Eric Goldman, a professor of law at Santa Clara University School of Law and director of the school's High Tech Law Institute, had some pointed advice for websites and apps trying to comply with the new updates to the federal government's children's privacy law: avoid it. "Do everything you can to avoid being covered by the statute," he said today during a panel briefing hosted by TechFreedom, a Washington, D.C. think tank.
One week after the Federal Trade Commission's revisions to the Children's Online Privacy Protection Act went into effect, the advertising community and kids sites are struggling with the new rules and what they might mean.
The rules, passed in late December and activated July 1, expanded the circumstances under which websites and apps must seek parental permission before collecting and sharing information from children under 13. Among other things, the updates broadened the definition of what is considered personally identifiable information going beyond email, name and address to include device IDs, as well as the definition of a website or app directed to kids.
Many of the participants at Monday's event warned the rules would have the unintended consequences of limiting kids' content on the Internet and chilling innovation.
"It will force major changes in the Internet ecosystem or it will dry up the offerings of many companies," said Stu Ingis, a partner with Venable, who represents the Digital Advertising Alliance.
The new rules have already had an impact on some sites. Snapchat, for example, changed its terms of service to prohibit kids under 13 rather than have to cope with trying to make its service compliant under Coppa.
Steve DelBianco, executive director for NetChoice, said AOL Kids suddenly stopped working for his daughter. "We have to make sure these services can continue," he said.
While the big kids brands have plenty of resources to cope, smaller websites and apps see Coppa updates as a burden. New operators could have compliance costs adding up to $18,670 a year and existing operators a cost of more than $6,200 a year, according to an FTC estimates cited by TechFreedom.
"A lot of small to mid-size companies don't want to deal with Washington. Their first question is, 'How do we structure this so we don't have to deal with this,'" said Lydia Parnes, a partner with Wilson Sonsini Goodrich & Rosati.
Sites that are not directed to children but are attracting kids could be forced to alter content, a situation the ACLU finds troubling.
"Enforcement of the rules is at the discretion of the FTC," said Gabriel Rottman, a legislative counsel and policy advisor for the ACLU. "By extending [the rules] to sites that don't have children as a primary audience, there is a concern websites might change the content on their sites or exclude children under 13 from access. That's influencing content of speech on websites."
"Most general purpose sites will continue to look for avoidance strategies," Goldman said.
The result, said NetChoice's DelBianco, is less innovation on the Internet. "There's no evidence that we've had growth in Coppa-compliant sites for kids. Now we've made things a lot trickier. It's the minefield of compliance," he said. "Coppa will raise costs, lower ad revenue, and we'll see less content for kids in the future."
"If the FTC is firmly committed to promoting both privacy and interactivity, [Coppa] may never work. We may not know what we lost," said Berin Szoka, the president of TechFreedom.
Maneesha Mithal, associate director of the FTC's bureau of consumer protection, said she's heard it all before when the original Coppa rule went into effect in 1999. "All these arguments were made before," she said.
The FTC continues to work with industry on coming into compliance and is expected to release more updates to the FAQ it issued in April.
As frustrating as that may sound, Mithal tried to reassure the industry. "We're not going to bring 'gotcha' cases," she said.