[Senate Hearing 111-968]
[From the U.S. Government Publishing Office]



                                                        S. Hrg. 111-968
 
    AN EXAMINATION OF CHILDREN'S PRIVACY: NEW TECHNOLOGIES AND THE 
                CHILDREN'S ONLINE PRIVACY PROTECTION ACT

=======================================================================

                                HEARING

                               before the

   SUBCOMMITTEE ON CONSUMER PROTECTION, PRODUCT SAFETY, AND INSURANCE

                                 of the

                         COMMITTEE ON COMMERCE,
                      SCIENCE, AND TRANSPORTATION
                          UNITED STATES SENATE

                     ONE HUNDRED ELEVENTH CONGRESS

                             SECOND SESSION

                               __________

                             APRIL 29, 2010

                               __________

    Printed for the use of the Committee on Commerce, Science, and 
                             Transportation




                  U.S. GOVERNMENT PRINTING OFFICE
66-284                    WASHINGTON : 2011
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, U.S. Government Printing Office. Phone 202ï¿½09512ï¿½091800, or 866ï¿½09512ï¿½091800 (toll-free). E-mail, [email protected].  

       SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION

                     ONE HUNDRED ELEVENTH CONGRESS

                             SECOND SESSION

            JOHN D. ROCKEFELLER IV, West Virginia, Chairman
DANIEL K. INOUYE, Hawaii             KAY BAILEY HUTCHISON, Texas, 
JOHN F. KERRY, Massachusetts             Ranking
BYRON L. DORGAN, North Dakota        OLYMPIA J. SNOWE, Maine
BARBARA BOXER, California            JOHN ENSIGN, Nevada
BILL NELSON, Florida                 JIM DeMINT, South Carolina
MARIA CANTWELL, Washington           JOHN THUNE, South Dakota
FRANK R. LAUTENBERG, New Jersey      ROGER F. WICKER, Mississippi
MARK PRYOR, Arkansas                 GEORGE S. LeMIEUX, Florida
CLAIRE McCASKILL, Missouri           JOHNNY ISAKSON, Georgia
AMY KLOBUCHAR, Minnesota             DAVID VITTER, Louisiana
TOM UDALL, New Mexico                SAM BROWNBACK, Kansas
MARK WARNER, Virginia                MIKE JOHANNS, Nebraska
MARK BEGICH, Alaska
                    Ellen L. Doneski, Staff Director
                   James Reid, Deputy Staff Director
                   Bruce H. Andrews, General Counsel
                 Ann Begeman, Republican Staff Director
             Brian M. Hendricks, Republican General Counsel
                  Nick Rossi, Republican Chief Counsel
                                 ------                                

   SUBCOMMITTEE ON CONSUMER PROTECTION, PRODUCT SAFETY, AND INSURANCE

MARK PRYOR, Arkansas, Chairman       ROGER F. WICKER, Mississippi, 
BYRON L. DORGAN, North Dakota            Ranking
BARBARA BOXER, California            OLYMPIA J. SNOWE, Maine
BILL NELSON, Florida                 JIM DeMINT, South Carolina
CLAIRE McCASKILL, Missouri           JOHN THUNE, South Dakota
AMY KLOBUCHAR, Minnesota             JOHNNY ISAKSON, Georgia
TOM UDALL, New Mexico                DAVID VITTER, Louisiana


                            C O N T E N T S

                              ----------                              
                                                                   Page
Hearing held on April 24, 2010...................................     1
Statement of Senator Pryor.......................................     1
Statement of Senator Wicker......................................     2
Statement of Senator Rockefeller.................................     3
    Prepared statement...........................................     5
Statement of Senator Klobuchar...................................     5

                               Witnesses

Jessica Rich, Deputy Director, Bureau of Consumer Protection, 
  Federal Trade Commission.......................................     7
    Prepared statement...........................................     8
Timothy Sparapani, Director, Public Policy, Facebook.............    13
    Prepared statement...........................................    14
Michael D. Hintze, Associate General Counsel, Microsoft 
  Corporation....................................................    19
    Prepared statement...........................................    21
Kathryn C. Montgomery, Ph.D., Professor, School of Communication, 
  American University............................................    33
    Prepared statement...........................................    34
Marc Rotenberg, Executive Director, EPIC and Adjunct Professor, 
  Georgetown University Law Center...............................    40
    Prepared statement...........................................    42
Berin Szoka, Senior Fellow and Director, Center for Internet 
  Freedom, The Progress & Freedom Foundation.....................    47
    Prepared statement...........................................    49

                                Appendix

Response to written questions submitted by Hon. Mark Pryor to:
    Jessica Rich.................................................    99
    Timothy Sparapani............................................   102
    Michael D. Hintze............................................   104
    Kathryn C. Montgomery........................................   108
    Berin Szoka..................................................   112


    AN EXAMINATION OF CHILDREN'S PRIVACY: NEW TECHNOLOGIES AND THE 
                CHILDREN'S ONLINE PRIVACY PROTECTION ACT

                              ----------                              


                        THURSDAY, APRIL 29, 2010

                               U.S. Senate,
      Subcommittee on Consumer Protection, Product 
                             Safety, and Insurance,
        Committee on Commerce, Science, and Transportation,
                                                    Washington, DC.
    The Subcommittee met, pursuant to notice, at 10:07 a.m. in 
room SR-253, Russell Senate Office Building, Hon. Mark Pryor, 
Chairman of the Subcommittee, presiding.

             OPENING STATEMENT OF HON. MARK PRYOR, 
                   U.S. SENATOR FROM ARKANSAS

    Senator Pryor. I'll go ahead and call our hearing to order 
this morning.
    I want to welcome our witnesses, thank all of you all for 
being here.
    This morning, we'll examine children's privacy and how well 
the Children's Online Privacy Protection Act, or COPPA, is 
working.
    The Consumer Protection Subcommittee has jurisdiction over 
the Federal Trade Commission, which enforces this statute. The 
FTC is currently engaged in reexamining the implementation and 
effectiveness of COPPA. Protecting our children's online 
privacy and safety is a critical issue whose importance cannot 
be overstated. Online abuses, such as harassment, threats, and 
cyberbullying should never be tolerated.
    Today's discussion could not come at a more pivotal time, 
as technology developments and innovations, while greatly 
beneficial in many respects, contribute to the complexity of 
today's online space.
    I'm concerned about our kids' online safety, for a number 
of reasons:
    First, we know that, while some companies are making great 
strides to protect young people from predators and online 
dangers, the disclosure of personal information by young people 
is prevalent. Researchers are still unpacking the implications 
of this disclosure.
    Second, recent reports have suggested that location-based 
advertising is tied to social networking. It also appears that 
certain technologies, such as GPS tracking capabilities, could 
track children, without their knowledge. As more kids have 
access to phones, and as tracking devices and mobile 
technologies increase in sophistication, greater understanding 
of how children could be impacted is essential.
    Third, we know that our young children are using the 
Internet now more than ever before, and we know that they 
represent a large portion of total online activity. And, 
according to one report, in the last 5 years, we have seen the 
time spent online by kids ages 2 to 11--ages 2 to 11--increase 
by 63 percent. Children of that age make up almost 10 percent 
of online users.
    I'm interested in all the witnesses' thoughts regarding the 
appropriateness of the statute's age limits, what constitutes 
children's personal information, how parental consent is best 
achieved, and how operators maintain the confidentiality and 
security of the information that they do collect, when 
authorized, about children.
    I know that this FTC is considering both how to better 
prevent the authorized collection or the use of children's 
information, and how to educate parents and teachers about the 
importance of encouraging children to protect themselves 
online.
    And I look forward to hearing from all of our witnesses, 
especially FTC, on what they're doing. And I also want to thank 
all of our witnesses for being here today.
    Not all members of the business community were willing to 
present their views. Specifically, we had asked Apple and 
Google to come, but they declined. I think that's unfortunate, 
because they are major players in this area. And we're going to 
have a long and in-depth conversation that starts today, but 
this is going to go on into the future, and I think it's 
unfortunate that Apple and Google chose not to participate in 
this discussion.
    So, with that, I'd like to turn it over to my Ranking 
Member, Senator Wicker.

              STATEMENT OF HON. ROGER F. WICKER, 
                 U.S. SENATOR FROM MISSISSIPPI

    Senator Wicker. Thank you, Mr. Chairman, for holding this 
important hearing to examine the Children's Online Privacy 
Protection Act, COPPA, and its application in today's ever-
changing technological world.
    We, as the Subcommittee responsible for consumer 
protection, are mindful that protecting our children is 
essential, and I applaud you, Mr. Chairman, for your commitment 
toward this goal.
    The Internet provides the opportunity to share information 
for both adults and children. This has led to our current 
revolution in the availability of information to almost anyone 
who has access to a computer.
    A flood of information, however, brings new challenges. One 
such challenge has been how to ensure the privacy of 
information for children when they use the Internet.
    COPPA was created to address the privacy concerns that 
arise with Internet users under the age of 13. This law has 
worked for many years to maintain the security of children's 
personal information when it is collected online. It also 
ensures that parents know what tools and resources are 
available to help them be more aware of, and have some control 
over, what their children are doing online.
    I commend the FTC for its continued efforts to enhance 
parents' involvement in children's online activities. I 
particularly want to highlight the consumer education efforts 
at the FTC. Making consumers and businesses aware of their 
rights and responsibilities is one of the most effective ways 
to ensure that the law achieves its goals.
    One of the best examples of this is the FTC's NetCetera 
guide, which teaches adults how to explain to children the 
risks that can be associated with online conduct. However, even 
with these efforts, there are still many challenges parents 
face in protecting their children's information online, and it 
is important that the law be equipped to meet those challenges 
as they develop.
    Keeping pace with technological changes is a difficulty 
that many industries face. It seems that, almost every day, a 
new service, a new application, or a new product is unveiled 
that is a little faster, a little better, and a little more 
complicated than we were using yesterday. This presents new and 
unique challenges in efforts to make sure that technologies are 
safe for consumers.
    I've been a parent for many years, and it is important to 
me to keep my children safe. I'm also a new grandparent, and 
I'm amazed to think about the opportunities that my 5-week-old 
granddaughter will have. Her generation will be able to access 
information and learn so much more than those of us in this 
room ever imagined. A significant portion of those 
opportunities will be available through online technology and 
innovations occurring today, tomorrow, and years into the 
future. These rapid and continued technological changes, 
however, can make it difficult to consider regulations for the 
Internet.
    Our first priority is to ensure safety, but we must also 
take care not to stifle innovation and business development 
that drives our economy and makes possible so many of the 
opportunities available to our children.
    There have been many suggestions about ways to improve 
COPPA and help it meet Congress's goals in today's world. 
However, there have also been many concerns expressed about the 
effect that these changes could have, not only on innovation, 
but also on the very goals that COPPA strives to achieve. I 
think it's important for us to take time to consider these 
conflicting concerns and better understand their ramifications 
in both children's online privacy and children's online 
experience.
    Thank you, Mr. Chairman.
    Senator Pryor. Thank you.
    Senator Rockefeller?

