FTC Issues Revised COPPA FAQs
On April 25, 2013, the Federal Trade Commission ("FTC" or "Commission") issued revised Frequently Asked Questions ("FAQs") concerning the updated Children's Online Privacy Protection Act ("COPPA") Rule, which is slated to go into effect on July 1, 2013. The revised FAQs, entitled "Complying With COPPA: Frequently Asked Questions," contain nearly 100 questions and answers that are intended to provide informal guidance for website operators, mobile application developers, plug-ins, advertising networks, and other third parties operating on child-directed websites and online services on how to comply with the revised COPPA Rule. Although the FAQs provide some helpful guidance for industry, the FAQs hold some surprises that will further affect the practices of websites and online services directed to children. In particular, the requirements for links and comments about teen-directed websites may suggest significant new burdens to website operators.
Privacy Policy Links
Since the FTC first enacted the COPPA Rule in 1999, operators have been able to post a single hyperlink to their website privacy policy for their entire site that combines information about the children's and general information practices. This practice was allowed so long as the privacy policy link either takes visitors directly to the point in the privacy policy that discusses collection practices with regard to children, or the privacy policy clearly discloses at the top of the notice that there is a specific section discussing the operator's information practices with regard to children. Under new FAQ 31, the FTC make clear that a direct link to the children's portion of the privacy policy should appear on the home page or screen of the children's area of the site or service, and at each area where personal information is collected from children. It will be important for affected operators to review their policies and links to be sure they comply.
Teen Sites
While confirming that COPPA does not apply to teens, FAQ 11 emphasizes the Commission's "concern" about teen privacy. The FAQs include staff comments that "strong, more flexible, protections may be appropriate for this age group." These comments may suggest an intent by the Commission to consider enforcement action related to teen privacy under the FTC's general Section 5 authority. More ominously, that statement, coupled with new FAQ 38 and FAQ 53, suggests a sea change in how operators of teen sites may be affected if the FTC staff deems the site "directed to children," either primarily or secondarily, since an operator of a website or online service that is either primarily or secondarily directed to children may not block children from participating in the website or online service.
Operators of teen-directed sites or mixed-audience websites who do not target children have historically used an age-screen to block underage users from accessing their websites, because the content is not intended for them. FAQ 53, however, suggests the distinct possibility that the definition of a child-directed site may be greatly expanded. It states:
Although you may intend to operate a "teen service," in reality, your site may attract a substantial number of children under 13, and thus may be considered to be a "Web site or online service directed to children" under the Rule. Just as the Commission considers several factors in determining whether a site or service is directed to children, you too should consider your service's subject matter, visual content, character choices, music, and language, among other things. If your service targets children as one of its audiences – even if children are not the primary audience – then your service is "directed to children."
Both the prospect of some unknown requirements related to teen privacy through enforcement action, and the prospect that teen-oriented sites considered "secondarily" directed to children will have to offer content to children, raise important First Amendment issues. If teen-oriented websites or online services are prohibited from blocking kids from entering the site, the result of the FTC rule will be to require them to offer kid-directed content, a result at odds with First Amendment rights to offer content to select target audiences. Similarly, any effort to impose new privacy restrictions on teen-oriented sites and online services could raise important constitutional questions, since teens have a recognized zone of privacy.
Other Open Questions
The FTC did not address a number of key questions remaining for industry, including whether the treatment of e-commerce websites as general audience sites has changed. Many e-commerce sites feature games, entertainment content, clothing, toys, and other products that appeal to kids, use kid-oriented themes, and feature animated characters, models, and celebrities geared to kids. The content of these sites has not changed over the years, but the updated FAQs raise concerns about whether such sites would now be viewed as "secondarily" directed to kids. Just as a parents' area in a kids' site is not viewed to be kid-directed, links to an adult site operated by the same corporate family or a third party have never been viewed to be "child-directed" under the old COPPA Rule. Instead, e-commerce sites have always been viewed to be general audience sites, even though they may be accessed via links from a kids' site operated by the company or feature kid-appealing content because they sell children's products. These links to different sites or microsites operated by the same company or corporate family are integral to the architecture of almost all websites, just as links to e-commerce partner sites are integral to the sites as well. The assumption is that the FTC will continue to treat e-commerce sites as general audience websites, but this merits confirmation in the FAQs.
Prospects for Extending the Compliance Deadline?
Despite requests from several industry groups last week urging the FTC to give companies until January 1, 2014 to comply with the significant changes to the COPPA Rule, the FTC has reiterated that the Rule will go into effect on July 1, 2013. This gives operators roughly two months to continue digesting the revised COPPA Rule, review the updated FAQs, and implement the necessary changes to their websites and online services. The prospect that teen sites will have to be significantly retooled to accommodate visits by children under 13 creates new concerns about the scope and application, and may result in renewed requests for an extension by affected companies.
For more information on children's privacy issues, please contact:
Sheila Millar (+1 202.434.4143, millar@khlaw.com)
Tracy Marshall (+1 202.434.4234, marshall@khlaw.com)