To change the way it is regulated. The ftc [inaudible] , you of this in mind should have received on your way in. We believe that limiting the Data Collected from children and preventing Online Marketing to to under 13 absent her absent parental consent. We also want to ensure businesses comply with the law and protect data on gauging in children. Childrensprotect information rather than ignore data. With that in mind, i will hand over to stephen. And thankou very much you to the team led by emma. Also, as it is probably obvious, cspan is here. We are live, so one questions you could be on broadcast tv. , i will be ceo moderating the panel. Video at cspan will be archived at cspan and will also provide a link. Im going to ask this panel to introduce themselves, starting with you mark. If you could tell us who you are, where you work and a description of your work in this space. Im an assistant director in the Privacy Division and i have been in that job for about 10 years. What the ftc does is protect Consumer Privacy and we enforce the law and we do policy work around it. A workshop this october. Thank you for having me. I worked at the Entertainment Software rating board where i run the program which is an ftc approved safe harbor program, so i work with companies, primarily in the interactive and toy spaces to ensure they are complying with law and regulations and generally doing right by their consumers. Advisor. Senior , he was the author and we have been acting in the last 20 years since then on pushing all sorts of kids privacy and most recently introduced a 2. 0 bill which i will be discussing. I cochaired the mobile privacy and security practices at the l. A. Piper and back in 1998 as a senior associate, i helped negotiate an draft some of the language that ed markey and itp sponsoring think the cop a law and i filed seven sets of comments in the rulemaking. I was there at the creation to provide some context over time. Thank you. Quite a breadth of experience both past and present and no doubt well into the future because the issue will not go away. Mark, let me start with you. What has led the ftc to seek comments now rather than some other time . Im speaking for myself and not the commissioners. I speak for one of them and will not say who. [laughter] we do this regulatory review process every 10 years typically and that is on a routine revised the role in 2013 pretty substantially to add categories of personal information that were really collected when the role was first in command implemented and sort of to expand the role for the way rule third parties were collecting. Coppa a lot. There are a number of statutes. Hat we enforce theres a lot of discussion then many of the others and there has also been a lot of change in technology. I mentioned to be workshop we held. Of theas no mention statutes in schools and it raised the issue of if somebody is using an Online Service, can the teacher provide consent or not . Addressed those, but we have never really address them more directly in the role the rule itself. Theres a huge amount going on and we thought about making sure we address that issue properly and getting public ideas on how to do that. I will just say one more issue or more change. A lot of us use voice assistance and when the Commission Revised the role in 2013, we had audio collected from a kid, so that raises questions about if you have a Voice Assistant that is directed to kids for some reason usebasically using it to voiceactivated search essentially, we realize that would raise issues, so we issued a discretionary enforcement policy that said if you use it that andhing like delete it, we will not bring a case like that. That is another issue we want to give the public input on the role and also other issues about , that kind ofce thing we want to address. Next. T happens when are you guys going to actually deliver your thoughts . Becausell be a while the comments are not due until october 23. We are having the workshop october 7 and we expect a lot put there as well. Once we get those comments, we review thewn and input and then figure out where to go from there. Just to make clear what this is, there is a process or the rulemaking where we put out regulatory language that we propose. This is one step before that. We are still at the information gathering phase. One thing that could out could come out is we could make a regulatory proposal. How are you currently working with companies that create content . Just taking a step back from looking at it, how are you currently working with everything from the disney to educational apps, for instance . One of the things we do is we have a hotline were companies can reach out and propose an issue to us or ask questions about the rule. We see this as trying to facilitate compliance with the rule, as opposed to catching somebody with a violation. We also have Consumer Education faqswe put out in the where we try to make the roles the rules as clear as possible. , for those of us not familiar what is a safe harbor . , safe harborsl were created as part of legislation. It is intended to be, provide independent oversight and enforcement of the act, but on the selfregulatory basis. In other words, it is not mandatory for any company to be part of safe harbor. The company has to choose whether or not they want to be part of the program. There are some companies that provide Safe Harbor Services and the companies that work with us have chosen to become part of our program and pay some sort of jobfor our services and our is to make sure those companies are first and foremost complying and the guidance that the ftc puts out. Many of the programs go beyond coppa, but for me safe harbor sampler standpoint, that is our objective. [inaudible] everyday, they are looking through them just like any other user would. They are doing back in scans to see what is happening on the one,nd, making sure that the practices of that member are in line with what coppa requires into, that the policies that they put out, in other words the disclosures they are making our reflecting those practices and accurate to their consumers. Howalk a little bit about you guys