Good afternoon, everyone, and thank you so much for attending our brief the hill event. Im emma morris, the Global Policy director at fozi. Id like to thank kmoonk carden as and his staff for securing the room for us. Briefly by way of background for those who arent familiar with the family Online Safety institute, were a Nonprofit Organization working to make the online world safer for kids and their families. Were pleased to host this panel today to discuss one of the most important issues facing families, kids privacy on the internet. In the united states, the collection and processing of childrens data has primarily been regulated by the childrens Online Privacy protection act and its corresponding rule for over 20 years. This law long preceded facebook, snapchat, youtube and hello barbie. We have seen numerous legislative proposals including from senator markey to change the way childrens legislation is regulated. At the beginning of the summer the federal trade Commission Published a request. With all of this activity in minding, fosi introduced a white paper which you should have received on your way in and you can download from our website. We believe that limiting the Data Collected from children and preventing Online Marketing to those under 13 absent verifiable parental consent are admirable aims. We are cognizant that Small Businesses are able to comply with the law and create engaging, educational and fun content for children. We Want Companies to bein sent ivized to protect childrens information. With that in mind ill hand over to Stephen Balkam who will moderate the panel this afternoon. Great. Thank you very much, emma. Thank you to the fosi team led by emma morris to put all this together. Fantastic in such a short period of time in the middle of the summer, so thank you for that. Also as its probably pretty obvious, cspan is here. Were out live and so just when questions come around, just be aware that you could well be taken up on broadcast tv. So, yes, founder and ceo of the family Online Safety institute. I will be moderating the panel. I just want to mention were also hash tagging at fosi briefs the hill. I know its not brief but it is a good hash tag, so please use it. And of course this video that cspan is doing right now will be arc koohived at cspan and w provide a link. Im going to ask this esteemed panel to introduce themselves starting with you, mark. If you could tem ll us who you are, where you work and a tweet length description of your work in this space. Im mark eichorn, sachbt director in the Privacy Division of the ftc. Ive been in that job for about ten years. And what the ftc does is protect consumer privacy. We enforce copa and we do policy work around copa. So a couple of years ago we held a workshop on Educational Technology issues and are holding a copa workshop this october. Thank you very much. Hi, everyone. Stephen, thank you for having me. My name is john falzone. I work at the Entertainment Software rating board where i run the privacy certified program, which is a ftcapproved copa safe harbor program. So i work with companies primarily in the Interactive Entertainment and toy spaces to ensure that theyre complying with the law and regulations and generally doing right by their consumers. Joseph wender, Senior Advisor to ed markey. Ed markey was the author of copa and we have been active in the last 20 years since then on pushing all sorts of kids privacy and advancement issues. Most recently introduced a copa 2. 0 bill which im sure ill be discussing during this panel. And im jim halpert and i cochair the Global Cybersecurity practices at dli piper and back in 1978 as a senior associate i helped negotiate and draft some of the language that ed markey wound up sponsoring with conrad burns and Richard Brian that became the copa law and was there at the creation and i think filed seven sets of comments in the 2000 rule making, so i was there at the creation and hope to provide some context over time regarding copa. Thank you, all. Its quite a breadth of experience, both past and present. No doubt well into the future, because this issue is not going to go away. Mark, let me start with you. What has led the ftc to see comments on the copa rule now before any other time . Im speaking for myself and knotted for t not for the commissioner or the commissioners. I speak for one of them and im not going to say who. So i we do this regulatory review process of all our rules and guides every ten years typically. And that is on a routine schedule. With copa we revised the rule in 2013 pretty substantially to add categories of personal information that werent really collected when the rule was first implemented or when the statute was first passed. And sort of to expand the rule in other ways, to cover persistent identifiers but also third parties collecting information from sites when they have actual knowledge that theyre directed to kids. So, you know, we hear about copa a lot. Theres a number of statutes that we enforce and rules that we enforce. Theres a lot more just sort of discussion and talk about copa than many of the others. Theres also theres been a lot of changing technologies. For example, i mentioned the ed tech workshop that we held. At the time that the statute was passed, there was no mention in the statute whatsoever of schools, and it sort of raised this issue of, well, if somebody is using an Online Service in the school context, can the parent i mean, excuse me, can the teacher provide seconsent o not . These types of issues. So weve sort of addressed those in the statement of basis and purpose for the rule but weve never really addressed them more directly in the rule itself. And when we held the workshop a couple years ago on these issues, its clear that this industry is really accelerating. Theres a huge amount going on there. We thought about sort of making sure that we addressed that issue properly