FTC Proposes Revisions to Children’s Online Privacy Protection Act

The Federal Trade Commission (FTC) released a Notice of Proposed Rulemaking (“NPRM”) on December 20, 2023 that proposes changes to the Children’s Online Privacy Protection Act Rule (“COPPA Rule”). COPPA, in effect since 2000, governs the online processing of children’s personal data and prohibits website operators from collecting personal data from children who are under 13 years old without their parents’ verifiable consent.

The NPRM is part of an ongoing review the FTC started in 2019 to update the COPPA Rule and enact new restrictions on the use and disclosure of children’s personal data as well as further limit website operators’ ability to condition access to their services on monetizing children’s personal data. If the FTC approves these changes, it would mark the first major update to COPPA since 2013.The FTC’s intent behind the NPRM is to respond to changes in technology and online practices, to strengthen the FTC’s protection of personal information collected from children, and to clarify and streamline the COPPA Rule. The FTC seeks comment on an array of potential changes, including:

1. Targeted Advertising: Requiring distinct parental consent for any children’s personal data to be disclosed to third-party advertisers by website operators.
    
2. Data Security: Requiring website operators to create an information security program and procedures specifically for children’s data that they collect and process.
    
3. Data Retention: Prohibiting children’s personal data from being used for secondary purposes, and requiring website operators to draft a retention policy specifically for children’s personal data. 
    
4. Nudging: Implementing rules that would prohibit website operators from using children’s personal data to send push notifications that would encourage them to stay online.

The FTC has requested comments on the proposed changes which are due March 11, 2024. Paul Hastings attorneys will continue to monitor these and other developments as we support our privacy and cybersecurity clients. If you have any questions, please do not hesitate to contact any member of our team.