Privacy Update for Child and Teen Advertising

June 26, 2024

Julia Tama, partner at Venable LLP, Nur-ul-Haq, SVP of global privacy and kids' compliance at Paramount Global, and Sheena Thomas, managing counsel, privacy at Adobe Systems discussed the latest enforcement actions, regulatory developments, and state laws that impact advertising to children and teens.

The discussion included how proposed changes to the federal Children's Online Privacy Protection Rule may impact advertising, the trend in expansion of child privacy protections to teens, and considerations for using artificial intelligence or machine learning for advertising purposes.

Key Takeaways

Children's Online Privacy Protection Act (COPPA) is a federal law on the collection, use, and disclosure of personal information online from children under 13. The law, as the speakers discussed, not does apply to the following:

Information collected from teens or adults (13 and older)
Information collected from adults about children
Information collected offline
Interpreted and enforced by the Federal Trade Commission (FTC)
State attorneys general also can and do enforce COPPA

Businesses may come into contact with children in two ways: the product or online properly is targeted to children under 13 or the business knows it is collecting data from users of another website or app that is child-directed.

To comply with COPPA, companies need to do the following and/or keep in mind as standards and touchpoints change, besides obtain verifiable parental consent:

Parental consent is not a "blank check."
Do not retain information beyond the purposes for which you collected the information (or otherwise have consent).
Delete information from all system locations if you do not have consent or have received a deletion request.
Do not use improperly retained information to feed training sets for internal purposes, like product development.
The FTC has signaled a desire to enforce areas of the COPPA Rule beyond parental consent.
Information from a known child under 13 is defined as "sensitive data." Many states with comprehensive privacy laws now require parental consent before businesses can "process" sensitive data about children. Some may require consent for targeted ads, geolocation data, and may even apply to offline collection.

When it comes to teenagers, some states require content regarding data, including:

Getting consent from a teen user, which New Jersey will extend this requirement to users up to age 16, Delaware for users up to age 17, and Florida for everyone under 18.
Colorado, in particular, requires that data for anyone under 18 have additional requirements, such as default privacy settings.
California limits what can be advertised on properties where minors may go, such as for BB guns, UV tanning, and aerosol paint.

When it comes to AI and machine learning, privacy laws still exist although are constantly evolving. The speakers noted that the FTC has provided blog guidance that rewriting privacy notices to allow use or sharing of data for training may be deceptive.

Leslie Fair of the FTC, in a document provided by the speakers, noted that "the FTC is considering requiring separate opt-in consent for third-party disclosures. Businesses would have to get parents' separate verifiable consent to disclose information to third parties, including third-party advertisers, unless the disclosure is integral to the nature of the website or online service. That means COPPA-covered companies' default settings would have to disallow third-party behavioral advertising and allow it only when parents expressly opt in."

CLE Materials

Source

"Privacy Update for Child and Teen Advertising." Julia Tama, partner at Venable LLP; Nur-ul-Haq, SVP of global privacy and kids' compliance at Paramount Global; Sheena Thomas, managing counsel, privacy at Adobe Systems, Inc. ANA Advertising Law 1-Day Conference, 6/26/24.

You must be logged in to submit a comment.