promote the creation of content for kids, particularly the under 13 market. It is an incredibly difficult market. Membersank, most of our dont even get into that market. Andmajority of websites apps why is that . It is difficult to monetize. Nd stay compliant with the law we are lucky that some of the companies we work with have strategies for monetization that orbeyond advertising in apps in purchases, but those of the traditional in app purchases, but those are some of the traditional ways you would monetize. There are brands that they are looking to keep kids engaged with. It is a difficult market to be an end to make money and come up make money in, but it is one have if you have the right longterm view, you can be very successful. Our job, we felt working with our members as early as we can in the process, if they have something is under 13 in a true child directed sense, or hitting some under 13s in a significant way but may be directed in an to an older audience, we start working with them as early as possible and start flagging issues. By the companies that work with us, are trying to do the right thing by working with us. But they dont always necessarily know what the right thing is. Then you have companies that are just coming to us when they have Just Launched or are planning to launch something. Those Companies Often think that they know everything, and they are complying with everything. And it can be complicated. There are a lot of issues you have to work through. But you can work through them if you are willing to do it. One of the most complicating issues that we come across when talking to companies is the distinction between actual versus constructed knowledge. Is the uninitiated, what this extraordinary distinction between actual and constructed knowledge and how it relates to the rule itself . Background, this is triggered when the Online Services either directed to children under 13 or the operator of the service has natural actual knowledge thats how it works in its current state. Actual knowledge is what it sounds like from a legal standpoint. The company has to know that the user is under 13, the most typical way a country will company would know that would be if a user has identified as under 13. A lot of apps or websites can train containing a registration contain a registration process. We all see those popups, user might identify as under 13, and automatically at that point, Coppola Coppa is triggered. It could be a site that is intended for parents, but if they collect the users age, coppa would be trevor triggered. Knowledge is a situation where an operator should have known that the user was under 13 from a legal standpoint. That could be based off of any informationctors of they might have available to them. It broadens the scope, as you can imagine. So what was your reaction and your bosses reaction to the ftcs announcement that coppa would be reviewed much earlier than expected . Our reaction was cautious optimism, we were supportive when the rules were reviewed back in 2013 and he sees that the landscape has changed in the six years preceding. So things like biometrics, genetics, voice assistance, all of the things that mark discussed, its clear they are more prevalent in the ecosystem today and the system should be looked at. Thats good. I say cautious optimism because we dont know what the outcome of this rulemaking will be. If in the end, the rules are strengthened, thats a good thing. But you have to be weary of potential bad players, or others coming in attempting to weaken the rules. So until we see what the final process of the product is, i cannot say we will be happy or sad. But i dont want to prejudge the process, because its good they are starting it. I had the privilege of testifying to the Senate Judiciary a month or so ago on the topic of protecting innocence in a digital world. The ftc camearing under a barrage of criticisms. Do you share the level of criticism . Or more positively, what more could the ftc do . Particularly in the kids privacy space, the jury is out. Everyone knows in this room, there is a case pending about youtube. And whether they violated and what the fine will be, and what new obligations will be placed on google. Has not yet been announced. I think what they do in that beticular case will indicative of the position the commission is taking with regards to how serious they are about enforcing coppa. So i dont want to say yet. We will see what they do. Im sure you can speak to the politico proposals, ventured three in the thats mentioned three of them this morning. Mentioned three of them this morning. We are busy, its a trifecta of bills, the first is coppa to 2. 0. T along to be consistent with california and gdpr theould you tell us about acronym . General Data Protection regulation, coppa is only 12 and under, senator markey believes 15yearolds need special protection, not necessarily the same as 12 and under, but still special protections. So the bill extends protections to 13, 14, and 15yearolds, changing the knowledge standard from actual to constructive, banning targeted ads and any button button eraser that allows parents and children to erase information. The other bills are the camera , the children and immediate research act, directing any age to do a fiveyear study on the impact of technology on children. Obviously kids are glued to these things, so what are the socioemotional, cognitive, and physical impacts in this incredible increase in technology by children. And the last bill is called the kids act, the kids internet design and safety act, which is seeking to get the ftc new authorities to address exactly what i was just describing. The practices by many websites to glue children to devices. All of the strategies they use regarding autoplay and other functions to suck kids in and ensure that they do not stop watching. I have a threeyearold, it works well on him, he will not stop watching the device unless i rip it out of his hands. Bill will be introduced in september and october, which addresses what we do about that issue. In our experience, parents are equally glued its a problem. This room is doing pretty well, this is a testament to how good this panelist, there are not that many people on their phones right now. But we do want you to tweet, from time to time. [laughter] the last question at this point, do you think coppa should be modified . Where are we looking for total rewrite . Modification. So you dont want to throw coppa out . Bill, as evidenced in the we are seeking changes and modifications to the 12 and and new protections for 13 through 15, but not a complete rewrite of coppa. It has been effective, but as bedenced by the ftc, it can improved upon because the world clearly looks different than when it passed in 1998. This is a perfect segue to you, jim, when you wrote the bill in 1998, when we were all much younger, 20 years ago, how has the world changed . 