and getting public ideas on how to do that. Ill just say just to highlight one more issue or one more change, obviously a lot of us use voice assistance. And when the Commission Revised the rule in 2013, we added coverage of audio collected from a kid. So that raises questions about, well, if you have a Voice Assistant that is directed to kids for some reason and youre basically just using it to do voice activated search essentially, then we realized that would sort of raise issues. So we issued a discretionary enforcement policy that basically says if you use it for something quick like that and you just immediately delete it, you know, were not going to be bringing a case involving that. So thats another issue where we want to get the publics input, sort of see how that might be integrated into the rule and how to address that. And also are there other issues about Voice Assistants, other issues with smart tvs, that kind of thing that we want to address. Talk a little bit about the process. Were coming up to the end of august. What happens next . When are you guys going to actually deliver your thoughts on this . Right. Well, it will be a while, i suspect, because the comments are not due until october 23rd. Were having the workshop, as i said, october 7th and we expect well get a lot of input there as well. So once we get those comments, well sit down and go through what we got and review the input and then figure out where to go from there. Just to make clear what this is, theres sort of a process for a rule making where we put out particular basically regulatory language that we propose. This is one step before that. Were still sort of at the informationgathering phase. So one thing that could come out of this next step is we could end up making a regulatory proposal based on what we hear. Okay. And how are you currently working with companies that create content . Just taking a step back from the looking at copa, how are you currently working with everyone from the disneys to the mom and pop shops who were creating an educational app, for instance . Well, one of the things we do is we have a copa hotline where companies can reach out to us and sort of pose an issue to us or ask a question about the rule. We see this as trying to sort of facilitate compliance with the rule as opposed to sort of catching somebody in a violation. So thats one avenue. We also have consumer and Business Education that we put out, and the faqs on copa where we sort of try to make the rule as clear as possible. Those are some of the ways that we do that. Okay. John, for those of us who are not familiar with safe harbors or the esrb, lets do a little bit of a level set. What is a safe harbor . Sure. So, first of all, safe harbors were created as part of the legislation that was passed. The safe harbor regime is intended to be to provide independent oversight and enforcement of the act but on a selfregulatory basis. So in other words, its not mandatory for any company to be a part of a safe harbor. Companies choose whether or not they want to work with safe harbor programs. The esrb is one of the oldest copa safe harbors, but there are seven companies that provide safe harbor services. And so the companies that work with us have chosen to become parts of our program. They pay, depending on the program, some sort of fee for our services. Then our job is to make sure that those companies are, first and foremost, complying with copa and the amended copa rule and the guidance that the ftc puts out. Many of our programs go beyond just copa but from a safe harbor standpoint, thats our primary objective. Every day my team is in websites and in apps that our members are putting out and theyre looking through them just as any user would, doing the user experience. Theyre doing back end scans to see whats happening on the back end that the user can see. Making sure that, one, the practices of that member are in line with what copa requires and, two, that the policies that they put out, in other words, the disclosures that theyre making are reflecting those practices and accurate to their consumers. Talk a little bit about how you guys promote the creation of content for kids, particularly the under 13 market, which has bedevilled a lot of creators. Talk about that. Its an incredibly difficult market. To be frank, most of our members dont even really get into that market. The majority of the websites and apps why is that, john . Because its difficult to monetize and stay compliant with the law. So we are lucky that some of the companies that we work with have strategies for monetiization but those are the traditional ways that you would monetize within an app or on a website. Some of our members in the toy industry, its not necessarily about that for them because they have brands that theyre just looking to keep kids engaged with and they can monetize in other ways. But its a difficult it is a difficult market to be in and to make money in. But it is one where if you have sort of the right longterm view, you can be very successful in it. So our job is we start working with our members as early as we can in the process. If they have something thats under 13 in a true childdirected sense or that is just going to be hitting some under 13s in a significant way but maybe directed to an older audience, we start working with them as early as we can in the Development Process to start flagging issues that might be coming. Because, look, the companies that work with us, they know what copa is and theyre trying to do the right thing by working with us, but they dont always necessarily know what that right thing is. And then youve got companies that are just coming to us when they have Just Launched or are planning to launch something. Those Companies Often think that they know everything and that theyre compliant with everything. But then when you get into it, it can be complicated and so theres