           STATEMENT OF HON. JOHN D. ROCKEFELLER IV, 
                U.S. SENATOR FROM WEST VIRGINIA

    The Chairman. Thank you, Mr. Chairman.
    And you've already pointed out the 60 million children who 
are availing themselves of these technologies, these days. And 
I listened to the good Senator from Mississippi, and I 
understand the need to encourage innovation. But, every time 
it's a choice between protecting children or protecting privacy 
and protecting innovation, we always seem to go with 
innovation, and we never go with privacy. So, that's what COPPA 
is all about.
    And I'm shocked--I'm absolutely shocked that children from 
2 to the age of 13--which is totally irrelevant, really; I 
mean, it ought to be ``children''--``children are children up 
until 25,'' or something like that, aren't they? I mean, 
they're just----
    [Laughter.]
    The Chairman. It's ridiculous. So, they get YouTube, 
Google, Facebook, and then two somewhat less decent terms that 
no parent would want their child searching for on the web. And, 
of course, that's the point.
    So, accessing these websites, whether they're well known or 
popular or outright illegal, have enormous privacy 
considerations. And this is not an innovation meeting; this is 
a privacy meeting. We do that in this committee; we protect 
people. And particularly, we protect children, because they are 
the most vulnerable of all.
    So, a lot of these companies are collecting personal 
information, and that's a benign term, until it becomes very 
unbenign and people are giving up all kinds of information 
that--they have no idea.
    So, we passed COPPA, as has been indicated. And the idea 
was to keep personal information private. But, then the whole 
world has changed since that happened, technologically. The 
entire world has changed. And so, the FTC began an important 
effort to review its rules. It actually probably should have 
done so--started somewhat earlier; and I want to talk about 
that, but at least they're doing it. And I really think that 
Congress has to take a very hard look at whether COPPA should 
be updated, if FTC isn't going to do it, to cover new kinds of 
information, new businesses.
    And I look forward to working with Senator Pryor. And I 
want to echo what he said. I appreciate the fact that Microsoft 
and Facebook are here. I also do not appreciate the fact that 
Apple and Google are not here. And I'm curious as to why 
they're not. Was it too expensive to send an associate or legal 
counsel? Was it a financial matter; they couldn't get the 
people here because they couldn't afford the plane tickets? 
Were they trying to avoid something? Were they trying to hide 
something? When people don't show up when we ask--I have this 
power of the subpoena, which I would absolutely love to use. I 
have not, to this point. But, what it all does, it increases 
our interest in what they're doing and why they didn't show up. 
So, they made a stupid mistake by not showing up today, and I 
say, ``Shame on them.''
    So, this is an introductory hearing. We're starting an 
important public discussion; all of us here, tremendously 
interested in this. And, you know, children's safety comes 
first, always.
    And so, we begin. And, as the Chairman has said, this is 
going to be the first of a number of hearings. Children are to 
be taken seriously. They're not. They're part of an age that 
we're not part of in technology, and it's dangerous for them. 
There are all kinds of horrible things that they can see; 
parents don't know about it. They don't know about it, they 
don't know what the rules are. And so, we have 
responsibilities.
    I thank the Chair.
    [The prepared statement of Senator Rockefeller follows:]

          Prepared Statement of Hon. John D. Rockefeller IV, 
                    U.S. Senator from West Virginia

    Thank you, Senator Pryor, for your outstanding work as Chairman of 
the Subcommittee on Consumer Protection.
    According to a recent study, children ages 2 through 11 make up 9.5 
percent of online users. That's nearly 16 million children, and the 
number is rapidly growing.
    A decade ago, going online meant accessing the Internet on a 
computer in your home. Today, it also includes iPhones, portable games, 
and interactive TVs. As powerful and exciting as these new developments 
are, a changing world brings new risks.
    For instance, a recent survey found that the top five Internet 
searches by children under 13 were for the terms: ``YouTube,'' 
``Google,'' ``Facebook,'' and two somewhat less decent terms that no 
parent would want their young child searching for on the web.
    Accessing these websites, whether they are well-known and popular 
or outright illegal, have enormous privacy implications that I fear 
parents are unaware of, and I know children do not understand.
    Many companies are collecting personal information and monetizing 
it. This commercial practice has a particular impact on our children.
    We have a responsibility to understand this rapidly changing 
digital landscape and to give parents the tools they need to protect 
their children's privacy.
    In 1988, we passed the Children's Online Privacy Protection Act, or 
``COPPA'', requiring websites to get parents' consent before collecting 
or using any personal information from children.
    Since then, the way children use the Internet has changed 
dramatically. Some online technologies that are nearly ubiquitous today 
did not even exist a few years ago.
    So in January, the FTC began an important effort to review its 
rules. But with such rapid change, I firmly believe Congress also must 
take a hard look at whether COPPA should be updated to cover new kinds 
of information and new businesses. I look forward to working with 
Senator Pryor in this examination.
    I very much want to thank Microsoft and Facebook for testifying. I 
have to say that I am disappointed Apple and Google have declined to 
participate today. These two companies are at the forefront of 
technological developments in the online world.
    With this introductory hearing, we are starting an important public 
discussion with direct implications on children's privacy. Apple and 
Google's refusal to take part does not speak well of their commitment 
to working with Congress on this issue going forward.
    I want to close by noting that children's privacy is strongly 
connected to children's safety, and I believe in my core that all 
children deserve special protections. Always. Period.
    It's important not to conflate the two issues, but privacy and 
safety most certainly overlap.
    To parents, nothing is more important than protecting our children. 
Nothing. I am enormously alarmed by the rise in criminal behavior 
targeting children online, from ``cyber-bullying'' to adult predators.
    These frightening trends are directly connected to the fact that 
our children's sensitive, personal information is being increasingly 
exposed to the public.
    I look forward to continuing this important discussion and working 
together--Congress, the FTC, and online stakeholders--to make sure 
nothing comes before the safety and security of our children.

    Senator Pryor. Thank you, Mr. Chairman.
    And I would note for the record that Chairman Rockefeller 
has a long and distinguished and successful career in 
protecting children.
    Senator Klobuchar.

               STATEMENT OF HON. AMY KLOBUCHAR, 
                  U.S. SENATOR FROM MINNESOTA

    Senator Klobuchar. Thank you very much, Mr. Chairman.
    And thank you, also, Senator Rockefeller, for all the work 
you've done in this area.
    It's remarkable, as my colleagues have noted, how quickly 
technology has changed over the last few years. The old joke--I 
still remember this--people would say, ``Well, if you want to 
program your VCR, ask your kid.'' But, now VCRs are a thing of 
the past. New technologies, devices, programs, and applications 
have completely changed the way we work and the way we 
communicate. From GPS and GeoLocation on Smartphones, to the 
ubiquity of text-messaging and Twitter, to posting our photos 
on social networking sites, the world is quickly changing.
    And no group adapts to new technology quicker than young 
people. And as was noted by my colleagues, nearly 16 million 
kids aged 2 through 11 are active online, and they make up, I 
think, 9.5 percent of online users. And these numbers are 
growing as more and more young people are logging on. The 
average young child spends more than 11 hours a month on the 
Internet, a 63-percent increase over 5 years ago. And this is 
one of the more sad facts. One survey found that the top five 
Internet searches for children under 13 are YouTube, Google, 
Facebook, sex, and porn.
    Clearly, the online world has changed dramatically. I think 
if you look back when these COPPA rules were adopted, 10 years 
ago, that wouldn't have been the case; you probably could have 
hardly even checked what kids were checking, and they probably 
weren't checking into any of these things. And so, it is very 
important that we examine this rule to ensure that it keeps up 
with the technology.
    I've just heard a lot of stories in our state, working with 
Senator Thune on the peer-to-peer legislation that we have, of 
changing technology that while it's so great in so many ways 
for innovation, has also severely hurt people's privacy rights. 
And when it comes to kids, we reach a whole new level.
    So, I'm looking forward to working with my colleagues to 
work on this rule and make changes that are in the best 
interest of everyone.
    Thank you very much.
    Senator Pryor. Thank you, Senator Klobuchar.
    And I would like to say that, for all of our witnesses--we 
have a very distinguished panel today, and that we could spend 
a lot of time introducing them and going through all their 
experiences and their degrees and all their backgrounds. And 
it's a very impressive group. But, that is all part of the 
record.
    And so, what I'm going to do is, I'm just going to go down 
the line, introduce each one, and ask each one to make a 5-
minute opening statement. And what I'd like for you all to do 
is just pay attention to the lights there in front of you, and 
when 5 minutes is over, we would love for you to, you know, 
wrap it up.
    First, I would like to introduce Jessica Rich; she's the 
Deputy Director of the Bureau of Consumer Protection at the 
Federal Trade Commission. Second is Timothy Sparapani, Director 
of Public Policy at Facebook. Next is Mike Hintze; he's the 
Associate General Counsel at Microsoft. Next is Kathryn 
Montgomery, Ph.D.; she's Professor of School of Communications 
at American University. Next is Marc Rotenberg; he's Executive 
Director of Electronic Privacy Information Center. And last, 
and certainly not least, at the children's table, here----
    [Laughter.]
    Senator Pryor.--we have--and I'm sorry that our table is 
only so long this morning--but, anyway, we have Berin Szoka; 
he's Senior Fellow, Director of the Center for Internet Freedom 
at The Progress & Freedom Foundation.
    So, thank all of you all for being here.
    And, Ms. Rich, if you could lead us off.

