Facebook filed a 22-page letter with the Federal Trade Commission outlining its thoughts and recommendations for the commission’s proposed changes to the Children’s Online Privacy Protection Act (COPPA).
The social network lauded the FTC’s commitment to protecting children’s online experiences and privacy, but expressed concern about some language in the proposed change, which could hold Facebook liable in cases where third-parties use its social plugins and create additional burdens for Facebook, developers, publishers and parents. In particular, Facebook urged the commission to explicitly allow first-party advertising as an acceptable use of a child’s “persistent identifier,” such as an IP address or cookie ID.
The FTC is proposing that COPPA be expanded to apply to apps, games and online ad networks, in addition to the child-directed websites it currently covers. Some language in the proposal would deem website publishers and developers that use plugins like Facebook Login or the Like Button as “co-operators” with Facebook. Facebook Chief Privacy Officer Erin Egan, who wrote the letter to the FTC, suggests that the language in the proposal “fundamentally misunderstands the relationship between plugin providers and website publishers.” The social network, for example, makes plugins available but doesn’t choose which websites use them, which plugins they use or how they use them. Neither does Facebook share data with the third-parties that use its plugins. As such, the company wants to ensure that it would not be held liable under COPPA for offenses by web publishers or app developers that integrate with its platform.
The FTC proposal makes some exceptions for collecting and using children’s information as needed for “support for internal operations.” Facebook requests that the FTC clarify its definition of “support for internal operations” to include data captured by plugins and to explicitly include activities that do not impact children’s privacy, such as first-party advertising. The letter cites the commission’s previous reports that distinguish first-party advertising from third-party advertising because it does not raise the same privacy concerns and is generally an expected part of free websites and online services.
Egan further recommends that COPPA not include language that requires operators of child-directed sites to “treat all users as children” and obtain parental consent even if they otherwise have knowledge that a user is 13 years or older. For example, if a user has signed up for Facebook, the user has verified that they are over 13 by providing a birthdate. Egan says this should apply to third-party sites that integrate plugins without requiring additional consent or age verification. “It would be nonsensical to require an operator to obtain verifiable parental consent before collecting information from a parent,” Egan writes.
As we’ve previously written about, Facebook could ultimately serve as a means for age verification all around the web. In its letter, the company suggests that the commission could add explicit clarification that publishers can use a common mechanism to obtain verifiable parental consent, as Microsoft, Disney and a number of organizations have suggested in their comments to the FTC. Doing this, Egan writes, would minimize the burden on parents by reducing the number of times they have to give consent and eliminate the need for multiple detailed privacy notices. Instead, parents could give consent and get notice up front. They would then then get a more specific notice when a child wants to play a game or use a new app. If a platform provides this ability, Facebook argues, it should not assume liability or turn the platform into a “co-operator” with third-party apps or websites that implement it.
The Wall Street Journal reported in June that Facebook was taking steps toward allowing children under 13 to be allowed on the site, including creating mechanisms that would connect children’s accounts to those of their parents. Facebook has not publicly shared whether it is planning to lower its age limit or how it would do so.