On May 11, 2020, the Children’s Advertising Review Unit (CARU) issued a public statement in support of a bipartisan call by six U.S. Senators for the Federal Trade Commission (FTC) to conduct a review of the data collection and processing practices of edtech companies, as well as companies that engage in digital marketing to children.
In a letter addressed to the FTC Commissioners on May 8, Senators Ed Markey (D-Mass.), Josh Hawley (R-Mo.), Richard Blumenthal (D-Conn.), Bill Cassidy (R-La.), Dick Durbin (D-Ill.) and Marsha Blackburn (R-Tenn.) urged the FTC to use its authority under Section 6(b) of the FTC Act to “uncover critical information about evolving and widespread threats to children’s privacy that warrant further protections.”
In particular, the Senators appealed to the FTC to examine the following issues:
- What personal data edtech services and providers collect from children and teens
- How they obtain consent for this collection
- How long they retain students’ data and what their process is for deleting student data
- Whether they offer incentives for schools to integrate their products and services into their systems, and whether they offer incentives, such as financial discounts, for adults to consent to children’s data collection
- How they collect and process children’s biometric information, including facial recognition data, in educational settings, including outdoor educational settings
- Whether they use student data for any non-edtech products or services, including whether they use children’s data for behavioral advertising
- What steps they take to maintain the security of students’ data
- Whether they have suffered any data breaches involving information about children or teens
- Whether parents have adequate alternatives to consent to the collection of their children’s data, and what options are provided to parents in the course of obtaining consent
- How edtech services and providers notify parents and schools about changes to their terms of service
The Senators also asked the FTC to seek the following information from companies that are engaged in digital advertising to children:
- What personal data they collect from children and teens
- How they obtain consent for this collection
- Whether parents are provided adequate opportunities to consent to such advertising, and how a parent’s decision not to consent to collection of their child’s data would affect the child’s experience with the product or service
- How companies employ data analytics and machine learning techniques to determine what content children are likely to consume and to target those audiences
- Whether they collect voice information from children, and if so, how they use this information
- What third parties they work with to collect and process children’s information
- Whether they sell or share children’s data, including to affiliated companies and data brokers
- Whether they use geolocation information for marketing to children, and if so, how they do so
- Whether they collect information about protected demographic characteristics or information that can be used as proxies for that type of information from children
- If they operate a platform for both adults and children, how they determine whether a user is a child
- How they have shifted their data practices in response to the coronavirus pandemic
- Whether they participate in a safe harbor program under the Children’s Online Privacy Protection Act (COPPA), and if so, whether there have there been any instances in which the safe harbor program enforced its requirements
In requesting the FTC to investigate the data collection and processing practices of these companies, the Senators emphasized the rapid, unprecedented expansion of the use of online technology in education and children’s entertainment due to the current coronavirus pandemic, and the resulting increase in the demand for and importance of personal information.
BBB National Programs’ Vice President Dona Fraser, who leads CARU, echoed the Senators’ concerns, stating, “The millions of children in quarantine due to the novel coronavirus outbreak are increasingly relying on technology for education and entertainment, and with that greater reliance comes the need for corporate responsibility.” While supporting the Senators’ call for an FTC inquiry, however, Fraser expressed a concern that the FTC’s response to the Senators’ request for 6(b) orders might delay or even derail the work the FTC has begun in its current review of the COPPA Rule. Fraser encouraged “fast action by the FTC, but not at the expense of the current COPPA rule review.”
In addition to endorsing the Senators’ call to seek information about privacy practices in digital advertising and edtech, CARU and Fraser specifically focused on edtech companies and asked the FTC to also pose the following questions to such companies:
- How are you making your privacy practices known?
- What is your data retention policy?
- If your company is collecting personally identifiable information from children, are you separating that data from the data collected from adults (or persons age 13 or older)? How are those databases secured, and who has access?
- How are you monitoring what third parties do with the data they touch or collect on your behalf?
To read the Senators’ letter, click here.
To read CARU’s statement, click here.
Why it matters: The FTC is currently conducting a COPPA Rule review, which is performed approximately every ten years but was fast-tracked due to the rapid technological advancement since the FTC’s last review. The last COPPA Rule review was completed in 2012, and the Rule was amended effective July 1, 2013. The FTC kicked off the current review just six years later, in 2019, holding a public workshop and seeking comments on the current Rule. The comment period ended in December 2019, but the FTC is likely to scrutinize the edtech and digital advertising spaces more extensively before making any changes to the Rule, especially in light of the forced digital transformation of the education sector and the surge in children’s consumption of digital content, as highlighted by the Senators’ May 8 letter to the FTC. While the FTC is considering the Senators’ and CARU’s request, it would be prudent for edtech companies and companies involved in digital marketing to review their privacy practices and ensure that their data collection and processing practices comply with the current COPPA Rule and address the concerns raised by the Senators and CARU in their requests.