Advocates Support Knowledge Standard in Colorado Draft Rules
Colorado is right to craft a knowledge standard to hold companies accountable for willfully ignoring user age in its draft kids privacy rules, consumer groups said in comments due Sept. 5 (see 2509100045).
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
However, industry groups and others told Attorney General Phil Weiser (D) to apply a standard consistent with the FTC’s Children’s Online Privacy Protection Act (COPPA).
Electronic Privacy Information Center welcomed the draft rules outlining clear instances of willful disregard: directly receiving information that a user is a minor, directing services to minors and categorizing users as minors for advertising purposes. The rule “improves compliance and supports a knowledge standard that accurately reflects the reality for controllers online,” said EPIC.
Common Sense Media said Colorado is right not to allow companies to “turn a blind eye to kids on their services for legal purposes while at the same time profiting off of them.”
Meanwhile, the Network Advertising Initiative urged consistency with COPPA. For example, Colorado should provide further clarity that other data controllers and processors, not just the company dealing directly with the consumer, should have responsibility to recognize and signal when websites and services are directed to minors.
The Entertainment Software Association said COPPA contains useful language to help provide clear guidance for assessing whether a site or service is directed to minors. This includes whether teens are used as models on the service, if the service refers to minors or teens as an intended audience, whether advertising is directed to minors and if there's empirical evidence showing the makeup of the audience.
Future of Privacy Forum warned that the department’s proposal to apply a “COPPA-style ‘directed to minors’ factor” within the knowledge standard, combined with expanding protection to all minors, “risks conflating distinct frameworks.” FPF highlighted the potential for confusion between COPPA’s "directed to children” category and its “fact-based ‘actual knowledge’ standard.”
Hintze privacy attorney Sam Castic told Privacy Daily that stakeholders are finding the specific examples of what it means to “willfully disregard” to be helpful in understanding what’s required to comply with the draft rules. Those examples include when a parent discloses the age of their child to the company and if the user indicates age in their profile, he said.
“People are finding the examples clarifying and helpful, but it doesn’t necessarily mean they’re going to be easy to address," said Castic. Finding age-related clues in social media posts may prove to be harder than simply monitoring designated fields that users fill in when they create accounts, he said.
Other states have set standards for willful disregard, including Connecticut, Texas and Nebraska, noted Castic. “But none of them have gotten into detail about what’s meant by that.”