• by Wendy Davis  @wendyndavis, March 12, 2024

A coalition of advocacy groups this week urged the Federal Trade Commission to issue tough new children's privacy rules, including one that would require web companies to obtain opt-in consent from parents at least twice before serving behaviorally targeted ads to children under the age of 13.

“Affording parents the choice to consent to the release of their children's data into the increasingly predatory data ecosystem is in line with COPPA’s original intent and addresses an ongoing problem,” Fairplay, the Center for Digital Democracy, Consumer Federation of America and other watchdogs say in 80-page comments submitted to the FTC.

The comments come in response to the FTC's proposed updates to regulations implementing the Children's Online Privacy Protection Act (COPPA), which prohibits website operators from knowingly collecting "personal information" from children under 13 without their parents' permission.

The FTC last updated the implementing regulations in 2013, when it defined “personal information” to include pseudonymous data that can link the children's activity across more than one site or app -- such as tracking cookies, device serial numbers and, in some cases, IP addresses.

Those 11-year-old rules effectively require companies to obtain opt-in consent from parents before sending children behaviorally targeted ads -- meaning ads selected based on data about children's activity across sites or apps.

A set of regulations proposed last year by the FTC would further restrict behavioral advertising by requiring a double opt-in from parents. First, web companies would have to obtain parents' consent to collect children's personal data, including data stored in pseudonymous identifiers. Next, companies would have to separately obtain parents' consent before sharing that data in order to serve children with behaviorally targeted ads.

The children's advocacy groups endorse this approach, arguing it would crack down on “unchecked data practices that target children and the harmful effects of predatory marketing.”

Ad organizations including the Association of National Advertisers oppose the proposed change, arguing that requiring parents to consent at least twice is unnecessary.

In addition to asking the FTC to toughen behavioral advertising rules, the advocacy groups say the agency should reconsider its approach to contextual advertising.

The current regulations allow companies to harness children's personal data -- including cookies and other identifiers -- in order to serve contextual ads. That term isn't defined in the children's privacy regulations, but was described in a 2009 FTC report as ads based on the content of a website a consumer is actively using.

Fairplay and the other groups essentially argue there's no reason for an advertiser to draw on children's personal data in order to serve contextual ads.

“This form of advertising is theoretically limited to keywords based on the content of a page, such as its words and images,” the groups write. “As soon as a so-called contextual ad is paired with a persistent identifier ... it becomes a form of data-driven advertising that should not, pursuant to COPPA’s core purpose, be conducted without parental consent.”

Consumer Reports, which filed separate comments, said it's reasonable to allow companies to use children's information to cap the frequency of contextual ads, but that businesses should obtain parental permission before drawing on children's data to target them with individual ads. 

That organization also said the FTC's current approach to contextual ads is ambiguous, and urged the agency to more clearly define “contextual advertising” and “behavioral advertising.”