Partners Michael P. Canty and Carol C. Villegas and Law Clerk Danielle Izzo are authors of the analysis "Assessing 3 Bills to Expand Kids' Online Protections in 2022," published by Law360 on February 2, 2022.
Data privacy issues dominated law and politics in 2021.
Major data breaches plagued corporations including Colonial Pipeline Co., Microsoft Exchange and Twitch Interactive Inc.1
The public became aware of internet tracking, in part due to Apple Inc.'s software update providing App Tracking Transparency, which allows users to opt out of app tracking.2
The Wall Street Journal investigated Meta Platforms Inc., formerly known as Facebook Inc., publishing "The Facebook Files,"3 and Big Tech faced damaging whistleblower accusations.4
Alongside these events, the U.S. Senate conducted several technology-focused hearings.
First, Antigone Davis, Meta's global head of safety, testified about Facebook's internal knowledge related to Instagram's effect on children.5 6
Later, whistleblower Frances Haugen also testified in front of the Senate about Instagram's effect on children,7 and urged lawmakers to take action.8
Additionally, Snap Inc., TikTok Inc. and YouTube Inc. testified about the privacy protections in place on their platforms, or the lack thereof.9
A variety of proposals were submitted in an attempt to effectuate change. As the new year begins, the key question is: Will this pending legislation change the state of data privacy law in 2022?10
Website and social media operators have enjoyed legal immunity while children have suffered, having sensitive personal information collected and experiencing detrimental psychological effects stemming from the platforms.
Last year's events highlight that Big Tech has gone too far. It is time for the technology industry to be policed. This article assesses three proposed pieces of legislation aimed at expanding protections for children online that may reshape the technology industry this year.
Proposed COPPA Amendment
The Current Version of COPPA
The Children's Online Privacy Protection Act is an existing Federal Trade Commission rule governing website operators with users under 13.11 Among other requirements, websites may only collect personal data from children with parental consent.12
Unfortunately, COPPA has been ineffective and underenforced.13 Website operators circumvent the requirements by claiming they were not aware of children's presence on their platform to evade liability.14 In fact, merely posting that users be over 13 is sufficient to absolve website operators of liability, even where data is collected from minors.15
The Proposed Amendment
In response to these compliance concerns, Sens. Ed Markey, D-Mass., and Bill Cassidy, RLa., proposed a COPPA amendment on May 11, 2021. The amendment would expand COPPA protections by:
- Including children up to 15 under the law's purview;16
- Lowering the "actual knowledge" standard to constructive knowledge;17
- Banning targeted advertising to minors;18
- Requiring a deletion feature allowing minors to delete personal information previously collected;19
- Imposing labeling requirements to provide detailed disclosures concerning the type of personal information collected from minors on each platform;20 and
- Creating a Youth Marketing and Privacy Division of the FTC to regulate online marketing directed at minors.21
What to Expect
If passed, the amendment would meaningfully expand online protections for minors.
The lower constructive-knowledge standard would finally hold website operators accountable to the minors that access their platforms. By increasing potential liability, web platforms would be forced to implement long-overdue age verification systems, because merely posting an age limit will no longer suffice.
Companies will be required to make a choice in order to comply with the amendment: either (1) implement and enforce stringent age verification systems, differentiating between practices allowed for adults and prohibited for minors, or (2) completely cease data collection across the board.
Both options make meaningful strides in creating more effective safeguards for children on the internet. In either case, the way the public accesses internet-connected devices would be forever changed.
Equally significant is the amendment's total bar on targeted advertising directed at minors. Again, website operators will be obligated to decide whether to cease targeted advertising across the board, or to develop and implement new tactics to ensure that ads are not being directed to minors based on their personal data.
The amendment could create two internet systems—a system for minors, where personal data is protected from invasive data collection and targeted advertising, and a system for adults, where web operators can continue with business as usual.
This divergence is likely to raise difficult questions for website operators. If targeted advertising can be eliminated for children, why not eliminate it across the board?
