October 21 will mark the 20th anniversary of the Children’s Online Privacy Protection Act, which governs the collection and use of information from, or about, children age 13 or under. While Congress has not revisited COPPA, the Federal Trade Commission significantly expanded the scope of the COPPA rule in 2013. Last October, the FTC issued an “Enforcement Policy Statement Regarding the Applicability of the COPPA Rule to the Collection and Use of Voice Recording.” What real-world effect have these changes had on the market for children’s content online?

Furthermore, a complaint recently filed with the FTC raises significant questions about COPPA enforcement given the shift from stand-alone websites to third-party platforms for accessing content. How should the FTC determine what portion of a site is “directed to” children, or when a site is directed to children rather than families? How does COPPA’s knowledge standard work? Do platform operators have affirmative duties to identify child-directed content? What do these legal questions mean for creators of content and services for kids?

Finally, Europe’s new General Data Protection Regulation would go beyond COPPA in regulating children’s information. Most notably, GDPR expands the age range covered to include children 13-16 — something Congress considered in 1998 but decided not to do because of First Amendment and practical concerns. How might the European approach to children’s privacy intersect with COPPA? Might Congress revisit the statute — and should it?

свернуть