NetChoice filed comments yesterday with the Federal Trade Commission on its current review of the Children’s Online Privacy Protection Act (COPPA).
We focus our response to the request for comments in four specific areas, and ask that the Commission:
1. Maintain the current age threshold at twelve years and under
2. Retain the “actual knowledge” standard
3. Clarify that states may not enact laws that conflict with COPPA
4. Conclude that geolocation & IP Address data are not individually identifiable information, and that COPPA already applies to the mobile Internet.
Regarding the second point, COPPA applies when a website is directed to children. But COPPA also applies when a website operator that has “actual knowledge that it is collecting personal information from a child” from children 12 and under. In any new COPPA rules, the Commission should maintain a strict construction of what it means to have “actual knowledge” and apply COPPA when website operators know in-factthat they have collected information from children.
The COPPA rule does not define “actual knowledge.” Generally, it is viewed as a heightened requirement for a mental state of possessing information. In the context of COPPA, “actual knowledge” would apply when a site learns a child’s age by asking for and receiving information from which it can determine age.
The “actual knowledge” standard is an important one for continued innovation on the Internet and for the future of user-generated content. It ensures that only culpable actors—sites that know they’re collecting information on children—are held liable for violating COPPA. At the same time, it prevents regulators from piecing together bits of information and determining on their own that a site should have known it was collecting information from children.
At the Commission’s COPPA Rule Review roundtable, we heard panelists describe how Congress initially considered a lower “knowingly” standard. This standard would have imposed a “should’ve known” obligation. A “knowingly” standard is more akin to a “constructive knowledge” standard, not actual knowledge. It would burden websites into mining data, to be sure that they would not be accused that they should’veknown.
COPPA compliance should not be a matter of shoulda, woulda, coulda. The Commission should reinforce its commitment to enforce the actual knowledge standard in ways that will not innocently trip up website operators.
-Braden Cox