Highlights from IAB COPPA Comments - December 23, 2011

The IAB and its member companies are firmly committed to protecting children online. However, the IAB does not believe that the Rule requires amendment at this time and, as detailed below, we are concerned that the significant amendments proposed by the Commission will have negative effects for consumers and companies alike.

View IAB's COPPA Comments Filed with the FTC

View the FTC's Proposed COPPA Rule

View Venable Summary of COPPA Comments to the FTC

  • The IAB agrees with the Commission that COPPA appropriately defines a “child” as an individual younger than 13.
     
  • The IAB shares the Commission’s views that Congress appropriately established a strict actual knowledge standard for applying COPPA to websites and online services not directed to children, and appreciates the Commission’s reaffirmation that such operators are not required to investigate the ages of users for their “general audience” websites and services.
     
  • The Commission has expressed the view that the Self-Regulatory Principles do not require parental consent for online behavioral advertising to children. This statement does not reflect the Principles application to children under 13. The Sensitive Data provision of the OBA Principles limits the collection and use of any data – not just data that is “personal information” as defined by COPPA – that can be associated with a particular computer or device for the purpose of engaging in online behavioral advertising where the entity collecting the data has actual knowledge the user is a child under 13.
     
  • IAB’s overarching concern is the cumulative effect of the changes outlined in the Commission’s proposal, which could be interpreted to bring virtually all online advertising and analytics activities, as well as other activities that use the same technologies, within the scope of COPPA.
     
  • Geolocation information standing alone is not sufficient to identify a specific individual or to allow personal or direct contact with an individual. Geolocation information, which may be obtained through several technologies, could include information such as country, region, city, postal/ZIP code, street name, latitude and longitude, and time zone. Proposed changes to COPPA, which would add the general term “geolocation information” as a type of “personal information,” is therefore substantially broader than the current Rule, which is limited to a full “home or other physical address including street name and name of a city or town.” The Commission intends that the new term “geolocation information” could include a street name and city alone, or other equivalent data. Without an address or other additional data to identify a household or individual, a street name and city could encompass a large geographic area and as many as 1,000 households. For example, Sepulveda Boulevard in the Los Angeles area, is over 40 miles long.
     
  • Persistent identifiers and geolocation information therefore are readily distinguishable from home addresses and telephone numbers, which are singled out in COPPA because of the risk that sexual predators could locate children by physically going to an address or calling a number. Cookies, in particular, can easily be filtered or deleted through the use of browser settings. Most importantly, these identifiers and geolocation information are not personally identifying unless they are combined with other data.
     
  • The Proposed Rule would negatively affect parents’ and children’s’ online experiences by expanding the instances when consent is required while constricting possible consent methods.
     
  • The IAB is concerned that the Proposed Rule would favor certain business models over others by making it difficult for entities to partner with each other in offering websites or online services for children. Small publishers would be disadvantaged because they often must rely on third parties to handle advertising and other support services.
     
  • The Proposed Rule’s distinction between data practices for internal operations, and the same data practices for other purposes, risks singling out advertising speech for greater burdens. To draw a content-based distinction that satisfies the First Amendment, the Commission must at least show that its Proposed Rule directly advances a substantial government interest and is drawn to achieve that interest. The IAB does not believe that the Commission has met this burden.
     
  • IAB does not believe the Commission has identified any concrete harm to children that would justify extending COPPA as contemplated. The Commission should not seek to single out online advertising for greater restrictions, particularly in the absence of clear constitutional and statutory authority.