At what age does society believe children should be able to manage their own online activities and their own personal information? Certainly a nine-year-old requires close adult supervision. And while a 12-year-old may be more Internet savvy, it is not unreasonable for the law to require parental involvement in decisions about the information that's collected from and shared about their children. But what about a 16- or 17-year-old? Should the law require teens to get their parents' consent before signing up for a gaming site, ordering a book online, or downloading a mobile application? What about email, social networking, and search, each of which requires or permits the sharing of some personal information?
Over a decade ago, Congress enacted the Children's Online Privacy Protection Act ("COPPA") and drew the line for parental consent for information sharing at children 12 and under. Now some groups are lining up to urge Congress to raise the age for parental consent to 18. It is certainly true that the online collection and solicitation of personal information from teenagers and adults alike has increased in recent years. But applying a law squarely aimed at protecting children to cover older minors is unworkable and unwise. And because teenagers have independent rights to access information, any such law would ultimately run afoul of constitutional protections as well.
The language that underlies COPPA is complex, but the intent is simple: Help parents control what information is collected from, and potentially shared by, kids under 13. And after a dozen years in the trenches, the law--by most accounts--is doing its job. A big reason COPPA is successful is because it applies to a narrow, carefully described set of online content and activities that only a child could love. Congress considered whether to include teenagers under COPPA's coverage when the law was first introduced - but rejected the idea in part over concerns about teenagers' First Amendment rights.
Now the scope of COPPA is in play again. The FTC's initial five-year review of the effectiveness of the law found nothing worthy of changing. But the Commission has recently ordered another look at the law's effectiveness, given the explosive growth of online services and technologies now available to kids. Several groups have seized on this review, believing it offers the opportunity to expand COPPA's focus from the under-13 set to teenagers under 18.
One organization wants to expand COPPA's parental consent requirements to cover older minors. Another group of organizations stops short of COPPA expansion but urges the creation of a new privacy regime just for 13- to 17-year-olds.
There are significant problems with both of these approaches. First and foremost: Teenagers have independent free expression rights under the Constitution that would be violated by an expanded COPPA regime. Teens have the right to post and access information online without prior parental approval -- the 16-year-old looking for information about STD prevention on a medical information website can't be required to get his mom's permission first. And the right to receive information forms the foundation for exercising other political and free speech rights - it would be absurd to prevent teens from building up this foundation until they become legal adults.
An expanded COPPA would pose other problems, as well. The number of websites that have to follow COPPA's exacting parental consent requirements would expand dramatically, encompassing every site that might attract older teens. These types of sites -- including sites like NYTimes.com, Hulu, and Google -- are popular with adults, too, so these sites would have to try to verify the age of all of their users. This would force website operators to collect significantly greater amounts of information from everyone, a move that only exacerbates privacy concerns and works directly counter to the First Amendment right to anonymous speech.
That of course assumes that an Internet user's age can be easily verified, but it can't. Website operators would have no real way of knowing whether the verifying information they receive is accurate. And it's doubtful that a technological fix is waiting in the wings. Raising the COPPA age to 17 would thus violate the free speech rights of adults seeking to access content without government interference, as well as the rights of speakers seeking to reach a teenaged audience.
It also makes little sense to enact a special teens-only privacy regime, particularly when the United States still has no set of baseline privacy rules that provide protections for everyone. For the first time in a decade, Congress is finally having a serious dialogue about enacting such a law. Why divert from that path now to enact narrow protections for older minors, when a comprehensive privacy bill would protect us all? The FTC has ample authority to ferret out and punish any specific unfair or deceptive online marketing practice aimed at minors. Vigilant FTC enforcement action, combined with a federal baseline consumer privacy law with protections for all, is the best approach.
COPPA is doing its job; there is no need to pop the hood and tinker with the law. The expansion effort is well intentioned, but the solution is shot through with privacy and free speech problems. The best move at this time can be summed up in a borrowed line from the iconic rock group Pink Floyd: "Leave them kids alone."