KIDS Act
The Components of the Act
The Kids Internet Design and Safety, or KIDS, Act was proposed on Sept. 30, 2021, by Markey; Sen. Richard Blumenthal, D-Conn.; and Rep. Kathy Castor, D-Fla. The goal of this act is to reduce the harms of algorithms and targeted marketing.22
This act would expand internet protections to minors up to 16. These protections would include:
- A lower standard, constructive knowledge, for liability;23
- A ban on certain interface elements or functional aspects of platforms directed to children;24
- Limitations on the scope of algorithms;25 and
- Regulations on content, prohibiting sexual, violent, unlawful or unrecognizable commercial content, and advertisements for tobacco and nicotine products.26
What to Expect
Aside from imposing new regulations, the KIDS Act will require website operators to completely change the operating features of its platforms, such as alerts, engagement and autoplay features. This would bring about essential change given the harmful effects that likes, follower counts and streaks have on minors.27
The act would also require an overhaul of the algorithms used to operate these platforms. App developers and web operators will become responsible for the content amplified by algorithms, reducing the expansive shield from liability online platforms currently hide behind.
Developers will have to ensure that algorithms are not promoting sexual, harmful or unlawful conduct to minors, a complete change from the existing responsibility for algorithms.
In addition to implementing extensive changes to the core operational features of apps and websites, the KIDS Act prohibits recommending content that includes influencer marketing to minors.28
This change would serve as a positive step toward addressing the FTC's concerns regarding deceptive advertising in influencer marketing.29 Children are particularly at risk of falling prey to unfair or untrue advertisements.30
The act would treat online advertisements for tobacco and nicotine products similarly.31
EARN IT Act
The Components of the Act
On March 5, 2020, the Eliminating Abusive Rampant Neglect of Interactive Technologies, or EARN IT, Act was proposed by Sens. Lindsey Graham, R-S.C.; Josh Hawley, R-Mo., Dianne Feinstein, D-Calif.; and Blumenthal. The act was reintroduced on Feb. 1.
The underlying aim of the EARN IT Act is to scale back Section 230 of the Communications Decency Act, which insulates interactive computer services from liability for content published on platforms by third parties.32
This effort to reduce Section 230 protections comes from concerns about the breadth of the provision and its potential to absolve website operators from all liability.33
The key to this proposed legislation involves the creation of a committee that would develop rules to govern website operations, referred to as the National Commission on Online Child Sexual Exploitation Prevention.34
These regulations will likely cover content that may be shown to minors and the methods for collecting data from minors online.35
This act is intended to be closely tied to Section 230 of the CDA by requiring website operators to abide by the committee's rules in order to earn Section 230 immunity.36 Accordingly, failure to comply with the established rules would jeopardize and reduce any available Section 230 protection.
Much of this power will be left to the proposed committee. However, the proposed legislation does recommend that the proposed agency consider a few key topics in developing a set of best practices and regulations. These recommendations are largely focused on expanding efforts to eliminate human trafficking and child sexual exploitation online.
This includes, for example, "preventing, identifying, disrupting, and reporting online child sexual exploitation," and "receiving and triaging reports of online child sexual exploitation by users of interactive computer services, including self-reporting."37
What to Expect
While the full scope of the requirements that will be tied to Section 230 immunity are not currently known, we do know for certain that this act will lead the charge in policing conduct in the tech space.
For the first time, the industry will face broad liability without the guaranteed protections of the CDA.38 Tech companies will be forced to implement meaningful, lasting changes in order to achieve the level of immunity that was once automatically granted.
Full development of this proposed agency and its checkpoints may take years, but the passage of the EARN IT Act alone would call for immediate, anticipatory action by companies to take steps to protect user data and privacy.
Conclusion
This proposed legislation, paired with the public spotlight placed on Big Tech in 2021, has set the stage for long-overdue changes to the internet in 2022. Any one of these proposed acts has the potential to create a kid-friendly internet, affording much needed protections to minors and their personal information.
Michael P. Canty and Carol C. Villegas are partners, and Danielle Izzo is an associate, at Labaton Keller Sucharow LLP.
The opinions expressed are those of the author(s) and do not necessarily reflect the views of the firm, its clients or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.