STATEMENT OF JESSICA RICH, DEPUTY DIRECTOR, BUREAU OF CONSUMER 
              PROTECTION, FEDERAL TRADE COMMISSION

    Ms. Rich. Mr. Chairman and members of the Committee, I'm 
Jessica Rich, Deputy Director of the Bureau of Consumer 
Protection at the Federal Trade Commission. I appreciate this 
opportunity to update you regarding the FTC's work to protect 
children's privacy and enforce the Children's Online Privacy 
Protection Act, or COPPA.
    We have submitted a written statement today which 
represents the views of the FTC. The views expressed orally, 
and my responses to questions, are my own and do not 
necessarily reflect the views of the Commission or any 
commissioner.
    The Federal Trade Commission is deeply committed to helping 
to create a safer, more secure online experience for children. 
The Commission's rule implementing COPPA became effective 10 
years ago. The statute and rule apply to operators of websites 
and online services directed to children under age 13 and to 
other website operators that have actual knowledge that they 
are collecting information from children.
    Covered website operators must provide notice of their 
information collection practices and, with limited exception, 
obtain verifiable parental consent prior to the collection, 
use, or disclosure of personal information from children. 
Operators also must give parents the opportunity to review and 
delete personal information that their children have provided.
    The Commission has taken a multipronged approach to rule 
compliance that includes enforcement, education, and 
implementation of the statutory mandated COPPA safe harbor 
program. On the enforcement side, the Commission has brought 14 
law enforcement actions alleging COPPA violations. The FTC's 
early COPPA cases focused on children's sites that collected 
extensive amounts of personal information without providing 
notice to parents and obtaining their consent.
    More recent enforcement actions have focused on operators 
of both general audience and child-directed social networking 
sites, and sites with interactive features that permit children 
to divulge their personal information online.
    A crucial complement to our law enforcement efforts is 
educating businesses about their responsibilities under the 
law. The FTC has published comprehensive compliance materials, 
which are available on our website. We also devote significant 
resources to answering individual requests from companies about 
rule compliance, and to conducting outreach to industry groups. 
Our goal in these efforts is to prevent COPPA violations before 
they occur.
    The Commission's consumer education materials aim to inform 
parents and children about the protections afforded by the 
rule, so they know what to expect and what to look for as they 
navigate online. These materials are available through the 
Commission's online safety portal, OnGuardOnline.gov. 
OnGuardOnline provides practical and plain-language information 
about COPPA and other privacy and safety topics, in a variety 
of formats, including articles, games, quizzes, and videos.
    Our most recent addition is the NetCetera guide, which 
Senator Wicker was kind enough to mention at the beginning.
    In light of significant changes to the online environment, 
including the explosive growth of social networking, mobile web 
technologies, and interactive gaming, the Commission recently 
initiated a review of the rule.
    On March 24 of this year, the Commission launched a public 
comment period aimed at gathering input on a wide range of 
issues, including whether the rule's definition of ``Internet'' 
adequately covers certain types of mobile communications and 
interactive media, whether the rule's definition of ``personal 
information'' has kept pace with technological developments--
that is, whether certain information that isn't named and 
listed in the rule, such as static IP address, could allow a 
website to contact a child; the effectiveness of mechanisms 
used to--and another topic is the effectiveness of mechanisms 
used authenticate parents who provide consent or seek access to 
their children's information.
    The comment period for these questions closes on June 30. 
On June 2, the Commission will host a public roundtable, here 
in Washington, to hear from stakeholders, including children's 
privacy advocates, website operators, businesses, academics, 
educators, parents, anyone who would like to come, on these 
important issues.
    The Commission takes seriously the challenge to ensure that 
COPPA continues to meet its originally stated goal, even as 
children's interactive media use moves from standalone PCs to 
other devices.
    Thank you, and I look forward to your questions.
    [The prepared statement of Ms. Rich follows:]

         Prepared Statement of Jessica Rich, Deputy Director, 
        Bureau of Consumer Protection, Federal Trade Commission