a lot of issues that you just have to work through. But you can work through them, if youre willing to do it. So one of the most complicating issues that we come across when talking to companies is this distinction between actual versus constructive knowledge. Again, for the uninitiated, what is this extraordinary distinction between actual and constructive knowledge and how it relates to the copa rule itself. Right. Just by way of background, copa is triggered when the Online Service is either directed to children under 13 years old or the operator of the Online Service has actual knowledge that the user is under 13 years old. So thats copa in its current state the way that it works. Actual knowledge is what it sounds like from a legal standpoint. The company has to actually know that that user is under 13 years old. The most typical way that a company would know that is if the user has identified as under 13 years old. A lot of websites contain or apps contain a registration process or some sort of age gating process so a user may identify as under 13. Weve all seen those popups that come up. A user might identify as under 13 and then automatically at that point copa is triggered, regardless of what the site is. It could be a site that could be a site that is intended for parents. But if they collect the users age, then copa would be triggered in that circumstance. Constructive knowledge is would be a situation where the operator should have known that the user was under the13 from a legal standpoint, so that could be based off of any number of factors of information that they might have available to them. It sort of broadens the scope, as you can imagine. Right. Okay, thank you. Joseph, so what was your reaction and as important your bosses reaction to the ftc in july that copa would be reviewed much earlier than had been expected . Our reaction was cautious optimism. He was very supportive when the rules were reviewed back in 2013 and he clearly sees that the landscape has changed in the six years preceding. And so things like biometrics, things like genetics, things like Voice Assistant, all the things that mark discussed, its clear that theyre much more prevalent in the ecosystem today and that the commission should be taking a look at that, so thats good. Now, i say cautious optimism because we dont know yet what the outcome of this rule making will be. If in the end the rules are strengthened, thats a really good thing. But you always have to be wary of potential bad players or others coming in and attempting to weaken the rules. So until we see what the final product of the process is, i dont want to i cant say if were going to be happy or sad. But i dont want to prejudge the process because its good that theyre certainly starting it. So i had the privilege of testifying to the Senate Judiciary only a month or so ago on the topic protecting innocence in a digital world. During that hearing, the ftc came under a barrage of criticisms. Presumably you saw or watched that hearing. Do you share the level of criticism of the ftc or put in a more positive way, what more could the ftc do in this space . I think particularly in the kids privacy space, the jury is still out. Because as Everybody Knows in this room, theres a case pending or a proceeding pending about youtube and whether they violated and what the fine is going to be and what the continuing or new obligations that are going to be placed on google. Now, that settlement, that agreement has not yet been released, has not yet been announced. So i think what they do in that particular case will be indicative of the position that the commission is taking with regards to how serious they are about enforcing copa. So i dont want to say yet. Well see what they do. Well, im sure you can, though, talk about senator markeys own proposals which politico mentioned three of them this morning. Were busy. Off you go. Tell us about them in tweetlength descriptions. Sure. Three different bills, the trifecta of bills. The first is a copa 2. 0 bill, which he has introduced on a bipartisan basis with josh hawley, the republican senator from missouri. What that bill will do in short to be consistent with california and gdpr spell out your acronym, gdpr. You spell it out. General Data Protection regulation. Thank you, jim. What it would do is create as Everybody Knows, copa is only 12 and under. Senator markey and others believe 13, 14, 15yearolds need special protections. Not necessarily the same as 12 and under, but still need special protections. So what the bill would do is extend protections to 13, 14 and 15yearolds. It would also change the knowledge standard from actual to constructive. It would ban targeted ads for kids and it does create an eraser button consistent with the law in california that allows parents and children to erase information that they themselves have posted so as to not violate the first amendment. The other two bills are the camera act, which is the children immediate Research Advancement act which is directing nih to do a fiveyear study on the impact of technology on children. Its obvious that kids are totally glued to these things now. So what are the socio, emotional, cognitive and physical impacts of this incredible increase in Technology Use by children. The last bill, which has not been introduced yet is called the kids acted, the kids entr t internet design and safety act. That bill is seeking to give the ftc new authorities to address exactly what i was just describing, the practices by many websites to glue children to devices. All the strategies that they use regarding auto play and other functions to sort of suck kids in and ensure that they dont stop watching. I have a 3yearold. It works very well on him. He will not stop watching the device unless i rip it out of his hand. And so that bill which well be introducing sometime in september or october will address what we do about that issue. In our experience parents are actually glued to these. Oh, its a problem. Actually this room is doing pretty well. Ive been looking around and there arent this is a testament how good this panel is. There arent that many people on their phones right now. Except we do want you to tweet from time to time. Mostly your attention up here, please. Last question at this point, so do you think copa should be modified or are we looking for a total rewrite of the law . Modification. So youre looking so youre not going to throw copa out . No. We think as was evidenced in our copa 2. 