FTC Proposes Additional Changes To COPPA Rule; Initiates Further Round Of Public Comment

Instead of revealing the long-anticipated final revisions to its rule relating to the Children's Online Privacy Protection Act (COPPA), the Federal Trade Commission last week proposed additional changes to the Rule, as a result of the overwhelming commentary it received to the revisions it proposed last fall (read our September 2011 alert on those proposed changes), and initiated another round of public comment. In its Aug. 1, 2012, Notice of Proposed Rulemaking, the Commission proposed modifications to several definitions in the Rule, including "operator" and "website or online service directed to children" that, if enacted, would clarify that providing the protections required by COPPA is the responsibility of both the entities operating child-directed websites and the third-party services, such as advertising networks, that collect information through those sites. The proposed revisions would also alter the way in which websites with content that attracts a mixed-age audience would be required to comply with COPPA requirements, and redefine "personal information" to include screen or user names, and persistent identifiers, subject to specific exceptions. Because the proposed revisions diverge from those it initially proposed in September 2011, the FTC is not making final amendments to the Rule, but rather is seeking another round of public comments.

Under the current form of the Rule, the responsibility for providing the required notice to parents and obtaining parental consent to the collection of personal information from children rests with the third party collecting information, such as an advertising network or provider of downloadable software - known as "plug-ins" - not with the website operator that allows these third parties to collect information, as long as the operator does not own, control or have access to the information collected. The FTC proposes modifying the definition of "operator" in the Rule to state that personal information is "collected or maintained on behalf of" an operator where it is collected in the interest of, as a representative of, or for the benefit of, the operator. As a result, an operator of a child-directed site or service that allows or integrates the services of third parties that collect personal information from its visitors would be considered a covered "operator" under the Rule.

The Commission's concurrent proposed revision to the definition of "website or online service directed to children,"...