Risk
7/2/2013
06:58 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Child Privacy Online: FTC Updates COPPA Rules

Children's Online Privacy Protection Act of 1998 expands to regulate behavioral tracking, plus geolocation data, photos, videos and audio recordings made by kids under 13.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
The Federal Trade Commission said this week that revised rules for the Children's Online Privacy Protection Act of 1998 (COPPA) have taken effect.

COPPA, which the FTC enforces, prohibits anyone from knowingly collecting personal information on children under the age of 13, without first obtaining their parents' verifiable consent. COPPA also requires sites to post clear, complete and accessible privacy policies, and to secure any children's information they collect. The rule first went into effect in 2000.

"At the FTC, protecting children's privacy is a top priority," said FTC chairwoman Edith Ramirez in a statement. "The updated COPPA rule helps put parents in charge of their children's personal information as it keeps pace with changing technologies."

Since COPPA was first written, notions of what constitutes an online site or service, as well as data collection practices, have evolved substantially, not least due to the rise of mobile computing and social networking. Also relatively new is behavioral tracking, which can record what users do across multiple sites.

[ Should search engines be held responsible for listing harmful websites? Read Google Launches Attack On Online Child Pornography. ]

On the latter front, the new final rule amendments to COPPA now "make clear that the rule covers an operator of a child-directed site or service where it integrates outside services, such as plug-ins or advertising networks, that collect personal information from its visitors."

The revision also updates the FTC's definition of personal information "to include geolocation information and persistent identifiers that can be used to recognize a user over time and across different websites or online services," as well as photos, videos and audio recordings. That said, COPPA also relies on children self-reporting their age, and exonerates businesses that don't provide notification or obtain parental consent if a child reports his age is 13 or above.

Before the new rules took effect, the FTC already had signaled that COPPA applied not only to websites, but also smartphone apps and the greater mobile and advertising ecosystem. In 2011, for example, the FTC filed its first-ever smartphone-related COPPA complaint, against W3 Innovations, as well as its owner and president. The agency charged them with failing to comply with COPPA's parental notification and consent requirements. According to the complaint, W3 -- developer of such iOS titles as "Emily's Dress Up and Shop," "Santa's Run" and "Zombie Duck Hunt" -- also "allowed children to publicly post information, including personal information, on message boards."

Which businesses must comply with COPPA? To help organizations answer that question, the FTC released "A Six-Step Compliance Plan for Your Business" guide. The agency also maintains a "COPPA hotline" email address, COPPAHotLine@ftc.gov, to field businesses' related compliance questions.

The FTC is also continuing five safe-harbor programs that assess business's COPPA compliance, now based on the updated rules.

"Under COPPA, safe harbor status allows certain organizations to create comprehensive self-compliance programs for their members," said the FTC in a press release. "Companies that participate in a COPPA safe harbor program are generally subject to the review and disciplinary procedures provided in the safe harbor's guidelines in lieu of formal FTC investigation and law enforcement."

Such safe-harbor programs are offered by Aristotle International, the Children's Advertising Review Unit of the Council of Better Business Bureaus, ESRB Privacy Online, Privo and TRUSTe.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2008-3277
Published: 2014-04-15
Untrusted search path vulnerability in a certain Red Hat build script for the ibmssh executable in ibutils packages before ibutils-1.5.7-2.el6 in Red Hat Enterprise Linux (RHEL) 6 and ibutils-1.2-11.2.el5 in Red Hat Enterprise Linux (RHEL) 5 allows local users to gain privileges via a Trojan Horse p...

CVE-2010-2236
Published: 2014-04-15
The monitoring probe display in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 4.0.0 through 4.2.0 and 5.1.0 through 5.3.0, and Proxy 5.3.0, allows remote authenticated users with permissions to administer monitoring probes to execute arbitrary code via unspecified vectors, rela...

CVE-2011-3628
Published: 2014-04-15
Untrusted search path vulnerability in pam_motd (aka the MOTD module) in libpam-modules before 1.1.3-2ubuntu2.1 on Ubuntu 11.10, before 1.1.2-2ubuntu8.4 on Ubuntu 11.04, before 1.1.1-4ubuntu2.4 on Ubuntu 10.10, before 1.1.1-2ubuntu5.4 on Ubuntu 10.04 LTS, and before 0.99.7.1-5ubuntu6.5 on Ubuntu 8.0...

CVE-2012-0214
Published: 2014-04-15
The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0.8.11 through 0.8.15.10 and 0.8.16 before 0.8.16~exp13, when updating from repositories that use InRelease files, allows man-in-the-middle attackers to install arbitrary packages by preventing a user fro...

CVE-2013-4768
Published: 2014-04-15
The web services APIs in Eucalyptus 2.0 through 3.4.1 allow remote attackers to cause a denial of service via vectors related to the "network connection clean up code" and (1) Cloud Controller (CLC), (2) Walrus, (3) Storage Controller (SC), and (4) VMware Broker (VB).

Best of the Web