0 bill, the markeyhawley bill, were seeking changes, modifications to the 12 and under regime and seeking new protection for 13 through 15 but not looking for a complete rewrite of copa. It has been effective, but as evidenced by the ftc starting their process now and my bosss bill, it can be improved upon because the world clearly looks different than it did when it was passed in 1998. Well, speaking of which, jim, this is a perfect segue to you when you wrote the bill in 1998. When we were all much younger, 20 years ago, how has the world changed, would you say . Well, 20 years ago i had a 1yearold child who is now just driving up this afternoon to enter his senior year of college, so its really a good, long period of time. And weve seen really what was a nacent internet age where verified parental consent were very limited to a world where people authenticate all the time on their devices for a variety of different things. That, i think, offers some opportunities to one of the barriers is weve heard from joe before is with copa is that its so difficult to get verifiable parental consent that the idea of creating, of getting into a copa compliant framework is very its a real barrier and it discourages investment in this in content and activities for kids that could be very positive. On the other hand, one can imagine a world where authentication is much easier and straightforward, and that may be less of a, if you will, Walled Garden where not much can grow really practically. And so i think this rulemaking potential rulemaking presents an opportunity to make copa realistic, not weak, but realistically reflect the fact that people are not going give away their credit cards for verification in todays day and age with all this information about data breaches, payment card data, but to allow much easier authentication with a lower barrier for parents to agree for their younger children to have learning opportunities and at the same time to take the faqs, which the commission the ftc has issued over time, which are really very good, and to be streamlined a little bit and to put them in the rule, including on issues like what is content thats targeted to children. The commission has done a lot of good thinking about that, including looking at the sort of advertising of and on a site, that can reflect whether the site really is targeted to children or not. And so the rulemaking offers, i think, opportunities to address and to raise the profile of some of these issues. At the same time, i have questions, and well get to this, about some of the other elements of the kids act and of the some questions in the ftc rulemaking about how some of these other ideas would work in practice. I dont i wouldnt describe them as concerns, but theyre questions. I think those are worth exploring as well. But i do think that essentially putting in the rule a bunch of the clarifications in the faqs, including also about educational online platforms, to make absolutely clear that the school acts in loco parentis where the federal Education Rights to privacy act, these are ways to break down some of the barriers and the way copa discourages new forms of learning for kids online, but at the same time take the guidance in the faqs, which is designed to, for example, look quite broadly at what sites are actually targeted to children and then the ftc is very does a lot of enforcement of copa. Its an area where i think the Senate Hearing completely overlooked its appear area where the ftc is very, very active, that and publication and changes to the rule can sensitize a lot of sites to the fact that they may be doing certain portions of their site may actually be targeted to children. So this is an opportunity in this new world where theres been a lot of evolution and theres also been a lot of guidance from the commission over the past really ten years that could go into the rule. So, jim, about ten years ago we did a panel in london at british telecoms headquarters and we agreed that copa had become this kind of global standard, that the europeans had pretty much adopted it and similarly in asia. But now were seeing with gdpr, the general Data Protection act, that its kind of coming back at us. In other words, there are new regulatory regimes particularly in europe which now were going to have to Pay Attention to. So what other International Trends do you see both positively and negatively that will impact us here . Well, in general this is an area, speaking as somebody who coheads a global privacy practice with lawyers in 40 countries who follow it, this is an area where Different Countries look at this slightly differently. We have a first amendment. Many other countries dont. There are key issues, for example, about 15yearolds ability to communicate that really in europe are not such a its a concern but not the same order of concern. So europe has taken even just europe alone has not taken a uniform approach to this. They let each eu member state establish the age where parental consenti consent is not required and consent by the individual is varied, it can vary between 14 and 16. Weve seen diversions there. Weve seen a different approach in japan. Countries that are updating their privacy laws do not adopt a uniform point of view. In the u. S. We have california thats moved forward with its own omnibus