FTC’s new proposed limits on monetization of children’s data could restrict ad targeting

Just a day after drugstore chain Rite Aid was banned from using facial recognition technology as part of a settlement with the FTC, the agency today published a series of proposed changes to the US’ federal children’s privacy framework, Children’s Online Privacy Protection Rule (COPPA). Since 1998, COPPA has helped to curb apps’ and advertisers’ online tracking of children under the age of 13 in the US.

The proposed changes include more stringent limits on companies’ ability to monetize children’s data. If adopted, the updates would restrict advertisers’ ability to target children with their messages.

An overview of proposed changes

The notice of proposed rulemaking includes a handful of suggested changes to COPPA. For one, website operators would be required to get explicit consent from parents or guardians to disclose children’s data to third-parties, including third-party advertisers.

“That means COPPA-covered companies’ default settings would have to disallow third-party behavioral advertising and allow it only when parents expressly opt in,” explains Luis Montezuma, a privacy policy manager.

Under the proposed rule, some online services would be required to have targeted advertising to children switched off by default. Strengthened data security requirements are also included in the proposed rule.

The rule would also restrict kids’ data collection, explicitly banning the collection of data beyond what is strictly necessary for a child to participate in a specific online activity. Website operators would also be disallowed from retaining youngsters’ data for any reasons beyond what’s strictly necessary for its specific purpose. Additionally, this data wouldn’t be allowed to be retained indefinitely.

These proposed changes mirror other recent decisions by the agency on data retention and deletion standards. In May, the FTC cracked down on Meta’s collection and use of young users’ personal data after the company flouted previous privacy orders from the FTC and violated COPPA regulations. Mere days later, the agency, along with the US Department of Justice, announced that it would require Amazon to “overhaul its deletion practices and implement stringent privacy safeguards” for violating COPPA by keeping children’s voice recordings indefinitely and blatantly disregarding parents’ data deletion requests.

New changes proposed in the notice today would also place limits on platforms’ ability to nudge kids to stay online via push notifications. Plus, the definition of ‘personal information’ under the law would be expanded to include biometric identifiers.

Another key change is a proposal to ban commercial uses of children’s information in educational technology (edtech). Under the rule, schools would be allowed to authorize edtech providers to collect, use and disclose students’ data for school-endorsed educational purposes only. These kinds of crackdowns have become an increased focus of federal agencies and state attorneys general in recent years; in 2021, Google settled a suit with New Mexico following allegations that it allowed app developers to collect children’s data without consent via its educational products.

“Kids must be able to play and learn online without being endlessly tracked by companies looking to hoard and monetize their personal data,” the FTC’s Khan said in a statement. “The proposed changes to COPPA are much-needed, especially in an era where online tools are essential for navigating daily life – and where firms are deploying increasingly sophisticated digital tools to surveil children. By requiring firms to better safeguard kids’ data, our proposal places affirmative obligations on service providers and prohibits them from outsourcing their responsibilities to parents.”

Advocates celebrate the proposed COPPA changes

Children’s privacy advocates like Center for Digital Democracy and Fairplay, a nonprofit focused on youngsters’ digital safety, are applauding the proposed changes.

“Children face growing threats as platforms, streaming and gaming companies, and other marketers pursue them for their data, attention and profits,” Dr. Katharina Kopp, director of policy at the Center for Digital Democracy, said in a statement. “Today’s FTC’s proposed COPPA rule update provides urgently needed online safeguards to help stem the tidal wave of personal information gathered on kids. The commission’s plan will limit data uses involving children and help prevent companies from exploiting their information.”

Kopp went on to say that the growing threats of AI-based tracking and targeting will hopefully be curbed with the help of COPPA updates proposed by the FTC. “Young people 12 and under deserve a digital environment that is designed to be safer for them and that fosters their health and wellbeing,” she added. “With this proposal, we should soon see less online manipulation, purposeful addictive design, and fewer discriminatory marketing practices.”

Evaluating the impact to the ecosystem

However, some are skeptical that the proposed changes, if adopted, will constitute meaningful change in the ecosystem. “What’s sort of strange about this is that I don’t really see what more [will be] changed,” Garrett Johnson, a marketing professor at Boston University Questrom School of Business, tells The Drum.

As it stands, Johnson says, COPPA requires platforms to obtain verifiable consent from parents in order to collect children’s data – something that he says is “prohibitively difficult” for most website operators. “Verifiable consent from a parent online usually means, like, using a credit card. So … platforms typically don't get consent. Instead, they just turn off personalized advertising [to kids] – that's what YouTube did [as part of an FTC settlement in 2019].”

He says that what the FTC appears to be proposing is a separate opt-in for using kids’ data for advertising – something that’s already unlikely to be happening within the existing ecosystem considering the barriers to obtaining consent for children’s data collection in the first place. “It’s just making something that's prohibitively difficult even more difficult.”

Increasingly, platforms will simply switch off the option to serve targeted ads to children – like YouTube has done – in order to avoid the headache, Johnson predicts. This shift, according to research Johnson and his colleagues have conducted, would likely limit the supply of kids-focused content online, and, as a result, could impact ad revenue significantly.

While YouTube’s ad price data is not publicly accessible, some YouTube channels claim to have seen ad revenue drop by as much as 60-90% following the platform’s decision to turn off targeted advertising to children, according to a 2019 report from Tubefilter, a news organization focused on the creator economy. One kids’ content-focused creator reported that their ad prices fell 73% following YouTube’s FTC settlement.

However, Johnson says, “In practice, I don’t see there being huge changes [as a result of] this.”

A growing demand for children’s online safety and privacy

The FTC began reviewing COPPA in 2019. It claims to have fielded over 175,000 comments from advertising and tech industry groups, content developers, consumer rights advocacy groups and members of Congress. Since then, the agency has developed a wide-ranging proposal to update the legislation. In its current form, the proposal is over 160 pages long.

Children’s data privacy and online safety are growing concerns of federal and state lawmakers in the US, too. In 2022, Senator Richard Blumenthal (D-CT) and Senator Marsha Blackburn (R-TN) introduced the Kids Online Safety Act (KOSA), a proposed law that would put stricter regulations on social media companies, requiring them to more rigorously police content and ensure its tools are designed to protect young users’ safety and wellbeing.

And in April of this year, a bipartisan group of federal lawmakers proposed the Protecting Kids on Social Media Act, a similar bill aimed at enhancing children’s safety on social media platforms by establishing new regulations around the spread of harmful content and limiting social apps’ potentially addictive features.

Senator Edward J. Markey (D-MA) and Senator Bill Cassidy (R-LA), who in May reintroduced COPPA 2.0, a proposed refresh of the nearly 25-year-old law, today signaled their support of the FTC’s effort. “This proposed update to the COPPA Rule is critical to modernizing online privacy protections for children and addressing Big Tech’s new tactics that exploit, track, and target kids online,” the lawmakers said in a joint statement.

They went on to say: “This reform could not come at a more important time. Experts, parents, and young people all agree that kids are being victimized by Big Tech’s voracious appetite for data. We commend the FTC for issuing this proposed rule and look forward to working to continue protecting young people’s privacy online.”

Members of the public have 60 days to submit comments on the proposed changes, after which the FTC will vote.

For more, sign up for The Drum’s daily newsletter here.