The Electronic Frontier Foundation (EFF) writes to share our concerns with the current text of the Children and Teens’ Online Privacy Protection Act (S. 836).1 While we admire the sponsor’s longstanding commitment to protecting the privacy of children and adults and we believe the goals of the bill are laudable, we are concerned that the current version of the legislation would have some unintended consequences that could ultimately jeopardize the same people the bill seeks to protect. Therefore, EFF suggests a change to the bill as the Committee begins consideration.
EFF applauds that the bill provides greater privacy protections to more young people than under the current law, by increasing the age of the covered user from under 13 to under 17. This bill also recognizes that teens need some amount of privacy and autonomy by allowing children between 13-16 to consent to data collected for commercial purposes, rather than requiring those teens to get their parents’ consent.
However, the bill’s big change from current law is likely to result in increasing privacy and security risks for young people online. Under COPPA, a service must obtain verifiable parental consent before collecting personal information from children under 13 if it either (1) directs its services to children or (2) has actual knowledge that the user is a child. The bill would amend the actual knowledge standard to a much lower standard: “knowledge fairly implied on the basis of objective circumstances”3 is defined for purposes of the bill as “whether a reasonable and prudent person under the circumstances would have known that the user is a child or teen.”
We oppose this change because we fear online services will implement burdensome and privacy invasive age-verification gates to comply with the bill's lower knowledge standard. The bill's “knowledge fairly implied” standard is essentially a negligence standard, which is one of the lowest mental standards recognized by law.
EFF continues to advocate for comprehensive consumer data privacy legislation, for Americans of all ages, which would protect all users’ privacy without also implicating the free speech rights of adults. At minimum, Congress should not incentivize general audience websites to go in the opposite, privacy-invasive, direction.