privacy law and takes the view that kids between ages 13 and 15 should affirmatively consent to sale, and this is a somewhat particular definition of sale, which means more than sale. Essentially use monetization for . Exchange f for something in exchange of value. But whether the business has actual knowledge that theyre dealing with a child. Or a teenager. So the result is now something that the kids act is way goes way beyond the requirements in california law, but the broad idea of optin consent for teenagers is now something that a lot of companies are working very hard in the u. S. To roll out in expectation when the ccpa takes effect for california residents. Bear in mind california is a seventh of the u. S. Economy and has a huge number of people. When that law takes effect on january 1st, 2020. So were seeing changes that, again, a little different because this is an optout of sale or an optin to sale but were seeing changes in the u. S. Just as were seeing them around the world. Im going to come back and use the c word and ask you about your concerns about whats going on with the copa review but also some of the proposals coming from senator markey and others. Well, i really have questions more than anything else. Your questions, then. So i think theres really an issue, for example, with constructive knowledge, what does that really mean in practice and how is that operationalized . Does it mean that a website or Online Service needs to really gate very heavily and potentially drive a whole lot of people through because they might be deemed to have constructive knowledge to prove that they are not teenagers . If thats the result, then this will be a rather frustrating online experience for everybody sitting in this room. So there really are issues around that. With the ftc, i think there are questions about what the ftc will do on the streamlining copa consent side to balance further clarifications of the reach of copa and thats a very important issue to making the law really work very well. I also think that the question theres an issue in the kids act with regard in the copa 2. 0 act . Copa 2. 0 act. Thank you for correcting me. Theres a question about what does it mean when you have a site that is not targeted to children but happens to have a lot of children or teenage users. And if the basis if simply having audience figures where it turns out that an example, the office is a tv show that a friend of mine created and named a character after me. Turns out the office was not targeted at an audience of preteenagers but was very popular with a lot of 12 and 13, 14, 15yearolds. Many of whom who have tuned into cspan to see jim halpert. Im not as tall or good looking at jim kra zin ski, im sorry. The results of this, though, is if you simply look at an audience and what the audience is, that can fluctuate. Its not a great metric for what targeting to children is. The word targeting doesnt really square with what may be the effect of a particular site. So i think thats an area where theres really a lot of questions. The result, i think, of a rule that said that a rigorous copa consent model would apply would be that sites would need to collect more information in order to figure out who the kids were and then to authenticate them. That would result probably in more Information Collection in order to for its sites to be compliant. So i dont think theres an easy answer here, and joseph may have some ideas or response to that. But i really have there are difficult issues here. This is complicated. The overall goal of protecting kids privacy is vitally important. But figuring out how to do this in a smart way that doesnt incentivize more Information Collection that, facilitates parental involvement in a way that allows kids to obtain information and cracks down on unscrupulous monetization of kids information where there is some targeting of kids i think really is the trick and really eager to see how this rulemaking, if it happens at the ftc and eventually Congress Considering privacy legislation would think about these issues. But in the first instance, the ftc has actually done an excellent job. I think we all should look forward to its work and be patient because this is such a delicate balance, i think having an Expert Agency deal with this in the first instance before Congress Goes and legislates again is probably a good idea. Thank you. So lets use those questions to throw it open to the panel. Weve got the constructive knowledge question, the reach of copa and the unintended consequences of collecting more information with copa 2. 0. Joey, why dont we start with you . These are all good questions that jim is asking. Im not going to get up here and say that, you know, our bill is perfect and that we have all the answers. This is part of the legislative process. Its the same way that its part of a rulemaking process at a federal agency. A rulemaking process, you have notice in common. A legislative process you have lots of different members that will offer amendments and go through a markup and go to committee, then go to the floor and have to reconcile with the house. In the schoolhouse rock version, thats how it should work in theory. I will say on constructive knowledge, i do want two things. One, i want to address the question that was raised before about how do you we dont think we think its a false choice that you either protect children or you have creativity and new apps or new offerings for children online. Ed markey firmly believes, as weve seen over the last 20 years, there is a way to do both and a lot of companies have mastered both. A lot of companies obviously have been deterred from doing it, but a lot have not. So we should be entering this process as were thinking about rewriting or revising the law at the agency or doing so in congress with both goals in mind. You want good, safe, educational content for children and at the