I. Introduction
    Chairman Pryor, Ranking Member Wicker, and members of the 
Subcommittee, my name is Jessica Rich, and I am the Deputy Director of 
the Bureau of Consumer Protection at the Federal Trade Commission 
(``Commission'').\1\ I appreciate the opportunity to appear before you 
today to discuss the Commission's implementation of the Children's 
Online Privacy Protection Act of 1998 (``COPPA'').\2\
---------------------------------------------------------------------------
    \1\ While the views expressed in this statement represent the views 
of the Commission, my oral presentation and responses to questions are 
my own and do not necessarily reflect the views of the Commission or 
any individual Commissioner.
    \2\See Children's Online Privacy Protection Act of 1998, 15 U.S.C. 
 6501-6508 (2009). The Commission's implementing regulations (the 
``COPPA Rule'') are found at 16 C.F.R. Part 312 (2009).
---------------------------------------------------------------------------
    The Federal Trade Commission is deeply committed to helping to 
create a safer, more secure, online experience for children. As such, 
the agency has actively engaged in law enforcement, consumer and 
business education, and rulemaking initiatives to ensure that knowledge 
of, and adherence to, COPPA is widespread. In the past 10 years, the 
Commission has brought fourteen law enforcement actions alleging COPPA 
violations and has collected more than $3.2 million in civil penalties. 
In addition, in light of significant changes to the online environment, 
including the explosion of social networking and the proliferation of 
mobile web technologies and interactive gaming, and the possibility of 
interactive television, the Commission has recently initiated an 
accelerated review of COPPA's effectiveness.
    This testimony first provides a brief legislative and regulatory 
overview of COPPA. It next summarizes the Commission's efforts to 
enforce COPPA and to educate businesses and consumers about the law. 
Finally, it discusses the Commission's current initiative to review its 
COPPA Rule in order to determine whether the Rule should be modified to 
address changes in technology that may affect children's privacy.
II. A Brief COPPA Overview
A. The Legislation
    Congress enacted COPPA in 1998 to address the unique privacy and 
safety risks created when young children--those under 13 years of age--
access the Internet. COPPA's legislative history reveals several 
critical goals: (1) to enhance parental involvement in children's 
online activities in order to protect children's privacy; (2) to 
protect children's safety when they visit and post information on 
public chat rooms and message boards; (3) to maintain the security of 
children's personal information collected online; and (4) to limit the 
collection of personal information from children without parental 
consent.\3\
---------------------------------------------------------------------------
    \3\ See 144 Cong. Rec. S12741 (Oct. 7, 1998) (statement of Sen. 
Bryan).
---------------------------------------------------------------------------
    COPPA applies to operators of websites and online services directed 
to children under age 13, and to other website operators that have 
actual knowledge that they are collecting personal information \4\ from 
such children (collectively, ``operators''). The statute generally 
mandates that operators covered by the Act provide notice of their 
information collection practices and, with only limited exceptions, 
obtain verifiable parental consent prior to the collection, use, or 
disclosure of personal information from children. Operators also must 
give parents the opportunity to review and delete personal information 
their children have provided. Operators are required to establish and 
maintain reasonable procedures to protect the security of personal 
information collected from children, and must not condition children's 
participation in website activities on the disclosure of more personal 
information than is reasonably necessary.\5\
---------------------------------------------------------------------------
    \4\ COPPA defines personal information as individually identifiable 
information about an individual collected online, including: a first 
and last name; a home or other physical address including street name 
and a name of a city or town; an e-mail address; a telephone number; a 
Social Security number; any other identifier that the Commission 
determines permits the physical or online contacting of a specific 
individual; or information concerning the child or the parents of that 
child that the website collects online from the child and combines with 
an identifier described in this paragraph. 15 U.S.C.  6501(8).
    \5\ 15 U.S.C.  6503(b)(1).
---------------------------------------------------------------------------
    COPPA contains a safe harbor provision enabling industry groups or 
others to submit to the Commission for approval self-regulatory 
guidelines to implement the statute's protections.\6\ The statute 
provides that operators who fully comply with an approved safe harbor 
program will be ``deemed to be in compliance'' with the Commission's 
COPPA Rule for purposes of enforcement.\7\
---------------------------------------------------------------------------
    \6\ 15 U.S.C.  6504. Since the Commission's COPPA Rule took effect 
on April 21, 2000, four groups have received Commission approval of 
their safe harbor programs: the Children's Advertising Review Unit of 
the National Advertising Division of the Council of Better Business 
Bureaus (``CARU''), the Entertainment Software Rating Board (``ESRB''), 
TRUSTe, and Privo, Inc. For information on the Commission's COPPA safe 
harbor process, see http://www.ftc.gov/privacy/privacyinitiatives/
childrens_shp.html.
    \7\ 15 U.S.C.  6504(b)(2).
---------------------------------------------------------------------------
B. The Commission's COPPA Rule
    COPPA mandated that the Commission promulgate and enforce 
regulations to implement the Act. The Commission published for public 
comment a proposed Rule in April 1999, and in November 1999 published 
its final Rule, which went into effect on April 21, 2000.\8\
---------------------------------------------------------------------------
    \8\ 16 C.F.R.  312 (2009).
---------------------------------------------------------------------------
    The Rule closely follows the statutory language, requiring 
operators to provide notice of their information practices to parents 
and, with limited exceptions, to obtain ``verifiable parental consent'' 
prior to collecting, using, or disclosing personal information from 
children under the age of 13. Verifiable parental consent, as set forth 
in the Rule, means that operators must use a consent method that is 
reasonably calculated, in light of available technology, to ensure that 
the person providing consent is the child's parent.\9\ The COPPA Rule 
sets forth a sliding scale approach to obtaining verifiable parental 
consent based upon the risks posed by the intended uses of the child's 
information.\10\ Under this approach, operators who keep children's 
information internal, and do not disclose it publicly or to third 
parties, may obtain parental consent by methods such as sending an e-
mail to the parent and then following up to confirm consent.\11\ By 
contrast, operators who disclose children's personal information to 
others must use a more reliable method of parental consent--either one 
of the methods outlined by the Commission, or an equivalent method 
designed to ensure that the operator is connecting with the child's 
parent.\12\
---------------------------------------------------------------------------
    \9\ 16 C.F.R.  312.5(b)(1).
    \10\ 16 C.F.R.  312.5(b)(2).
    \11\ The sliding scale mechanism, which initially was designed to 
expire in April 2002, was subsequently extended by the Commission. In 
2006, the Commission announced that it would extend the sliding scale 
approach indefinitely. See 71 Fed. Reg. 13247 (Mar. 15, 2006), 
available at www.ftc.gov/os/2006/03/P054505COPPARuleRetention.pdf.
    \12\ Such methods include, but are not limited to: using a print-
and-send form that can be faxed or mailed back to the operator; 
requiring a parent to use a credit card in connection with a 
transaction; having a parent call a toll-free telephone number staffed 
by trained personnel; using a digital certificate that uses public key 
technology; and using e-mail accompanied by a PIN or password obtained 
through one of the above methods. 16 C.F.R.  312.5(b)(2).
---------------------------------------------------------------------------
    COPPA authorizes the Commission to enforce the Rule in the same 
manner as it does rules promulgated under Section 18(a)(1)(B) of the 
Federal Trade Commission Act prohibiting unfair or deceptive acts or 
practices.\13\ This permits the Commission to obtain civil penalties 
against operators who violate the Rule. COPPA further authorizes state 
attorneys general to enforce compliance with the Rule by filing actions 
in Federal court with written notice to the Commission.\14\
---------------------------------------------------------------------------
    \13\ 15 U.S.C.  6503(c), 6506(a), (d); 15 U.S.C.  57a(a)(1)(B) 
(2009).
    \14\ 15 U.S.C.  6505. To date, only the state of Texas has filed 
law enforcement actions under the COPPA statute. See News Release, 
Office of Texas Attorney General Abbott Takes Action Against Web Sites 
That Illegally Collect Personal Information from Minors: Millions of 
Children Registered With The Popular Sites; Texas first state to take 
action under COPPA (Dec. 5, 2007), http://www.oag.state.tx.us/oagNews/
release.php?id=2288.
---------------------------------------------------------------------------
III. The Commission's COPPA Enforcement and Education Efforts
A. Enforcing COPPA
    In the 10-years since the Rule's enactment, the Commission has 
brought fourteen (14) COPPA enforcement actions that cut to the core of 
COPPA's goals--ensuring that parents are informed and have the right to 
say ``no'' before their young children divulge their personal 
information. These rights are especially important when, with the mere 
click of a mouse or the touch of a screen, a child's personal 
information can be viewed by anyone. Together, the Commission's actions 
have garnered more than $3.2 million in civil penalties.\15\
---------------------------------------------------------------------------
    \15\ News releases detailing each of the Commission's COPPA cases 
are available at www.ftc.gov/privacy/privacyinitiatives/
childrens_enf.html.
---------------------------------------------------------------------------
    In 2006, as social networking exploded onto the youth scene, the 
Commission redoubled its efforts to enforce COPPA. That year, the 
Commission obtained an order against Xanga.com, a then-popular social 
blogging site alleged to have knowingly collected personal information 
from, and created blog pages for, 1.7 million underage users--without 
obtaining their parents' permission. The Xanga.com settlement included 
a $1 million civil penalty.\16\
---------------------------------------------------------------------------
    \16\United States v. Xanga.com, Inc., No. 06-CIV-6853(SHS) 
(S.D.N.Y.) (final order Sept. 11, 2006).
---------------------------------------------------------------------------
    In 2008, the Commission obtained orders against two other operators 
of social networking sites. In January of that year, operators of the 
child-directed social networking site, Imbee.com, paid $130,000 to 
settle charges that they allegedly violated COPPA by collecting and 
maintaining personal information from over 10,500 children without 
first obtaining parental consent.\17\ Later that year, Sony BMG Music 
Entertainment paid a $1 million civil penalty to resolve allegations 
that the company knowingly and improperly collected a broad range of 
personal information from at least 30,000 underage children who 
registered on 196 of its general audience music fan sites.\18\
---------------------------------------------------------------------------
    \17\ United States v. Industrious Kid, Inc., No. 08-CV-0639 (N.D. 
Cal.) (filed Jan. 29, 2008).
    \18\ United States v. Sony BMG Music Entm't, No. 08-CV-10730 
(S.D.N.Y.) (final order Dec. 15, 2008).
---------------------------------------------------------------------------
    Most recently, the Commission charged Iconix Brand Group, Inc., the 
owner and marketer of several apparel brands popular with children and 
teens, with collecting and storing personal information from 
approximately 1,000 children without first notifying their parents or 
obtaining parental consent. The Commission's complaint further alleged 
that on one of its brand websites, Iconix enabled girls to share 
personal stories and photos publicly online. Iconix agreed to pay a 
$250,000 civil penalty to settle the Commission's charges.\19\
---------------------------------------------------------------------------
    \19\ United States v. Iconix Brand Group, Inc., No. 09-CV-8864 
(S.D.N.Y.) (final order Nov. 5, 2009).
---------------------------------------------------------------------------
B. Consumer and Business Education
    Although law enforcement is a critical part of the Commission's 
COPPA program, enforcement alone cannot accomplish all of the agency's 
goals in administering COPPA and the Rule. A crucial complement to the 
Commission's formal law enforcement efforts, therefore, is educating 
consumers and businesses about their rights and responsibilities under 
the law. By promoting business and consumer education, the Commission 
seeks to help the greater online community create a culture that 
protects children's privacy and security.
    The Commission's business outreach goals focus broadly on shaping 
prospective practices. The agency devotes significant resources to 
assisting website operators with Rule compliance, regularly updating 
business education materials and responding to inquiries from operators 
and their counsel.\20\
---------------------------------------------------------------------------
    \20\ To facilitate COPPA compliance, the Commission maintains a 
comprehensive children's privacy area on its website where businesses 
can find useful publications, including How to Comply with the 
Children's Online Privacy Protection Rule; You, Your Privacy Policy and 
COPPA; and How to Protect Kids' Privacy Online, as well as answers to 
Frequently Asked Questions (or ``FAQs''). See http://www.ftc.gov/
privacy/privacyinitiatives/childrens.html. Periodically, the Commission 
issues guidance on specific topics, like the Rule's requirements for 
the content of online privacy notices, and the COPPA ``actual 
knowledge'' standard for operators of general audience websites. In 
addition, the agency maintains a COPPA Hotline, where staff members 
offer fact-specific guidance in response to questions from website 
operators.
---------------------------------------------------------------------------
    The Commission's consumer education materials aim to inform parents 
and children about the protections afforded by the Rule and also 
provide them with general online privacy and safety information. The 
Commission's consumer online safety portal, OnGuardOnline.gov, provides 
practical and plain language information in a variety of formats--
including articles, games, quizzes, and videos--to help computer users 
guard against Internet fraud, secure their computers, and protect their 
personal information.\21\ The Commission's booklet, Net Cetera: 
Chatting With Kids About Being Online, is a recent addition to 
OnGuardOnline.gov. This guide gives practical tips on how parents, 
teachers, and other trusted adults can help children reduce the risks 
of inappropriate conduct, contact, and content that come with living 
life online. Net Cetera focuses on the importance of communicating with 
children about issues ranging from cyberbullying to sexting, social 
networking, mobile phone use, and online privacy.\22\ The Commission 
has partnered with schools, community groups, and local law enforcement 
to publicize Net Cetera, and has distributed more than 2.5 million 
copies of the guide since it was introduced in October 2009.
---------------------------------------------------------------------------
    \21\ The OnGuardOnline.gov website is the central component of the 
OnGuardOnline consumer education campaign, a partnership of the Federal 
Government and the technology community. Currently, 13 Federal agencies 
and a large number of safety organizations are partners on the website, 
contributing content and helping to promote and disseminate consistent 
messages.
    \22\ See OnGuardOnline, ``Net Cetera: Chatting With Kids About 
Being Online,'' available at http://www.onguardonline.gov/pdf/
tec04.pdf.
---------------------------------------------------------------------------
IV. The Current Regulatory Review
    In 2005, the Commission commenced a statutorily required review of 
its experience in enforcing COPPA.\23\ Specifically, Congress directed 
the Commission to evaluate: (1) operators' practices as they relate to 
the collection, use, and disclosure of children's information, (2) 
children's ability to obtain access to the online information of their 
choice; and (3) the availability of websites directed to children. At 
the same time, the Commission sought public comment on the costs and 
benefits of the Rule, including whether any modifications to the Rule 
were needed in light of changes in technology or in the marketplace.
---------------------------------------------------------------------------
    \23\ See 15 U.S.C.  6506(1).
---------------------------------------------------------------------------
    After completing that review, in 2007 the Commission reported to 
Congress that, in keeping with the legislative intent, the Rule: (1) 
played a role in improving operators' information collection practices 
and providing children with greater online protections than in the era 
prior to its implementation; (2) provided parents with a set of 
effective tools for becoming involved in and overseeing their 
children's interactions online; and (3) did not overly burden 
operators' abilities to provide interactive online content for 
children. Accordingly, the Commission concluded that there was a 
continuing need for those protections, and that the Rule should be 
retained without change.\24\ At that time, the Commission also 
acknowledged that children's growing embrace of mobile Internet 
technology and interactive general audience sites, including social 
networking sites, without the concomitant development of suitable age-
verification technologies, presented challenges for COPPA compliance 
and enforcement.\25\
---------------------------------------------------------------------------
    \24\ See Fed. Trade Comm'n, Implementing the Children's Online 
Privacy Protection Act: A Report to Congress (2007), available at 
http://www.ftc.gov/reports/coppa/07COPPA_Report
_to_Congress.pdf.
    \25\ See id. at 28-29.
---------------------------------------------------------------------------
    Although the Commission generally reviews its rules approximately 
every 10 years, the continued rapid-fire pace of technological change, 
including an explosion in children's use of mobile devices and 
participation in interactive gaming, and the possibility of interactive 
television, led the agency to accelerate its COPPA review by 5 years, 
to this year.\26\ Accordingly, on March 24, 2010, the Commission 
announced the start of a public comment period aimed at gathering input 
on a wide range of issues relating to the COPPA Rule, including:
---------------------------------------------------------------------------
    \26\ The Commission recently concluded a series of privacy 
roundtables exploring the challenges posed by the array of new 
technologies that collect and use consumer data. The Commission also 
sought public comment on these issues and currently is examining the 
comments and information developed at the roundtables. In addition, the 
Commission expects that information gathered during the course of the 
COPPA Rule review will help inform this broader privacy initiative. See 
Exploring Privacy: A Roundtable Series, http://www.ftc.gov/bcp/
workshops/privacyroundtables/index.shtml.

   The implications for COPPA enforcement raised by mobile 
        communications, interactive television, interactive gaming, and 
        other similar interactive media and whether the Rule's 
        definition of ``Internet'' adequately encompasses these 
---------------------------------------------------------------------------
        technologies;

   Whether operators have the ability, using persistent IP 
        addresses, mobile geolocation data, or information collected 
        from children online in connection with behavioral advertising, 
        to contact specific individuals, and whether the Rule's 
        definition of ``personal information'' should be expanded 
        accordingly;

   How the use of centralized authentication methods (such as 
        OpenId) will affect individual websites' COPPA compliance 
        efforts; \27\
---------------------------------------------------------------------------
    \27\ Centralized authentication methods offer a means for users to 
log on to different services using one digital identity. Services such 
as OpenId replace the common login process on individual websites with 
a single authenticated identification to gain access to multiple 
software systems. As a result, children who obtain an OpenId 
authentication might be able to gain back-door access to websites that 
otherwise would have provided them with COPPA protections or prevented 
their entry.

