Proposed changes to US children’s privacy rules count biometrics as personal data

The U.S. Federal Trade Commission, unencumbered by more conservative members, is changing the nation’s primary regulation controlling commercial access to children’s personal data.

The FTC issued a statement this week saying it intends to change the Children’s Online Privacy Protection, or COPPA rule, last updated a decade ago. It is seeking public comment.

Any changes would likely be somewhat easier to implement given that the current FTC’s two Republican commissioners resigned in the last year in protest of what they said was Kahn’s activist agenda. Kahn sits with two other Democrats in leading the agency.

Of the proposed changes, two stand out.

FTC Chair Lina Khan says she wants to alter the use of digital tools to surveil children for data, including biometrics.

She feels vendors are “outsourcing their responsibilities to parents.” Companies would have to do a better job guarding children’s personal information.

Surveillance of persistent identifiers without verifiable parental consent right now is legal so long as the organization does not collect other personal data and uses the identifiers to support internal operations of an online service.

That exemption would remain in the update but only if there is more communication with parents.

Companies would have to post online notices stating which specific functions would benefit from the collected data and what limits are placed on the data’s use.

Perhaps more consequentially, the commission wants to add the term biometric identifiers to the commission’s definition of personal information.

Notice of the rulemaking states that “a coalition of consumer groups” has pushed for the addition of biometric identifiers. It also calls for “appropriate exceptions” to the proposal. One is data that “enhances the security of a child-directed service” so long as it is promptly deleted.

Inferred data, which includes predictive behavior, will be discussed for inclusion, according to the FTC.

A 60-day comment period will open after the proposal is published in the Federal Register.

Article Topics

biometric identifiers  |  biometrics  |  children  |  COPPA  |  data protection  |  FTC  |  U.S. Government