same time that protects them and their privacy. On the constructive knowledge point, what i would say is theres clearly a problem right now with channels, with sites i say channels because thats youtube but sites overall that have an unbelievable number of children users or children viewsers that dont fall into the two categories that were mentioned earlier, which is actual knowledge, because theres an age gate, or intended for children. So one of those examples is theres a specific website about toy reviews for children, for kids. Its highly popular for children, but arguably right now, and the operator of the site knows it. Everybody knows it in the sense that they have constructive knowledge that kids are being directed to the site to see what are popular toys right now. But it falls outside of the two categories that were mentioned before, so it doesnt trigger copa. And so we need to find a way to address these types of websites that are clearly being used by children but also at the same time not fall into the trap of the unintended consequences that jim described earlier. And there may be a way, to pick that particular example, one might argue that this content was of overwhelming significance and interest to kids, so it wasnt that different than a cartoon site, for example. That might may or may not it could be the way the reviews are done too. Are they done really for parents and talking about a bunch of criteria that parents would be interested in or is it an unboxing video where you see a child excitedly unboxes a toy. And saying this one is really cool. So i think this would be the maybe mark can speak to this, some way to get to a site like this or tweak the rule rather than adopting a constructive knowledge standard, you know, for this sort of site because its a particular example. You may well have others that are important, but this one i think can fit probably the existing frame. Mark . Well, i think that this is one of the pressing issues of copa, right, which is that there are i think when the rule was passed, there was sort of this idea of like things like the super bowl being the tv analogy, where people are pretty sure that there are probably kids watching the super bowl, but it wasnt directed at them, yet all told there are possibly even millions of kids watching the super bowl. And i think you need one distinction you can make is between that type of site and a site where its sort of like, yeah, due to the nature of my site, i pretty much know that i have inordinate appeal to the kids and maybe its not only intended maybe its not even intended for them at all, but i know that i have a large following among the kid population. And i think thats a challenging situation where i think the constructive knowledge approach is maybe designed for that kind of situation. But definitely, yeah, under the current rule you have your actual knowledge bucket and you have your directed to kids bucket and there is sort of another category out there. And i think we do want to avoid the super bowl side, though, because if you think about and this would be true of many different ways that people get online and communicate as well as particular content. We do have huge populations of adults and older teenagers who are also part of this mix. The only way to distinguish, to figure out who are the younger minors is to collect information about the users. And thats the catch22 or paradox of this. And so it may be about thinking a little more broadly about sites and services that are actually directed to children or should have actual knowledge that theyre collecting information about a lot of children. But without adopting a constructive knowledge standard across the board, because thats where the super bowl is a great example. Can you imagine americans logging in to watch the super bowl when its being streamed and having to wait for 45 minutes while all these people are screened to make sure that theyre actually able to watch it. Thats not a great experience. So this is a balance its hard. Youre describing well take it into the online space. Espn. Espn is a general audience site that adults go on every day. I went on it this morning. But kids go on it as well. Teenagers go on it as well. How does that compare . On what side of the line is that versus the example i gave before of a toy reviews for kids site. Theres clearly a difference between those two sites. Theres clearly a difference in audience between those two sites. So i think we all agree on the espn. Com side that it wouldnt be that it wouldnt trigger copa, but its the toy reviews for kids site, now it becomes a lot harder. John, reactions . Go ahead. I was just going to say the trick, of course first of all, let me just say my job is much easier. I just apply what the law is that they decide to pass and the regulations. You do what youre told, right . Just following orders. Im not really policy. But of course in the context of this discussion the trick is to write the law and to interpret the law through regulations and guidance in a way that doesnt sweep in the espn. My son is 12 so im right in that sweet spot. Espn is the first thing. 