   Whether there are additional technological methods to obtain 
        verifiable parental consent that should be added to the COPPA 
        Rule, and whether any of the methods currently included should 
---------------------------------------------------------------------------
        be removed; and

   Whether parents are exercising their rights under the Rule 
        to review or delete personal information collected from their 
        children, and what challenges operators face in authenticating 
        parents.\28\
---------------------------------------------------------------------------
    \28\ See Request for Public Comment on the Federal Trade 
Commission's Implementation of the Children's Online Privacy Protection 
Rule, 75 Fed. Reg. 17089-93 (Apr. 5, 2010); see also News Release, Fed. 
Trade Comm'n, ``FTC Seeks Comment on Children's Online Privacy 
Protections; Questions Whether Changes to Technology Warrant Changes to 
Agency Rule'' (Mar. 24, 2010), http://www.ftc.gov/opa/2010/03/
coppa.shtm.

    The period for comment on these questions will close on June 30, 
2010. On June 2, before the comment period closes, the Commission will 
host a public roundtable at its Washington, DC Conference Center to 
hear from stakeholders--children's privacy advocates, website 
operators, businesses, academics, and educators and parents--on these 
important issues.\29\
---------------------------------------------------------------------------
    \29\ See News Release, Fed. Trade Comm'n, ``Protecting Kids' 
Privacy Online: Reviewing the COPPA Rule'' (Apr. 19, 2010), http://
www.ftc.gov/opa/2010/04/coppa.shtm.
---------------------------------------------------------------------------
V. Conclusion
    The Commission takes seriously the challenge to ensure that COPPA 
continues to meet its originally stated goals, even as children's 
interactive media use moves from stand-alone PCs, to handheld devices, 
and potentially beyond.
    Thank you for this opportunity to discuss the Commission's COPPA 
program. I look forward to your questions.

    Senator Pryor. Thank you.
    Mr. Sparapani?

           STATEMENT OF TIMOTHY SPARAPANI, DIRECTOR, 
                    PUBLIC POLICY, FACEBOOK

    Mr. Sparapani. Chairman Pryor and Rockefeller, Ranking 
Member Wicker, and other Subcommittee members, thank you for 
your leadership and for inviting me to share Facebook's 
perspective on child safety, and how Facebook's innovations 
promote a safer online environment for teens.
    From our inception, Facebook sought to provide a safer 
environment for all its users than was generally available on 
the Web. Facebook is not directed at children less than 13 
years of age residing in the U.S., and does not knowingly 
collect information from any children under 13 in the U.S. 
Nevertheless, we take seriously our responsibilities to protect 
children under 13 and enhance teen users' online safety.
    Accordingly, Facebook was built with COPPA's requirements 
in mind. Our commitment to keeping children off the site starts 
by requiring those trying to establish an account to enter 
their age on the very first screen. This birth date field 
prohibits children under 13 from establishing an account. This 
age-gate technology places a persistent cookie on the device 
used to attempt to establish an underage account, preventing 
the user from attempting to modify their birth date. When 
Facebook becomes aware of accounts established by children 
under 13, we terminate those accounts and delete all 
information.
    We emphasize two points today. First, Facebook's real-name 
culture and innovative technologies and policies enhance online 
safety and privacy for teens. And, two, Congress should not 
overhaul COPPA, but, rather, support and encourage, not 
discourage or prohibit, companies' innovations to advance child 
and teen online safety, security, and privacy.
    Facebook's approach to providing online safety leadership 
begins with the recognition that no existing system today can 
verify age of users online. As a result, Facebook developed an 
innovative, multilayer system to act as technological proxies 
for age verification. These layers are enhanced by Facebook's 
real-name culture, which helps us identify fake accounts.
    Before Facebook, Internet users were warned to avoid 
sharing their real names and information online. Facebook was 
the first major Internet site that required people to build 
their profiles and networks using real names. This made 
Facebook less attractive to predators and other bad actors, who 
prefer not to use their real names and identities. People are 
also less likely to engage in negative, dangerous, or criminal 
behavior when their friends can see their name, their speech, 
and their information that they're sharing. This real-name 
culture, therefore, creates accountability and deters bad 
behavior.
    Since Facebook users understand that their actions are 
recorded digitally, when users violate our site rules or the 
law, we can pinpoint corrective action to the specific account 
involved.
    Our real-name culture also empowers users to become 
community police and report violations. Facebook's users click 
our report button, found throughout the service, when they see 
inappropriate behavior. This substantially multiplies the 
number of people reviewing content and behavior, which we think 
greatly enhances teen safety.
    Further, Facebook's innovative privacy tools allow users to 
exercise direct control and share what they want with whom they 
want and when they want. This empowers users of all ages to 
protect themselves online. If a user feels uncomfortable 
connecting with a particular person, she may decline that 
friend request. If a user feels that a friend is annoying, 
harassing, or dangerous, she may block or de-friend that 
person, which terminates the user's connection and prevents 
further contact.
    Further, Facebook's proprietary technologies allow us to 
continuously improve online safety and combat emerging online 
threats. Although we do not generally discuss these matters 
publicly, for fear that they may be circumvented or 
compromised, these technologies allow Facebook to perform 
ongoing authentication checks. We look for behavior that does 
not fit the patterns created by the aggregate data from our 400 
million users. Let me tell you that suspicious behavior does 
stand out, which initiates a Facebook inquiry and immediate 
remedial actions.
    Facebook employs additional age-gating technologies to 
limit the contact and sharing between minors and adults; thus, 
reducing the opportunities for adults to pose as minors.
    Additionally, while those over 18 on Facebook can share 
information with everyone, Facebook automatically limits minor 
sharing to a much smaller subset of users, such as the minor's 
friends, friends of friends, and those in their verified 
networks, typically in their schools. This substantially 
reduces the visibility of minors to nonminors whom they do not 
know.
    Further, Facebook recognizes the importance of 
collaborating with others to innovate in this area. We're proud 
of our relationships with child and safety security experts and 
with law enforcement. We are particularly proud of our 
relationships with the attorneys general.
    In conclusion, although Facebook is not a service that is 
directed at children under 13, we've built our service, 
policies, and tools with COPPA in mind. Our experience tells us 
that Congress need not amend COPPA, at this time. In fact, any 
amendments might undo many of our innovative privacy and safety 
tools. Congress can, however, assist companies like us in 
advancing online child and teen safety by eliminating 
disincentives for child safety innovation. Congress should 
ensure regulators are not discouraging technological and policy 
safety advances when reviewing privacy and security policies 
and technologies at companies, like ours, that are trying to do 
the right thing.
    Thank you.
    [The prepared statement of Mr. Sparapani follows:]

          Prepared Statement of Timothy Sparapani, Director, 
                        Public Policy, Facebook

    Thank you Chairman Pryor, Ranking Member Wicker and Subcommittee 
Members. My name is Tim Sparapani and I am Director, Public Policy for 
Facebook. Thank you for inviting me to testify today concerning 
Facebook's perspective on online child safety. We are pleased to 
discuss some of our innovations that lead to a safer online 
environment. We believe these innovations--some of which are obvious to 
users and others that are not--are a key to providing a positive online 
experience.
    Facebook started in 2004 as a social networking site for college 
and university students and from inception, Facebook sought to provide 
a safer environment for all its users than was generally available on 
the web. Although Facebook is not directed to young children--you must 
be 13 years of age or older to join Facebook--the Company takes special 
steps to insure that users under 18 have a safer experience.\1\
---------------------------------------------------------------------------
    \1\ Facebook is not directed at children less than 13 years of age 
residing in the United States and does not knowingly collect 
information from any children under 13 in the United States. 
Nevertheless we recognize and take seriously our responsibilities as a 
corporation to protect children and enhance the online safety of 
children 13 years of age and older who are our users. Accordingly, 
Facebook was built with the requirements of the Child Online Privacy 
Protection Act (COPPA) in mind. When Facebook becomes aware of accounts 
established by children under the age of 13 we terminate those accounts 
and delete all the information uploaded by that account.
---------------------------------------------------------------------------
    Facebook has been involved with many online safety initiatives 
around the world, such as the U.S. State Attorneys General Internet 
Technical Task Force, the UK Home Office Task Force on Child Safety, 
the EU Safer Internet initiative, the Australia Attorney General's 
Online Safety Working Group and others. Today, I would like to discuss 
the important ways that Facebook innovation helps promote a safer 
online environment. We also encourage Congress to encourage, not 
discourage or prohibit, companies' innovation in policies and 
technologies to promote child online safety, security and privacy. We 
believe that our innovations in teen online safety, security and 
privacy advance the cause of online safety for children.
Summary of Key Points and Request for Congressional Action
    We wish to emphasize four points today and enlist Congress' 
assistance to advance child online safety.

   Facebook's real name culture and innovative technologies and 
        policies enhance online safety and privacy for teens.

   Facebook expends extensive effort on key teen safety issues 
        that further reduce teen risks.

   Facebook collaborates with experts, law enforcement, and 
        government agencies to develop a safer Internet.

   Congress has a role to play to support and encourage, not 
        discourage or prohibit companies' innovations to advance child 
        and teen online safety, security and privacy.

