Class 5

Internet Privacy Law

Children’s Privacy

Communications Decency Act (1996)

❖ Crime to knowingly:

❖ (A) uses an interactive computer service to send to a specific person or persons under 18 years of age, or

❖ (B) uses any interactive computer service to display in a manner available to a person under 18 years of age, any comment, request, suggestion, proposal, image, or other communication that, in context, depicts or describes, in terms patently offensive as measured by contemporary community standards, sexual or excretory activities or organs.

COPA not COPPA❖ Child Online Protection Act

(1998)

❖ COPA required all commercial distributors of "material harmful to minors" to restrict their sites from access by minors.

❖ "Material harmful to minors" was defined as material that by "contemporary community standards" was judged to appeal to the "prurient interest"

Here Comes COPPA

❖ Children’s Online Privacy Protection Act

❖ Originally designed to cover minors

COPPA

❖ It is unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under subsection (b) of this section.

When is it no longer a non-children’s site and a mixed-

audience site?

Can’t Collect IP Address

Computer

YouTube

Requested video + IP address

Steaming video

Forms of Parental Consent

❖ Providing a consent form to be signed by the parent and returned via U.S. mail, fax, or electronic scan

❖ Requiring the parent, in connection with a monetary transaction

❖ Having the parent call a toll-free telephone number staffed by trained personnel, or have the parent connect to trained personnel via video-conference

❖ Verifying a parent’s identity by checking a form of government-issued identification against databases

YouTube Terms of Use❖ 12. Ability to Accept Terms of Service

❖ You affirm that you are either more than 18 years of age, or an emancipated minor, or possess legal parental or guardian consent, and are fully able and competent to enter into the terms, conditions, obligations, affirmations, representations, and warranties set forth in these Terms of Service, and to abide by and comply with these Terms of Service. In any case, you affirm that you are over the age of 13, as the Service is not intended for children under 13. If you are under 13 years of age, then please do not use the Service. There are lots of other great web sites for you. Talk to your parents about what sites are appropriate for you.

FERPA

❖ A carrot approach to federal regulation of schools

❖ Gives parents access to child’s records

❖ Schools must have written permission from the parent or eligible student in order to release any information from a student's education record.

❖ Number of significant FERPA actions in 50 years = ZERO

FERPA Disclosure without Consent

❖ School official may access for “legitimate educational interest

❖ To another school in which the student seeks or intends to enroll

❖ Directory information

❖ others…

Delaware HB 261(1) Prohibit the online marketing and advertising of certain products and services to children under the age of 18 (2)  permit individuals to delete or request the deletion of content they posted online (either via a website or mobile application) as Minors, except in certain prescribed circumstances, and (3)  requires online operators to establish an age verification system “that can be reasonably expected to identify the age of the child who is a prospective or registered user.”

Advertising to minors

Not so simple an issue

Student Privacy Bills…

Not so simple

Industry Advertisers❖ DAA

❖ Third Parties or Service Providers should collect and use “personal information,” ... from children under the age of 13 as compliant with COPPA, unless such collection or use is otherwise exempted by COPPA.

❖ IAB❖ Entities should not collect “personal

information” ... from children ... or engage in Online Behavioral Advertising directed to children.

❖ NAI❖ The use of PII or non-PII to create an OBA

segment specifically targeting children under 13 is prohibited without verifiable parental consent.

California’s SOPIPA

❖ An operator shall not knowingly engage in“targeted advertising”

❖ “K–12 school purposes” means purposes that customarily take place at the direction of the K–12 school, teacher, or school district or aid in the administration of school activities, including, but not limited to, instruction in the classroom or at home, administrative activities, and collaboration between students, school personnel, or parents, or are for the use and benefit of the school.

Louisiana Law

❖ PERSONALLY IDENTIFIABLE STUDENT INFORMATION

❖ Name, any information that is linked or linkable

❖ No…school system shall provide personally identifiable student information to any member of the school board or to any other person or public or private entity…

Who is CARU?❖ CARU reviews and evaluates advertising

for truth, accuracy, appropriateness and sensitivity to children’s still developing cognitive abilities.

❖ Advertisers have special responsibilities when advertising to children or collecting data from children online.

❖ They should take into account the limited knowledge, experience, sophistication and maturity of the audience to which the message is directed.

Industry Self-Reg Working Together

❖ Broadcast advertising for “Iron Man 3,” rated PG-13 for “sci-fi action violence, and brief suggestive content” aired on the program “SpongeBob,”

❖ A referral agreement between MPAA and CARU if CARU finds an advertisement for a film rated PG-13, R or NC-17 in any medium primarily directed to children under 12

❖ MPAA reviewed issue and found that the TV spots at issue for “Iron Man 3,” did not contain strong depictions of violence or sexuality

Spam-Blocking

❖ Both AOL Mail and Yahoo! Mail have a 99.9% effectiveness at blocking spam emails. ❖ This means that for every

1,000 spam emails sent only email arrives in a users’ inbox.

❖ AOL receives approximately 4 billion email delivery attempts per day of which AOL outright blocks 3.5billion or 87%. ❖ This is email that never gets

delivered to the recipient.

Example of CARU Case – Link Snacks

❖ Visitors to the homepage are invited to join the “Jack Pack,” and initially must enter their email. They are then directed to a registration page.

❖ There, they must enter a first name, last name, email address, and answer a series of questions such as “What’s your dream job,” which they respond to via drop down menus.

❖ The website came to the attention of CARU through its routine monitoring practices.

❖ The operator agreed to implement a neutral age-screening process, along with a session cookie so that children under 13 cannot change their birthdate when they are unable to register.

Example of CARU Case – Build-A-Bear

❖ Build-A-Bear website had Pinterest and Twitter functionality.

❖ CARU recommended installing a neutral age-screening mechanism at the site and eliminate links to Pinterest and Twitter that do not age screen.

❖ The company said that a session cookie designed to prevent visitors from circumventing the age-screening process had been inadvertently overwritten and had since been restored.

❖ Further, the company said it would remove links to Twitter and Pinterest from the site’s front page.