6 30 in the morning hes downstairs, hes on his espn app. This time of year hes already probably done three mock football drafts by this time of day. So theyre on theyre on those sites. We have to ask ourselves, first, do we want those sites to be swept in . And if we agree that we dont and that the sites that were targeting are those, you know, unwrapping toy type of situations, how do we how is the line drawn . How does it make it possible for me to be able to say to my members this one is triggering and this one isnt triggering. Thats already, frankly, a difficult even in the current regime, its a difficult issue to take on. People two really smart people can look at it from two different angles, at the same site from two different angles and come up with different conclusions on that. The current ftc guidance and rules address the question of mixed audience sites very specifically. And i think it might be good, mark, just to illuminate this a little bit more for folks in the room about what the current approach is, since were talking about the problem so well. Youre the lead for the agency so we completely defer to you about the ftcs view of that. The mixed audience exception was created in the 2013 rule. Basically it applies to a service, site or service thats already directed to children. But if im in a situation where i kind of feel like, well, maybe kids are a secondary part of my audience but my main audience is over the age of 12, then i can create a sort of copa compliant experience for the younger kids and then, you know, have an age gate where theres a where personal information is collected from the older kids. So i think that that is one way to approach the problem that youre talking about of sites that may sort of have an inod inordinate appeal. If people dont avail themselves of that box and dont consider themselves directed to kids in the first place, then you still have this situation where they may be collecting personal information from a lot of kids and wouldnt be again, wouldnt be using that exception. So this whole discussion is making me think of the ico, the uk authority on privacy recently put out something on how to approach kids. They havent finished their process yet. I believe theyre going to finish this fall. But their document kind of suggested that they would create a setting where it was almost like for one thing they were protecting kids under 18, as i recall. Right. And they were also setting up a system where it seemed like there were going to be lots of lots of the internet that was sort of safe for kids under 18 and where information essentially wasnt collected and then there would be some kind of, again, like some kind of age gating process for adults. So kind of a different approach there. Right. But its a verification. What the ico wants is a verification. What we think of as traditional age gate, the self identification of somebody as over under 13 years old, the ico has said that doesnt work. Or at least in its draft form of its age appropriate design form that doesnt work. Between now and november 23rd is the deadline for the final to come out. Whether or not they stick with this or not, because they frankly came under a lot of scrutiny for essentially requiring the collection of a lot more personal information to verify ones identity or ones age. So well have to kind of see how that ends up playing out. And how brexit ends up too. Just had to throw that in there. Let me throw this out to the crowd here. Any questions, concerns that you have about copa . You always wanted to ask . If not, i have a oh, yes. Do we have a microphone . No . Just speak loudly then, please, and say who you are. Im angela campbell. I have so many questions but i guess ill start with jim. I dont the argument is that in order to make sure that arent you collecting arent these companies collecting all kinds of personal information about these people who they havent identified their names but can tell from the information collected with pretty certainty what age that person is, so theyre already collecting information. I dont understand why that i think that may be true its a good question. Could you repeat the question just in case that didnt get picked up . Heres the question. Theres so much Information Collection online that these sites should know already that in some cases that theyre collecting information from a child. I think that that is that can be true in some situations, but in many situations its not. So the typical website, and bear in mind that copa applies to any online site or service, will not have that information. So they will have the ip address, some information about that site usage, and they are not in a position to be a gate keeper. Same thing for an isp. If you sign up for Internet Access service in your home and theres a lot of activity, its very difficult to distinguish everybody logs on with the same ip address as they go out from that isp and its very hard to tell who is me, who is my now 22yearold son whos leaving for the last time for college. But its hard to tell. Even with theres a lot of surfing that parents will do, and i did it, to show my sons like online math solving problems where they would actually use the site. Sometimes i was surfing, looking for appropriate sites to them trying to curate their Internet Access experience. So i actually looked at a fair number of sites that were quality sites, but they were targeted to children. So it becomes a little bit harder. If you have a mobile device thats unique to the individual but then again most kids under age 12 dont have these, i hope, then youre in a position to be able there may be more information to be able to track. But for most home situations, its very difficult. I think we have time for one more question. Yes. I didnt hear any examples of certain egregious abuse in particular circumstances maybe recently that would have been in the news that you could cite that might have some effect on all of this. Go ahead. Did you want to start . Go ahead. Maybe repeat the question. Oekay. So the question is are there examples or recent actions that will push legislation one way or another to be passed or not. I think theres been a host of alleged violations of copa, particularly i mentioned the youtube allegation earlier during the panel. But theres also a whole number of well, theres also a host of new technologies that are out there. I think Voice Assistant is a terrific example where not just not just alexa in your home thats designed for adults, but, you know, now theres an echo dot kids version for amazon, which is designed specifically for kids. And so its designed to listen to everything a child says and then respond