    We request, therefore, that Congress not overhaul COPPA, but 
instead provide legislative and regulatory incentives to companies to 
innovate on child safety and privacy technologies, and prevent 
regulators from foreclosing innovation and experimentation in this 
area.
    Our testimony lays out in brief a number of the key innovations 
employed by Facebook to promote safety for teens and others online.
Facebook Innovation 1: A Real Name Culture Promotes Online Safety
    Facebook's approach to providing online safety leadership begins 
with the recognition that there is no existing system today that can 
verify the age of a child online. As a result, Facebook developed and 
implemented an innovative, multi-layer system to act as technological 
proxies for age. These layers are discussed in greater detail below and 
are enhanced by Facebook's innovation of using a ``real name'' culture, 
which allows us to better filter out fake accounts and identify 
inappropriate contact.
    Before Facebook, the common wisdom was that Internet users should 
avoid using their real names and sharing information online. Facebook 
was the first major web service that required people to build their 
profiles and networks using real names, and provided them with privacy 
tools to enable them to decide who could access that information. This 
important policy and technical architecture decision not only allowed 
Facebook users to become more connected, but also made the site safer. 
A culture of authentic identity made Facebook less attractive to 
predators and other bad actors who generally do not like to use their 
real names or e-mail addresses.
    Facebook's real name culture also attracts users who are more 
likely to adhere to our Statement of Rights and Responsibilities (SRR, 
or what other companies call Terms of Service) and keep their behavior 
consistent with the standards of their communities. People are less 
likely to engage in negative, dangerous or criminal behavior online 
when their friends can see their name, their speech and the information 
they share. The real name culture creates accountability and deters bad 
behavior since Facebook users understand that their actions on our 
service create a record of their behavior. When users actions violate 
our SRR or the law, we can pinpoint corrective action--usually account 
termination and/or referral to law enforcement in potential criminal 
matters--to the specific account involved. Similarly Facebook is often 
able to detect fakes because of the types of connections made by a fake 
user account. And, of course, it's difficult to connect to friends 
using a fake account, since they are more likely to reject friend 
requests from people they do not know. Facebook also routinely blocks 
the registration of accounts under common fake names.
    Our real name culture also empowers users to become ``community 
policemen,'' and report those whose behavior violates Facebook's SRR. 
Facebook's users regularly use our report button, found throughout the 
service. This substantially multiplies the number of people reviewing 
content and behavior on Facebook and greatly enhances safety of teens 
on Facebook. At the same time, user actions often appear in the 
newsfeeds of his or her friends. If a friend learns of inappropriate 
behavior, he or she can intervene with a user to determine whether 
something is wrong.

Facebook Innovation 2: User Control on Facebook Enhances Privacy and 
        Safety
    Since its inception, Facebook has built innovative privacy tools 
for users to exercise direct control and share what they want, with 
whom they want, and when they want. This user control model supplements 
the protections designed into our service and empowers our users of all 
ages to protect themselves online.
    Perhaps more importantly for this hearing, Facebook's user control 
model also allows users to determine whom they are connected with on 
Facebook. Facebook users must accept a request from another user to be 
connected--Facebook never makes that choice. If a user feels 
uncomfortable connecting with a particular person, she may decline that 
friend request. Further, if a user begins to feel that a friend on 
Facebook is annoying, spamming, harassing, and/or dangerous, she may 
de-friend that person at any time. This action of de-friending 
terminates the connection between the users and prevents further 
contact.\2\ A user may also ``block'' another user in order to prevent 
any contact between the two. And, any user may at any time use our 
ubiquitous report button to draw Facebook's attention to inappropriate 
behavior.
---------------------------------------------------------------------------
    \2\ It should be noted that the de-friending and blocking occurs 
without notification, so the connection is simply, elegantly, 
electronically severed without drawing attention to the ending of the 
connection.
---------------------------------------------------------------------------
    Facebook takes its commitment to innovating to advance user privacy 
seriously. When new users sign up, they are introduced to our privacy 
help center, which explains how they may set a privacy setting for each 
piece of content the user shares. In December 2009, we introduced an 
unprecedented privacy dialog, which required every Facebook user, 
worldwide, to stop and consider their privacy settings before they 
could use the service further. As a result of that process, an 
additional one-third of our users customized their privacy settings.

Facebook Innovation 3: Hidden Security Systems and Safety Tools Advance 
        Facebook Users Online Safety
    Facebook's safety innovations extend to the development and use of 
proprietary technologies that allow us to continuously improve online 
safety and combat emerging online threats. Although we do not generally 
discuss these publicly for fear that they maybe compromised or 
circumvented, these technologies allow Facebook to perform ongoing 
authentication checks, including technical and community verifications 
of users' accounts. We look for anomalous behavior in the aggregate 
data produced by our 400 million users. For example, if an adult sends 
an unusual number of friend requests to unrelated minors which are 
ignored or rejected, our systems could be triggered, sending up a red 
flag and initiating a Facebook inquiry and remedial actions.
Facebook Innovation 4: Facebook Employs Age Gates to Limit Sharing and 
        Connections Between Minors and Adults
    As stated earlier, Facebook is neither directed at children less 
than 13 years of age nor does Facebook knowingly collect information of 
those under 13. Our privacy policy is explicit in this regard:

        If you are under age 13, please do not attempt to register for 
        Facebook or provide any personal information about yourself to 
        us. If we learn that we have collected personal information 
        from a child under age 13, we will delete that information as 
        quickly as possible. If you believe that we might have any 
        information from a child under age 13, please contact us 
        through this help page.

    Accordingly, Facebook is not required to comply with many of 
COPPA's requirements. However, Facebook actively removes accounts once 
discovered, of anyone it learns is under 13. It also employs a number 
of age gating technologies to limit the contact, sharing and 
connections between minors and adults. Facebook limits minors' access 
to the service by requiring those entering Facebook.com to type in 
their age on the very first screen.\3\ This birth date field prohibits 
children under the age of 13 from establishing an account. The age gate 
technology places a persistent cookie on the device used to establish 
an account, preventing the user from attempting to modify their birth 
date.
---------------------------------------------------------------------------
    \3\ The Subcommittee should note that many other leading online 
companies and social networks never even attempt to collect users' date 
of birth, and, therefore, never even attempt to block minors from using 
their sites and services.
---------------------------------------------------------------------------
    Facebook further employs a separate set of age restrictions to 
further limit contact between minors and adults. These restrictions are 
intended to limit opportunities for adults to pose as minors. Facebook 
engages in what we call social verification to ask minors that are new 
to our service to consider the source of a new friend request. Along 
with the friend request we may interpose a question to the minor prior 
to the minor being able to confirm that they wish to accept that 
request. Typical representative questions asked of the minor: (i) Is 
this someone whom you know from your school?; or (ii) Is this someone 
whom you or your parents know from your community? We also limit the 
number of friend requests that anyone can send in a set period of time 
to further reduce unwanted contacts between unrelated users.
    Additional limitations further limit the sharing of data between 
minors and adults on Facebook. While those over 18 on Facebook can 
share information with everyone, Facebook automatically restricts users 
under 18 from doing so. Facebook automatically limits their sharing to 
a much smaller subset of users, such as the minor's friends, friends of 
those friends, and their verified networks, generally associated with 
their schools. This limitation substantially reduces the visibility of 
minors to non-minors whom they do not know.

Face Book Innovation 5: Facebook Engages in Extensive Additional Safety 
        Efforts to Combat Specific Threats to Teens Online
    Facebook innovations also combat specific threats to teens on our 
service and the company cooperates closely with law enforcement on 
these issues, upon receipt of appropriate legal process.
Suicide and Self-Harm
    Facebook regularly delivers information to each user's networks of 
friends. As a result, Facebook stands in a special position to help 
reduce teen suicides and other forms of self-harm. Users who witness 
changes in their friends' behavior, reflected in their Facebook 
postings, can intervene to prevent friends from harming themselves. The 
promotion of self-harm, including eating disorders, cutting, etc., is a 
violation of Facebook's Statement of Rights and Responsibilities, and 
we encourage users to report this information. Our dedicated team of 
User Operations analysts reviews these reports and removes content such 
as photos, groups, and events. When we receive a report of someone who 
has posted suicidal content on Facebook, we alert the National Suicide 
Prevention Lifeline and encourage the user to contact his or her local 
authorities/law enforcement immediately. We've also posted an FAQ to 
the privacy and safety page in our Help Center with information and 
links to suicide help resources. Facebook saves lives on a regular 
basis by helping to prevent this kind of behavior. Our real name 
culture helps people identify those who are truly in need and respond 
in real time to a cry for help.

Cyberbullying and Harassment of Teens Online
    Facebook has led efforts around the world to help combat 
cyberbullying. In the U.S., Facebook was a founding member of the Stop 
Cyberbullying Coalition. Our robust reporting infrastructure leverages 
Facebook's 400 million users to monitor and report offensive or 
potentially dangerous content. This infrastructure includes, systems to 
prioritize the most serious reports, and a trained team of reviewers 
who respond to reports and escalate them to law enforcement as needed. 
The team treats reports of harassing messages as a priority, reviewing 
and acting on most within 24 hours. We also prioritize serious reports 
submitted through the contact forms in our Safety Center. With 
assistance from our outside experts on our Safety Advisory Board we 
have produced new materials on our Safety Center that specifically 
address how to prevent or respond to cyberbullying. We have also 
partnered with other organizations like MTV on their ``A Thin Line'' 
campaign to educate young people about the dangers of digital abuse; 
with the BBC on their ``bullyproof'' campaign, and regularly invite 
experts, such as the National Crime Prevention Council to address 
cyberbullying on the Facebook Blog, which reaches over 8 million 
people.

Missing Children and Runaways
    Facebook has also been successful in helping to locate missing 
teens. Law enforcement has generously praised Facebook for prioritizing 
law enforcement requests for IP location information that might help 
locate a missing child, which we provide on receipt of appropriate 
legal process. In just 1 week last February, we helped authorities in 
Fairfax, Virginia and Menlo Park, California find and return two 
missing kids. Last July, we received a request for IP data and basic 
user information for a minor who had gone missing. Over the course of 
the next week, we worked closely with law enforcement over e-mail and 
by telephone. Ultimately, the minor was found using the exact IP data 
we had provided. Similarly, a Facebook user went missing in Canada, and 
a demand for ransom was made. The Royal Canadian Mounted Police 
contacted us, and we followed our procedure for imminent threats. When 
a message was sent to a friend from the missing person's account, we 
provided the necessary data, enabling the RCMP to locate and return the 
person to safety.
    Preface: only a tiny fraction of a single percent of users will 
ever encounter the following two kinds of behaviors on Facebook. We 
focus on these areas because we take any threat to our users' safety 
very seriously.

Registered Sex Offenders Attempting to Establish Accounts
    Although it is not required to do so by law, Facebook prohibits 
access to Facebook by Registered Sex Offenders (RSOs). Facebook employs 
an outside contractor--at our own expense--to collect a list of RSOs 
from all of the states periodically throughout each year. Every state 
and locality keeps their list of RSOs in a different file format with 
different information and different character fonts. etc. We 
periodically compare that compilation of names to our user list; we do 
not wait for law enforcement to request that we do so. Our internal 
team of investigation professionals evaluates any potential matches 
more fully. If we find that someone on a sex offender registry is a 
likely match to a user on Facebook, we notify law enforcement and 
disable the account. On occasion, law enforcement has asked us to leave 
the accounts active so that they may investigate the user further.
    We have worked proactively to establish a publicly available 
national database of registered sex offenders that enables real-time 
checks and includes important information like e-mail addresses and IM 
handles.

