Federal Trade Commission
Children's Online Privacy Protection Rule -- Comment, P994504
Supplemental Comments of
August 25, 1999
The Center for Democracy and Technology (CDT), the American Civil Liberties Union (ACLU), and the American Library Association respectfully submit these supplemental comments in response to the Federal Trade Commissions (FTC) proposed Rule implementing the Childrens Online Privacy Protection Act (COPPA or the Act). Notice of Proposed Rulemaking to Implement the Childrens Online Privacy Protection Act of 1998, and Proposed Rule, 64 Fed. Reg. 80 (April 27, 1999).
I. The Threat to Children's Speech
Directly contrary to both the statutory language and intent of The Children's Online Privacy Protection Act, the Proposed Rule dramatically inhibits the ability of children to communicate over the Internet. COPPA appropriately addresses the privacy concerns raised by the collection of personal information by commercial Web sites directed to children (or that have actual knowledge that they are dealing with a child). The Act was designed to place duties on those who collect information from children. It was not designed to regulate children's behavior; indeed, great effort was taken to ensure that the Act would not limit children's ability to speak. That is, however, exactly what the Proposed Rule does.
The core of the Act's protections is the requirement that commercial Web sites and online services directed at children 12 and under, and Web sites that have actual knowledge they are dealing with a child, obtain parental consent prior to the collection of personal information from children. The legislation was not intended to interfere with children's ability to communicate, interact, and seek out information online. However, two definitions contained in the Proposed Rule go beyond the statutory language and threaten to upset the balance between protecting children's privacy and ensuring their ability to participate online.
Under the Proposed Rule, Web sites that do not collect personal information from children will nonetheless be required to obtain verifiable parental consent before allowing children to participate in any service that allows children to speak. Simply put, any site that would enable a child to communicate with a peer, ask a question of a teacher, or e-mail to a neighborhood friend, would have to obtain parental consent before allowing such communications. For example, Internet sites that provide anonymous chat or email services for children would be required to obtain parental consent, even if the operator of the site does not gather any information from the children.
Rather than focusing on the risks to children posed by the collection of personal information by commercial Web sites, the Proposed Rule erects a barrier to children's speech because of the possibility that children may (as they may when using the telephone or playing on a playground) disclose information about themselves. The Proposed Rule reduces the vibrant and interactive Internet -- where children can speak as well as listen -- to something far more akin to television.
The harmful effect of the Proposed Rule may indeed be inadvertent on the part of the Commission. In its discussion of the Proposed Rule, the Commission expressly draws a critical distinction between "conduits" and "operators." The discussion states: "Where the website or online service merely acts as the conduit through which the personal information collected flows to another person or to another's website or online service, and the website or online service does not have access to the information, then it is not an operator under the proposed Rule." Based on this discussion, it would appear that the Commission does not intend to reach services providers that merely provide communications capabilities to children -- but that is exactly what the Proposed Rules do.
Whether an inadvertent drafting problem or an intentional effort to go beyond the statutory language of the Act, the Proposed Rules are contrary to the statute and must be changed, as detailed in the following section.
Problematic Sections of the Proposed Rule and Recommended Changes
The statutory language of COPPA was clearly limited to reaching situations where the "operator" of an Internet site gathered information from children for commercial purposes. The Proposed Rule, however, places obligations on operators of email services, chat rooms, and other communications media even if the operator does not gather information. The effect of this overreaching in the Proposed Rule is to place significant burdens on the ability of children to speak online.
The problem arises in two specific definitions found in the Proposed Rule: that of "disclosure" and "collect." Separately, either definition would likely be read to encompass the mere provision of communications capability to children (even if the operator of the service does not collect information). Taken together, the two definitions would likely be interpreted to burden children's ability to speak. Both definitions warrant careful review and correction by the Commission.
The Proposed Rule expands the statutory definition of "disclosure" (bold indicates new language):
The boldfaced provision in Subsection (b) was added in the Proposed Rule, and that language (especially when read in conjunction with the definition of "collect") sweeps in the mere provision of a communications capability to children. Simply read, the language would cover any service in which a child could possibly disclose information even if the operator of the service does not collect the information.
While the FTC clearly must have flexibility to ensure that the list of methods through which an operator can disclosed collected information in section (b) are not outdated, this is accomplished by the phrase "by any means" in the statutory definition. The definition in the Proposed Rule turns the disclosure or revelation of information by a child -- an activity which an operator cannot (nor are they expected to under the Act) control -- into a "collection" and subsequent "disclosure" by the operator. Clearly this is not the intent of the statute.
The Proposed Rule should be amended as follows:
Section 312.2 defines the term "collects or collection," a term not defined in the Act:
We concur with the FTC's assessment that the terms "collects and collection" must be defined. All personal information collected by the commercial operator pursuant to these regulations -- including information collected from parents, information collected offline, and information collected during the process of verifiable consent -- should be covered by this definition. The Rule appropriately clarifies the intent of the Act to cover all such instances of collection.
However, by not making clear that "collection" refers to collection by the commercial operator, the definition (especially when read in conjunction with the definition of "disclosure") appears to reach beyond the statutory language to cover communications services provided by an operator even if the operator is not collecting any information.
Inserting the words "by an operator" in the first line of the definition clarifies the scope of the Act -- commercial Web sites directed at children or who knowingly collect information from children. Currently the definition appears to expand the scope of entities covered by the Act. Inserting the phrases "the use by an operator" and "to gather" in section (b) would clarify that the act that triggers the parental consent requirement of the law is that of "collecting" -- an intentional act, not the provision of a service where a child may -- despite the operator's best efforts -- disclose information. This distinction, as the Commission acknowledges in the discussion of the term "operator," is critical.
III. The Impact of the Harmful Language
If the expansion of the Proposed Rule beyond that supported by the statutory language was inadvertent, we assume that the Commission will make the needed corrections. If, however, the harmful provisions of the Proposed Rule were intentionally inserted, then those provisions cannot stand. The Proposed Rule violates the will of Congress in at least four different ways:
COPPA represents an effort to create a legal framework for privacy protection designed specifically for the Internet. This rulemaking is the first effort by a federal agency to implement Rules specifically for the Internet environment. The success or failure of these Rules and this law will have an enormous impact on the future of privacy protections, speech, the Internet, electronic commerce, and future regulatory efforts in these areas. In many ways this is the test bed for whether government intervention can be successful in the online environment. We believe that the changes requested above are essential to ensuring that the Act meets its goal of protecting children in a manner that preserves the interactivity of children's experience on the Internet and preserves children's access to information in this rich and valuable medium.
We welcome the opportunity to comment upon the proposed Rule and looks forward to working with the Federal Trade Commission and all interested parties to implement the Act in a manner true to its goals.
Jerry Berman, Executive Director
Center for Democracy and Technology
Barry Steinhardt, Associate Director
American Civil Liberties Union
Lynn Bradley, Acting Director of the Washington Office
American Library Association