• by Wendy Davis  @wendyndavis, December 20, 2023

The Federal Trade Commission on Wednesday proposed new restrictions on companies' ability to use behavioral advertising techniques to serve ads to children under 13.

The proposal effectively would require operators of websites and apps to obtain opt-in consent from parents at least twice before serving behaviorally targeted ads to children. First, the companies would have to obtain parents' consent to collect children's personal data, including data stored in cookies or other pseudonymous identifiers; then, companies would have to separately obtain parents' consent before sharing that data for behavioral targeting purposes.

“Behavioral advertising would have to be turned off by default and parents would have the clear option to say no to behavioral advertising even if they consent to the company’s other data practices,” the FTC wrote in a blog post outlining the proposal.

The FTC's proposal regarding behavioral advertising is part of a package of potential updates to regulations implementing the Children's Online Privacy Protection Act (COPPA), a 25-year-old law that bans website operators from knowingly collecting "personal information" from children without their parents' permission.

The agency launched a review of the regulations four years ago, when it sought comments from the public on topics including how to apply the law to platforms that allow third parties to post content. The regulations were last updated in 2013, when the FTC said the term “personal information” includes not only names, addresses and phone numbers, but also “unique identifiers” can link the children's activity across more than one site or app -- such as tracking cookies, device serial numbers and, in some cases, IP addresses.

Those 2013 rules broadly require web companies to obtain parents' consent before collecting that pseudonymous data, but have some exceptions -- including one that applied when ad-tech companies harnessed identifiers to deliver contextual ads, meaning ads tied to content on a webpage being viewed.

The FTC appeared to suggest Wednesday that it may revisit that exception for contextual ads. In addition to setting out proposed rules, the agency sought comments on a variety topics, including whether website operators should be able to continue to collect identifiers for contextual ads without parental consent.

“Given the sophistication of contextual advertising today, including that personal information collected from users may be used to enable companies to target even contextual advertising to some extent, should the Commission consider changes to the Rule's treatment of contextual advertising?” the agency asks.

At the same time, the proposed rules don't appear radically different from existing ones. For instance, the FTC explicitly rejected calls to impose a “constructive” knowledge standard on website operators, which would have required them to obtain parental consent when they should know a user is under 13. Instead, the FTC said it would continue to apply the “actual knowledge” standard, which only requires companies to obtain parental consent when they actually know a user is under 13, or when a user is on a website or app directed to children. (The FTC also says an operator of a site aimed at a general audience has “actual knowledge” of a child's age if it “willfully disregards the fact that a particular user is a child.”)

Phyllis Marcus, a partner at Hunton Andrews Kurth and former leader of the FTC's children's privacy enforcement program, says the new proposed rules are “not earth shaking,” noting that they by and large don't incorporate principles included in measures like the California Age-Appropriate Design Code.

That law, which was recently blocked by a federal judge, requires online companies likely to be accessed by users under 18 to prioritize their “best interests” and “well-being,” and also largely prohibits those companies from collecting or sharing their personal information.

“I think there is some sigh of relief,” Marcus says. “I think operators are going to feel a little bit of comfort in that the FTC did not take the opportunity to align COPPA with age-appropriate design codes,” she adds.

The one proposed regulation that does incorporate some age-appropriate design code principles deals with an exception to the broad requirement that websites obtain parental consent before collecting certain types of data from children.

Currently, that exception allows website operators to collect children's data without parental consent, when the data is used for internal operations. One of the new proposed rules would prohibit companies from using that internal-operations data to send push notices to children, without parents' consent.

Some watchdogs including the Center for Digital Democracy and Fairplay praised the proposed rules.

“The commission’s plan will limit data uses involving children and help prevent companies from exploiting their information,” Katharina Kopp, the Center for Digital Democracy's policy director, stated. “These rules will also protect young people from being targeted through the increasing use of AI, which now further fuels data collection efforts.”

The FTC will accept comments for a 60-day period beginning when the proposed rules are officially published in the Federal Register.