figure it out.
Contact the reporter at email@example.com.