Child Pornography
    Facebook takes substantial steps to stop any trafficking of child 
sexual exploitation materials, commonly referred to as child 
pornography. We use automated tools to automatically prohibit any 
sharing of known links (i.e., URLs) containing these materials so that 
these links cannot be distributed across our service. Facebook has a 
highly trained team dedicated to responding to the rare occasions when 
child pornography is detected on the service. That team sends incident 
reports to the National Center for Missing and Exploited Children 
(NCMEC) and the U.S. Department of Justice for potential prosecution. 
When we encounter what we believe are new offending URLs, we deploy a 
new technology we have developed that enables us to pull down any URL 
shared throughout our service even though it has been distributed.

Facebook Innovation 6: Facebook Has Made a Commitment to Collaborate on 
        the Advancement of Safety Online
    Although Facebook has important responsibilities in advancing 
safety online, Facebook recognized the importance of collaborating with 
others to innovate in this area. Facebook has developed deep, ongoing 
relationships with child safety and security experts. In December, 
Facebook formalized these relationships by creating a Safety Advisory 
Board of outside experts who advise us, and, on occasion, our users 
about how to keep teens safe online. Facebook also continues to work 
closely with law enforcement agencies around the country, and around 
the world. We are particularly proud of our work with the States' 
Attorneys General. In 2008, Facebook actively participated in the 
Internet Safety Technical Task Force at the behest of the Attorneys 
General to examine these issues. In April, we launched our new Safety 
Center to provide our users, parents and educators with updated 
educational materials and information about how to utilize our 
innovative privacy and security tools to enhance online safety.

Conclusion: Facebook Will Continue to Innovate but Congress must Help
    Although we are not a service that is directed at children less 
than 13 years of age, we have built our service, policies, and tools 
with COPPA in mind. Our experience tells us that Congress need not 
amend COPPA at this time. In fact, any amendments might undo many of 
our innovative privacy and safety tools. Congress can, however, assist 
Facebook and companies like us in advancing online child and teen 
safety by providing incentives, not disincentives, for child safety 
innovation online. If COPPA is amended, Congress could consider 
permitting companies to explore innovative approaches to obtaining 
parental consent online. Congress should ensure regulators are not 
discouraging technological and policy innovation in this area when 
reviewing privacy and security policies of companies that are trying to 
do the right thing.
    We thank this subcommittee for its leadership and call on Congress 
to take these actions to enhance child online safety. Thank you for 
your consideration.

    Senator Pryor. Thank you.
    Mr. Hintze?

  STATEMENT OF MICHAEL D. HINTZE, ASSOCIATE GENERAL COUNSEL, 
                     MICROSOFT CORPORATION

    Mr. Hintze. Chairman Rockefeller, Chairman Pryor, Ranking 
Member Wicker, thank you for the opportunity to share 
Microsoft's views on the Children's Online Privacy Protection 
Act.
    Microsoft has a deep and long-standing commitment to 
protecting the privacy of consumers, including children, who 
use our software and services. I want to begin by discussing 
Microsoft's comprehensive approach to protecting children's 
privacy online. I will then identify those areas where COPPA 
has made progress over the last decade, and highlight a couple 
of key challenges that remain.
    This hearing is timely. Ten years ago, this month, the 
Federal Trade Commission's COPPA rule took effect. COPPA's 
stated goal is to preserve the interactivity of children's 
experience on the Internet, while protecting their privacy. 
That goal remains essential today. Research has found that 
children gain important educational and social benefits, such 
as increased opportunities for learning and creativity, by 
engaging in interactive activities online. And children are 
realizing these benefits as they increasingly use new 
technologies to access the Internet, including mobile phones, 
videogame consoles, and portable media players. But, as we all 
recognize, these interactive technologies often enable 
consumers to disclose personal information online, and children 
may not fully understand the terms or the tradeoffs involved.
    COPPA was designed to address this issue. Microsoft fully 
supports COPPA's objectives of enhancing parental involvement 
and protecting children's privacy.
    While children's use of the Internet has evolved over the 
last decade, these objectives remain just as, if not more, 
important today. Privacy failures can have a real impact on 
children's safety.
    Therefore, Microsoft takes a number of steps to help 
protect children's privacy and safety through our own products 
and services, educational initiatives, and partnerships.
    First, Microsoft requires parental consent and offers 
parental controls for a number of our products and services, 
including Xbox, Hotmail, and our Instant Messenger Service. For 
example, our Windows Live Family Safety tool enables parents to 
limit their children's searches, block or allow websites based 
on the type of content, restrict with whom the child can 
communicate, and access detailed activity reports that show the 
websites their children visited, and the games and applications 
they used.
    Second, Microsoft engages in educational efforts around the 
world to help parents and caregivers make informed decisions 
about children's Internet use.
    Third, Microsoft partners with government officials, 
industry members, law enforcement agencies, and child 
advocates, to address children's privacy and safety issues.
    The attachment to my written testimony provides more 
details on these initiatives.
    Now I'd like to spend a few minutes talking about COPPA.
    In the past decade, COPPA has made important progress in 
raising awareness of children's privacy issues. For example, 
many website operators now limit the amounts and types of 
information they collect from children, and provide parents and 
children with educational resources to foster conversations 
about online privacy and safety. Also, by encouraging website 
operators to be more transparent about their privacy practices, 
and encouraging them to implement parental consent mechanisms, 
COPPA has enabled parents to take a more active and informed 
role in deciding how their children can take advantage of the 
Internet's many benefits.
    We believe COPPA provides a flexible notice-and-consent 
framework that can accommodate children's evolving use of new 
technologies. Therefore, we do not believe that a legislative 
amendment is necessary at this time. Rather, the statute 
enables the FTC to update its rule. And we appreciate the FTC's 
efforts to review its implementation of COPPA in light of new 
business models and new technologies.
    I'd like to highlight two aspects of the FTC's rule that we 
urge the Commission to consider as part of its review.
    First, the Commission should provide clear guidance on how 
companies can better meet, not only the letter, but the spirit 
of the law. Microsoft goes beyond the letter of the law by 
proactively requesting age information and seeking parental 
consent for children's use of many of its services, even when 
those services are not specifically targeted to children. We 
take this approach to encourage parental involvement in 
children's online activities, and enable children to 
participate in, and benefit from, interactive activities 
online. Other companies take different approaches. We encourage 
the Commission to use its COPPA rule-review process as an 
opportunity to help website operators and online services 
understand how they can honor the spirit of COPPA, especially 
in light of new technologies.
    Second, we urge the Commission to work with technology 
companies and consumer advocates to develop more consumer-
friendly, effective, and scalable methods for obtaining 
parental consent. The FTC has explicitly approved five parental 
consent methods for the disclosure of children's information 
online. However, these methods can be cumbersome for parents, 
do not scale for widely used services, and rely on children's 
self-reporting of age. These issues become more pronounced as 
children increasingly access services through mobile devices, 
where providing notice and obtaining parental consent raise 
additional challenges.
    Microsoft recognizes that the task of improving the 
parental consent process is not easy, and there's no silver-
bullet solution. The FTC's ongoing COPPA rule review provides a 
good opportunity for productive dialogue on alternative 
parental consent methods. We are committed to working, both in 
the short and long term, with Congress, the Commission, and 
other stakeholders to address privacy challenges raised by new 
technologies.
    Thank you for the opportunity to testify today.
    [The prepared statement of Mr. Hintze follows:]

  Prepared Statement of Michael D. Hintze, Associate General Counsel, 
                         Microsoft Corporation