20 years ago i had a , who isold child driving up this afternoon to enter his senior year of college. Time. Good long period of we have really seen a nascent internet age, where in particular forms of karen parental consent were limited, to a world where people authenticate all the time for a variety of different things. I think that offers some opportunities. One of the barriers, as we have before, is that it is difficult to get ,erifiable parental consent that the idea of creating of getting into a coppa compliant barrier. Is a real it discourages investment in content and activities for kids that could be positive. But one could imagine a world where authentication is much easier, and straightforward. That may be less of a Walled Garden were now much can grow, practically. I think this potential rulemaking presents an coppaunity to make realistic, not weak, but realistically reflect on the fact that people will not give away their credit cards for. Erification easierallow a much authentication with a lower barrier for parents to agree for their younger children to have learning opportunities. And, at the same time, to take issued by the fec over time, which are very good ftc overtime, which are very good, to streamline them and for them in the rule, including things like what content is targeted to children. The commission has done a lot of good inking, including looking at the advertising of and on a site, which can reflect whether the site is targeted to children or not read the rulemaking to addressrtunity and raise the profile of some of these issues. I havesame time, questions about the other elements of the kids act, and questions in the rulemaking about how some of these other ideas would work in practice. I would not describe them as concerns, but they are questions and they are worth exploring. But i think essentially putting ,n the rule and clarifications including about educational Online Platforms, to make absolutely clear that the school acts in loco parentis where ferpa applies. These are ways to break down the and i think coppa discourages the layout of new firms of forms of learning for kids online. But at the same time, take the which isand faqs designed to look quite broadly at what sites are targeted to children. And the ftc does a lot of of coppa. T the Senate Hearing overlooks that this is an area where the ftc is very active, that, public education, and changes to the rule can i think sensitize a lot of sites to the fact that they may be have certain portions of their site which are targeted to children. This is an opportunity in this new world where there has been a lot of evolution and guidance from the commission over the past 10 years that could go into the rule. About 10 years ago we did a panel in london, and we agreed that coppa had become this kind of global standard, that the europeans had adopted it and similarly in asia. But now we are seeing in gdpr that it is coming back at us. There are new regulatory regimes, particularly in europe, which we will now have to pay attention. What other International Trends you see, publicly and positively and negatively impact . This is an area, speaking as someone who coheads a global privacy practice with lawyers in 40 countries who follow it, this is an area were Different Countries look at this differently. We have a first amendment. Many countries dont. There are key issues that 15yearolds ability to its acate, in europe, concern but its not the same order of concern. Europeis taking even alone, has not taken a uniform approach. Each e. U. Member state has established the age where can parental consent is not required , and consent by the individual can substitute, varying between 14 and 16. We have seen diversions there, a different approach in japan, countries updating their privacy laws do not adopt a uniform point of view. In the u. S. , california has moved forward with its own privacy law, taking the view that kids between the ages of 13 and 15 should affirmatively , and this is a somewhat particular definition or useeans monetization in thirdparty advertising in exchange for something of value but essentially use of information in thirdparty advertising, if the website or Online Service or any business offline has actual knowledge that they are dealing with a child. Or teenager. The result is now something that the kids act goes way beyond the requirements of california law, but the broad idea of office in consent for teenagers consent in opt in for teenagers is something that various companies are working. Ard to rollout bear in mind that california is a seventh of the u. S. Economy and has a huge number of people will and that law takes effect january 1, 2020. We are seeing changes, its a little different because this is opt intot of sale or sale. We are seeing changes in the u. S. And around the world. Im going to ask you about concerns about what is going on with the coppa review and also the proposals that are coming from senator markey and others. I have questions more than anything else. Issuek theres really an with constructive knowledge constructed knowledge . What does that mean in practice and how is it operationalized . Does it mean that a website or reallyservice needs to gauge very heavily, and potentially drive a lot of people through because they might be dree deemed to have constructed knowledge to prove that they are not teenagers . If thats the results, this wi