A federal law that limits companies' ability to collect data from children applies to businesses that gather data from connected toys and other devices, the Federal Trade Commission says.
The Children's Online Privacy Protection Act, which initially regulated data collection at Web sites, also "can apply to the growing list of connected devices that make up the Internet of Things," the FTC said in guidance issued last week.
COPPA generally prohibits operators of online sites or services aimed at children under 13 from collecting their personal information without parental consent -- though there are some exceptions. The FTC now defines personal information broadly, including names, email addresses and street addresses as well persistent identifiers like tracking cookies, IP addresses, device identifiers, geolocation data, photos and voiceprints.
That broad definition means that some IoT toys will automatically collect personal data when the device is activated, says Jeremy Goldman, a lawyer with Frankfurt Kurnit Klein & Selz's privacy and data security group.
"Every connected toy is going to have an IP address and a device identifier," Goldman says. He adds that as soon as a child turns on a connected toy, it might collect a persistent identifier.
Goldman adds that the FTC's guidance reflects the expansive nature of the children's privacy law. "The term online services is very broad and applies to everything connected to the Internet," he says.
While COPPA always requires operators of Web sites and services to obtain parental consent before collecting some kinds of information -- including names, email addresses and street addresses -- companies need not obtain parental consent before collecting some forms of persistent identifiers (like IP addresses) for operational purposes. Operational purposes can include analytics and security, Goldman says.
The FTC's new guidance comes six months after advocates raised concerns about the toys My Friend Cayla and i-Que Intelligent Robot, which allegedly conduct and store "conversations" with children. The Electronic Privacy Information Center, Campaign for a Commercial Free Childhood, Center for Digital Democracy and Consumers Union alleged in an FTC complaint that those toys "record and collect the private conversations of young children without any limitations on collection, use, or disclosure of this personal information."