Federal Privacy Bill Sets Up Confusion Over Using Kids’ Data

A federal privacy bill reshaping decades-old standards for how companies treat the data of minors would force companies to take a more holistic approach to their compliance programs.

The measure, called the “American Privacy Rights Act” or “APRA,” was approved by a House subcommittee Thursday. APRA combines proposed updates to the Children’s Online Privacy Protection Act (COPPA) and a comprehensive privacy bill discussion draft, in a recalibration of Congress’s recent focus on children’s privacy.

If the bill becomes law, practitioners and privacy professionals will have to consider how kids and teens’ privacy fits into their comprehensive consumer privacy programs, rather than standalone COPPA protections, said Sara Kloek, vice president for education and children’s policy for the Software & Information Industry Association.

Key Provisions

Specific mandates in the bill would require companies to:

• Treat all data collected from or about minors as “sensitive,” triggering consent requirements before collectors could share data with third parties
• Collect only the data necessary to provide services
• Ban targeted advertising at children younger than 17
• Bar education technology providers from using data collected from minors for non-educational, commercial purposes

Determining which data belong to a covered minor while complying with the data minimization requirements could prove difficult, said Bailey Sanchez, senior counsel with the Future of Privacy Forum.

“As far as compliance goes it opens up whole new problem for age information and age assurance,” said Amy Lawrence, chief privacy offer and head of legal at SuperAwesome Inc., a marketing platform targeting youth audiences. “How do you deal with a strict bar of processing a minor’s IP address? You would have to know everyone’s age.”

Compliance Challenges

Attorneys also pointed to compliance challenges posed by language in the bill that’s unclear. For example, while it would expand COPPA to cover data collected “about” a minor, not just from them, it doesn’t define what that includes.

“There’s a lot of stuff that’s about a kid that might not be collected from them,” SIIA’s Kloek said, adding it would be difficult to build a compliance program without more specifics. Kloek speculated the “about” data could include a child’s photo posted by a parent.

The lack of a knowledge standard in the bill could also raise uncertainty for companies. The bill’s vagaries could raise questions about liability in situations when companies don’t know if a user is a minor. Websites could be incentivized to produce more invasive forms of age verification in the spirit of compliance, said SuperAwesome’s Lawrence.

Enforcement

The Federal Trade Commission (FTC), which already enforces existing children’s privacy rules, would take the lead on enforcing APRA, alongside state attorneys general.

The bill leans into the FTC’s role, adopting in places restrictions that mirror agency enforcement actions, said Kloek. The FTC expressed a desire to codify restrictions during its most recent rulemaking to update its COPPA rule. A final rule is expected in the coming months.

APRA also takes aim at growing concerns with the potential harms of algorithm-driven platforms to children. Lawmakers say that kids will benefit from requiring stricter requirements, including impact assessments, for covered algorithms. That could put it at odds with state efforts to rein in harmful design practices, experts say.

“There are open questions as to whether it would preempt the design codes,” said Sanchez. “This is about data. Design codes go broader than that.”