when, you know, a command is mentioned. At the same time, ill mention another product that was not even brought to market but was proposed and has been since pulled, a product by mattel called aristotle, which my boss had written the company about before it was debuted which was intended to be a Voice Assistant specifically placed in babies rooms. The device was going to respond to the needs of the baby based upon whether they were crying or what else, play soothing music or give other say things to the child. But the whole device was designed to listen to the baby and respond to the baby. So these are certainly as a father of a 3yearold too are pretty eyeopening, startling examples that i think in this larger context of privacy compromises on a large scale, think Cambridge Analytica and facebook this doesnt have much to do, though, with data breaches. No, im saying that all those things are pushing congress to act on privacy, and we think that copa or kids in particular, teens in particular, must be its own special part of that larger comprehensive package, if it were to come to be. All right. Were quickly running out of time. I just do want to go up and down the panel and just say, by the way,panel, there is something much bigger sitting on top of this discussion and thats the idea of an omnibus federal privacy bill. What happens to kappa and 2. 0, all of this stuff if that starts to move. Ill start with you. Okay. So i dont want to predictions about what congress will will do. Ive worked on the hill for ten years. I know not to make predictions about what it will do. Congress at some point will tackle privacy in a comprehensive way. Maybe this congress. Maybe next congress. Maybe the following congress. I dont know. But whats expected to happen is that that bill will will not eviscerate cappa. Just in in the same way it wont eviscerate ferpa or hppa, all the other privacy laws that are out there. Youll be living in this country, its a balkanizeded privacy wor privacy world. They apply to different agencies or contexts or different types of information. What will happen, i think, i mean obviously our goal but i think the most realistic result hf of a comprehensive bill it is will modify cappa in some way. It wont get rid of it and it likely would consistent with europe and california bump up the age some way and create a new protection for 13, 14, 15. I mean, you know, i can adopt the i just work here rule too. If Congress Passes something, if they pass omnibus legislation that said, you know, heres the new law of the land and were no longer having specific exceptions, this is the, you know, this is the framework. Then, you know, we would abide by that. If they pass something that says hey, you know, were keeping cappa and maybe were tweaking this or that and this is all part of the sort of overall privacy landscape, we adjust to that too. So, you know, theyre the bosses. Right. Do you want to step out on a limb . You know, i mean, i dont have any insight, obviously. Joe knows what hes talking about as far as where thingsen stand. I guess many i personal view is cappa has been around a long time. A lot of work has gone into companies complying with it. It sure made sense to me if its changed it is supplemented not wiped out and starting from scratch. Okay. Jim, final word. First of all, id say never bet against ed marky getting a privacy law through congress. He has been the sponsor of more federal privacy legislation than any person whose ever served. He also has excellent relations with the speaker and leadership in the house. So if im sitting here looking at this, i think it would probably help federal privacy legislation if if he had got more involved in that process. He is very good at cutting deals. I would assume that something is likely to happen on team privacy also because the ccpa has already established a new set of requirements for teen privacy. And i would bet that federal privacy legislation if it preempted state law and its passed while democrats are controlling one house of congress, it will at least capture the general requirements of the ccpa in it. So looking ahead at that level and knowing this sponsor, i think were likely to see something happen with regard to older teenage privacy. They have done great work. I hope that they continue to have its authority under cappa for under 13 and without disrupting that too much. But there clearly are issues here that can and probably will be addressed when federal privacy legislation moves. Whatever happens, well be back up here on the hill for another meeting. Well take this to our annual conference november 21st here in washington, d. C. Called 2020 vision, the future of on line safety. Well be talking about Artificial Intelligence and stuff with the screens and keyboards go away which makes the privacy question even more to say the least. Can you all help me in thanking this wonderful panel . Tonight, gary adelman covers the whole civil war in 56 minutes. He begins with the leadup to the war including the compromise of 1850, bloody kansas, abraham lincolns 1860 election. And then he highlights the major battles and concludes with the confederate withdrawal. You can begin it tonight at 8 00 p. M. Eastern on cspan3. Enjoy American History tv this week and every weekend on cspan3. Tonight on the communicators, tennessee senator marcia blackburn, chair of the judiciary committees Technology Task force on chinas wuawei company in the u. S. , antitrust issues and regulating big tech. Some of these social media platforms that are beginning to distribute news and have a news feed, individuals want to see them actually have a news director. It tonight at 8 00 eastern o cspan2. Now a senate banksing Committee Hearing to examine the banking challenges Cannabis Store owners and sellers face in states where marijuana has been legalized. Lawmakers are conser
comparemela.com © 2020. All Rights Reserved.