Senators: 'Net Privacy Law for Children in Need of Overhaul
May 1, 2010
Speaking before a Senate Commerce Committee hearing, Chair Jay Rockefeller (D-WV) warned that Congress needs to take a "hard look" at whether the nation's privacy law for children on Internet sites "should be updated to cover new kinds of information and new businesses." Rockefeller was referring to the Children's Online Privacy Protection Act (COPPA), which requires websites to obtain parental approval before gathering or using personal information about kids younger than 13.
Senators and witnesses debated whether COPPA's age limit should be raised to 18, as well as the confidentiality of GPS data identifying the immediate location of youngsters.
"I'm interested in all witnesses' thoughts regarding the appropriateness of the statute's age limit," declared the subcommittee's chair Mark Pryor (D-AR), "what constitutes children's 'personal information', how parental consent is best achieved; and how operators maintain the confidentiality and security of the information they do collect—when authorized—about children."
Amen, declared Rockefeller. "We passed COPPA, but the whole world has changed since that happened. Some online technologies that are nearly ubiquitous today did not even exist a few years ago," he explained, "Accessing these websites, whether they are well-known and popular or outright illegal, have enormous privacy implications that I fear parents are unaware of, and I know children do not understand."
The meeting came just days after three Senators sent an open letter to Facebook protesting the social networking sites' privacy policies, especially its automatic opt-in practices for user data. Facebook attended the hearing, as did Microsoft. But Rockefeller took a long whack at several companies that did not.
"I do not appreciate the fact that Apple and Google are not here," he angrily declared. "And I'm curious as to why they're not. Was it too expensive to send an associate legal counsel? When people don't show up when we ask, I have this power of subpoena which I would absolutely love to use. All this does is increase our interest in what they're doing and why they didn't show up. They made a stupid mistake by not showing up and I say shame on them."
The big guns on Commerce are clearly threatening updates to the law. Amy Klobuchar (D-MN) declared her intention to "work on this rule and make changes that are in the best interest of everyone," while Pryor warned that "the disclosure of personal information by young people is prevalent." Thus, the main question at the hearing was what kind of changes should be made.
Passed in 1998, COPPA requires websites to publicly disclose the kinds of information they collect from children, get "verifiable parental consent" for doing so, offer parents access to the data, and keep the information secure. Rockefeller was particularly partial to the testimony of Mark Rotenberg, Executive Director of the Electronic Privacy Information Center, who suggested two revisions—first, expand the range of Personally Identifiable Information covered by the law to include location data gleaned via mobile tracking software.
Second, Rotenberg urged the Senate to extend the COPPA age requirement to 18. If Congress doesn't act on this recommendation, privacy problems will only get worse, he warned:
"Not only will companies that target young teens gather more data, their business practices will become increasingly more opaque and more difficult for users to manage. We have seen just in the last few years how companies such as Facebook have found that they can manipulate privacy settings and change privacy policies to coax personal information out of users who had earlier made clear which information they would reveal and which information they would keep private."
Facebook's Director of Public Policy Timothy Sparapani brought a very difficult perspective to the hearing, of course, arguing that the social networking sites' distinctly un-anonymous "real name" culture offers a host of benefits for teens. Facebook, Sparapani told the Senate, was the first big Web service to require public names.
"Before Facebook, the common wisdom was that Internet users should avoid using their real names and sharing information online," he explained. "Facebook was the first major web service that required people to build their profiles and networks using real names, and provided them with privacy tools to enable them to decide who could access that information. This important policy and technical architecture decision not only allowed Facebook users to become more connected, but also made the site safer. A culture of authentic identity made Facebook less attractive to predators and other bad actors who generally do not like to use their real names or email addresses."
Real name accountability on Facebook regularly deters bad behavior like harassment and cyber bullying, Sparapani told the senators. And it has allowed the site to function as a resource for peers to combat suicide and to help identify runaways. In addition, Facebook software puts controls on the extent that kids from 13 through 18 can link with adults. "This limitation substantially reduces the visibility of minors to non-minors whom they do not know."
Obviously, extending COPPA to 18 would be a huge issue for Facebook, which currently blocks users who identify themselves as 13 or younger from registering with the site.
"Although we are not a service that is directed at children less than 13 years of age, we have built our service, policies, and tools with COPPA in mind," Sparapani concluded. "Our experience tells us that Congress need not amend COPPA at this time. In fact, any amendments might undo many of our innovative privacy and safety tools."
But critics of Facebook at the hearing seemed less worried about Facebook's laudable anti-cyber bullying and suicide policies, and more concerned with the ways that the company shares or could share user data with advertisers and application makers. That's why the Federal Trade Commission is running a rule review proceeding on how to update implementation of COPPA.
Among the questions the agency asks are whether website operators "have the ability, using persistent IP addresses, mobile geolocation data, or information collected from children online in connection with behavioral advertising, to contact specific individuals, and whether the COPPA Rule’s definition of 'personal information' should be expanded accordingly."
There was also some fretting at the hearing about the fact that kids way below 13 manage to get at these sites anyway.
"We know that our young children are using the Internet now more than ever before," noted Senator Pryor. "And we know they represent a large portion of total online activity," he added, citing a report indicating that children aged two through 11 take up almost 10 percent of "active online space."
This made a big impression on Senator Rockefeller.
"I'm shocked," he declared. "Absolutely shocked that children from two to the age of thirteen—which is totally irrelevant. Children are children up until the age of 25 or something. Aren't they? It's ridiculous."