• by Wendy Davis , Yesterday

As states continue to pass new laws aimed at protecting minors online, the Interactive Advertising Bureau is proposing a "framework" that would involve requiring businesses to obtain teens' consent before serving them with personalized ads.

"IAB recognizes there are legitimate concerns about privacy and other risks associated with digital advertising when children and teens’ personal data are involved," the IAB writes in the new report titled "Protecting America's Youth: A Modern Framework for Modernizing Children's Privacy Law."

A spokesperson says the IAB is not calling on Congress to enact new legislation, but is instead "providing a framework for policymakers as they consider legislation to protect teen and child privacy."

The report recommends implementing what the IAB calls "protections in connection with digital advertising."

Those protections include "requiring opt-in teen consent for targeted advertising to minors between 13 to 15, with parental notification," and "requiring opt-in teen consent for targeted advertising to minors from 16 to 17." (The report essentially defines targeted advertising as ads based on data collected over time and across unaffiliated websites or apps.)

The group also recommends continuing to require opt-in consent from parents before serving targeted ads to children under 13.

Since 2013, the Federal Trade Commission has prohibited web companies from knowingly collecting ad-targeting data from children 12 and younger without parental consent.

"A minor’s need for protection is greatest where capacity is lowest, and risk is highest, and it recedes as capacity matures," the IAB writes. "A young child cannot recognize advertising as advertising, cannot understand that data is being collected about them, and cannot appreciate the value exchange that funds the services they use. An older teenager can do much of this, approaching adult-like understanding."

The group adds that its proposed approach "protects those least able to protect themselves without treating a sixteen-year-old as if they were six."

The report comes as Congress is considering new laws regulating data, and as states have already passed such laws.

For instance, in March the Senate passed the Children and Teens’ Online Privacy Protection Act (COPPA 2.0), which would prohibit website and app operators from knowingly serving targeted ads to users under 17.

Earlier this month, the House also passed a version of that bill -- but as part of a larger package that is seen as unlikely to advance in the Senate.

States are taking a variety of approaches. Some, including Maryland and Connecticut, have completely banning targeted advertising to minors under 18, while others have set different age limits, or allowed targeted advertising to teens who consent.

The IAB says the patchwork of laws creates "overlapping and sometimes inconsistent compliance obligations, raising costs and legal uncertainty for businesses operating outside a single state," adding that it supports "standardizing age ranges" for restrictions on the use of data for ad targeting.

The IAB also proposes that an opt-in consent requirement should be triggered by companies' "actual knowledge" of users' ages, and opposes imposing liability on companies that "should have known" a particular user's age and fail to obtain consent.

A should-have-known standard does not adequately "inform businesses as to what will trigger liability," the group argues, adding that such a standard "may lead companies to implement stricter approaches to avoid liability, thus unfairly burdening adult consumers as well as industry more broadly."