    Chairman Pryor, Ranking Member Wicker, and honorable members of the 
Subcommittee, thank you for the opportunity to share Microsoft's views 
on children's privacy issues raised by new technologies and the 
Children's Online Privacy Protection Act (COPPA). Microsoft has a deep 
and long-standing commitment to protecting the privacy of consumers, 
including children, who use our software and services. We appreciate 
your initiative in holding this hearing today.
    This hearing is timely. Ten years ago this month the Federal Trade 
Commission's COPPA Rule took effect. At the time, COPPA's stated goal 
was to preserve ``the interactivity of children's experience on the 
Internet.'' \1\ That goal remains essential today. Research has found 
that children gain important educational and social benefits, such as 
increased opportunities for learning and creativity, by engaging in 
interactive activities online.\2\ And children are realizing these 
benefits as they increasingly use new technologies to access the 
Internet, including mobile phones, video game consoles, and portable 
media players.\3\
---------------------------------------------------------------------------
    \1\ 144 Cong. Rec. S12787 (1998) (statement of Sen. Bryan); see 
also 64 Fed. Reg. 59888, 59889 (1999) (``In drafting this final rule, 
the Commission has taken very seriously the concerns expressed about 
maintaining children's access to the Internet.'').
    \2\ See, e.g., Carly Shuler, Joan Ganz Cooney Center at Sesame 
Workshop, Pockets of Potential: Using Mobile Technologies To Promote 
Children's Learning 13-14, App. A, B (2009), http://
www.joanganzcooneycenter.org/pdf/pocketsofpotential.pdf; National 
School Boards Association, Creating & Connecting: Research and 
Guidelines on Online Social--and Educational--Networking 1 (July 2007), 
http://www.nsba.org/SecondaryMenu/TLN/CreatingandConnecting
.aspx.
    \3\ According to the Henry J. Kaiser Family Foundation, children 8- 
to 10-years old spend about 30 minutes each day browsing websites, 
posting to social networking sites, and sending instant messages and e-
mails to friends and family. This number more than doubles for older 
children. See Henry J. Kaiser Family Foundation, Generation 
M2: Media in the Lives of 8- to 18-year-olds 20 (2010), 
http://www.kff.org/entmedia/upload/8010.pdf.
---------------------------------------------------------------------------
    But, as we all recognize, these interactive technologies often 
enable consumers to disclose personal information online, and children 
may not fully understand the terms or the trade-offs involved. COPPA 
was designed to address this issue. Microsoft fully supports COPPA's 
objectives of enhancing ``parental involvement in a child's 
activities'' and protecting ``children's privacy by limiting the 
collection, [use, and disclosure] of personal information from children 
without parental consent.'' \4\ While children's use of the Internet 
has evolved over the last decade, these objectives remain just as--if 
not more--important today. Privacy failures can have a real impact on 
children's safety. Therefore, Microsoft has developed strong privacy 
practices regarding how children's personal information is collected, 
used, and disclosed online.
---------------------------------------------------------------------------
    \4\ 144 Cong. Rec. S12787 (1998) (statement of Sen. Bryan).
---------------------------------------------------------------------------
    Today, I want to begin by discussing Microsoft's comprehensive 
approach to protecting children's privacy online. I then will identify 
those areas where the COPPA Rule has made progress over the last decade 
and highlight a couple of key challenges that remain. My testimony 
concludes by describing promising identity management and privacy 
enhancing tools that can help address these challenges.
Microsoft's Comprehensive Approach to Addressing Children's Privacy
    Microsoft takes a number of steps to help protect children's 
privacy and safety through our own products and services, educational 
initiatives, and partnerships.
    First, Microsoft requires parental consent and offers parental 
controls for a number of our products and services. For example, our 
Xbox Live, Spaces, Messenger, and Hotmail services request age 
information in a neutral manner during the registration process. If a 
child indicates he or she is under the age of 13, we seek and obtain 
parental consent before the child is permitted to participate in 
interactive activities offered by these services.
    In addition, our parental controls for Windows 7, Windows Live, 
Xbox 360, Zune, and other services help parents make granular choices 
about how their children may share personal information online. For 
example, our Windows Live Family Safety tool enables parents to limit 
their children's searches; block (or allow) websites based on the type 
of content; restrict whom their children can communicate with in 
Windows Live Spaces, Messenger, or Hotmail; and access detailed 
activity reports that show the websites their children visited and the 
games and applications they used.\5\ Importantly, we have designed our 
family safety settings such that the settings can roam across different 
types of devices through which children may access these online 
services.
---------------------------------------------------------------------------
    \5\ See Attachment. Because we believe that consumers should be 
notified that they are being monitored to prevent abuse, children are 
provided on-screen notice where these tools provide parents with 
monitoring capabilities and these capabilities are engaged.
---------------------------------------------------------------------------
    Second, Microsoft engages in educational efforts around the world 
to encourage parents and caregivers to talk to their children about 
online privacy and to assist them in making informed decisions about 
their children's Internet use. For example, Microsoft provides parents 
with a number of educational resources to help them preserve their 
children's privacy and protect their children from inappropriate 
content, conduct, and contact online.\6\ And Microsoft works to raise 
awareness of children's privacy and safety issues by sponsoring 
roundtables with local and regional policymakers, academics, the media, 
and other thought leaders.
---------------------------------------------------------------------------
    \6\ See, e.g., http://www.microsoft.com/protect/family.
---------------------------------------------------------------------------
    Third, Microsoft partners with government officials, industry 
members, law enforcement agencies, and child advocates to address 
children's privacy and safety issues. For example, we support 
GetNetWise.org, which offers parents and children resources for making 
informed decisions about Internet use. We also are an active 
participant in the National Cyber Security Alliance and its online 
website Stay Safe Online, which encourages children and parents to 
discuss topics such as disclosing personal information through Internet 
chat rooms, e-mail, and websites. In addition, Microsoft works closely 
with the International Center for Missing and Exploited Children, 
Interpol, the National Center for Missing and Exploited Children, and 
many other organizations on child protection issues.\7\
---------------------------------------------------------------------------
    \7\ See, e.g., http://www.microsoft.com/protect/community.aspx; 
Microsoft Corp., PhotoDNA: Putting Microsoft Technology To Work 
Ensuring a Childhood for Every Child (2009), http://
www.microsoftphotodna.com/.
---------------------------------------------------------------------------
The COPPA Rule 10 Years Later
    In the past 10 years, the FTC's COPPA Rule has made important 
progress in raising awareness of children's online privacy issues. For 
example, many website operators now limit the amounts and types of 
personal information they collect from children online and provide 
parents and children with educational resources to foster conversations 
about online privacy and safety. Also, by encouraging website operators 
to be more transparent about the types of personal information that 
they collect from children online and about the use and disclosure of 
this information, the COPPA Rule has enabled parents to take a more 
active and informed role in deciding how their children can take 
advantage of the Internet's many benefits.
    We appreciate the FTC's efforts to review its implementation of 
COPPA in light of changes in technology, and Microsoft looks forward to 
participating in this process. While we recognize that changes to the 
COPPA Rule may be warranted, we do not believe that a legislative 
amendment is necessary at this time. COPPA provides a flexible notice 
and consent framework for the collection, use and disclosure of 
children's personal information, and we believe the statute enables the 
FTC to update its Rule as technologies and children's use of new 
technologies evolve over time.
    Today, I want to highlight two key aspects of the FTC's Rule that 
we believe the Commission should consider as it reviews its Rule in 
light of new technologies.
    First, we hope that the Commission will provide clear guidance on 
how companies can better meet not only the letter, but also the spirit, 
of the law in light of changing technologies and the evolving ways in 
which children are consuming online services. As expected, website 
operators and online services have adopted different approaches to 
complying with the COPPA Rule.\8\ For example, Microsoft proactively 
requests age information and seeks parental consent for children's use 
of many of its services even when those services are not specifically 
targeted to children. We take this approach in order to encourage 
parental involvement in children's online activities and enable 
children to participate in and benefit from interactive activities 
online. Other companies take different approaches. While flexibility in 
implementing the requirements of COPPA is desirable given the diverse 
array of websites and online services available, new technologies 
challenge COPPA's goal of promoting opportunities for discussions 
between parents and children about the disclosure of personal 
information online. We encourage the Commission to use its COPPA Rule 
review process as an opportunity to help website operators and online 
services understand how they can honor the spirit of COPPA, especially 
in light of new technologies.
---------------------------------------------------------------------------
    \8\ Microsoft supports, for example, the FTC's approach of treating 
operators of general audience sites differently from operators whose 
sites are directed to children.
---------------------------------------------------------------------------
    Second, we urge the Commission to work with technology companies 
and consumer advocates to develop more consumer-friendly, effective, 
and scalable methods for obtaining parental consent. The COPPA Rule 
generally requires that website operators and online services obtain 
verifiable parental consent before knowingly collecting, using, or 
disclosing children's personal information online.\9\ The FTC has 
appropriately adopted a ``sliding scale'' approach to parental consent. 
However, the FTC has only explicitly approved five parental consent 
methods for the disclosure of a child's personal information online: 
(1) providing a form for the parent to print, sign, and mail or fax 
back to the company; (2) requiring the parent to use a credit card in 
connection with a transaction; (3) maintaining a toll-free telephone 
number staffed by trained personnel for parents to call; (4) obtaining 
a digital certificate using public key technology; and (5) requiring an 
e-mail accompanied by a PIN or password obtained through one of the 
first four verification methods. These methods can be cumbersome for 
parents, do not scale for large organizations, and rely on children's 
self-reporting rather than an online age verification system.\10\ These 
issues become more pronounced as children increasingly access online 
services through mobile devices, where providing notice and obtaining 
parental consent raises additional challenges.
---------------------------------------------------------------------------
    \9\ 16 C.F.R.  312.5.
    \10\ Children in the upper age range covered by COPPA may be 
sophisticated enough to provide false age information in order to 
access online sites and services that screen for age.
---------------------------------------------------------------------------
    For this reason, Microsoft recommends that the Commission expand 
its list of approved parental consent methods to include other reliable 
approaches that minimize burdens on parents, leverage existing 
technologies, and scale for millions of users. In addition, as more 
online services are made available on mobile phones and other mobile 
devices, the Commission should consider the types of parental consent 
mechanisms appropriate for these devices.
    Microsoft recognizes that the task of improving the parental 
consent process is not easy and that there is no ``silver bullet'' 
solution. But the FTC's ongoing COPPA Rule review provides a good 
opportunity to begin a productive dialogue on how to take advantage of 
existing services and new technologies to develop alternative parental 
consent methods.
    For example, Microsoft and others in the industry have been working 
on new technologies for authentication and identity management 
generally, and these technologies could be used to help streamline and 
make more effective parental consent processes.\11\ Digital identity 
cards are one of these technologies. They could be issued through 
existing offline processes where in-person identity verification of a 
parent-child relationship already occurs. Once a digital identity card 
has been issued, website operators and online service providers could 
obtain parental consent by requesting that parents and children provide 
their digital identity cards before accessing interactive services and 
features.
---------------------------------------------------------------------------
    \11\ See Microsoft Corp., Digital Playgrounds: Creating Safer 
Online Environments for Children (2008), http://download.microsoft.com/
download/2/8/4/284093f4-5058-4a32-bf13-c12e2320cd
73/Digital%20Playground.pdf; Scott Charney, Vice President Trustworthy 
Computing, Microsoft, ``The Evolution of Online Identity,'' 7 IEEE 
Security and Privacy 56-59 (2009).
---------------------------------------------------------------------------
    Microsoft appreciates that these stronger authentication and online 
identity technologies can themselves impact privacy. For this reason, 
we believe that these systems should work in tandem with technologies 
that enable users to limit the personal information they disclose. For 
instance, Microsoft is working on technology that relies on 
cryptographic protocols and tokens to enable parents and children to 
better manage their identities online in a privacy enhancing way. When 
combined with the use of digital identity cards, these technologies 
could allow parents and children to disclose only that information that 
is necessary (such as parental status or age, but not name or other 
personal information) to enable children's access to and use of 
websites and online services.\12\
---------------------------------------------------------------------------
    \12\ Microsoft Corp., Microsoft U-Prove Technology Release: Open 
Standards and Community Technology Preview (2010), http://
www.microsoft.com/mscorp/twc/endtoendtrust/vision/uprove.aspx.
---------------------------------------------------------------------------
    These identity management technologies offer exciting prospects for 
creating a broader range of meaningful parental consent methods 
tailored to the use of children's information online. Microsoft looks 
forward to working in close collaboration with the public sector and 
other industry members to evaluate and implement these technology tools 
as part of a comprehensive approach to protecting children's privacy 
online.

Conclusion
    Thank you for the opportunity to testify today. We take our privacy 
obligations seriously, and we are committed to working in both the 
short and long term with Congress, the Commission and other 
stakeholders to address privacy challenges raised by new technologies.

                               Attachment

Family Safety
Helping to Protect Children in the Online World
    This white paper is for informational purposes only. Microsoft 
Makes No Warranties, Express or Implied, in this 
Document. 2008 Microsoft Corp. All rights 
reserved

Introduction
    For children, the Internet is both a classroom and a virtual 
playground--a place to learn, connect with friends and have fun. But as 
kids explore and interact online, they might encounter content their 
parents would not want them to see, or they might come into contact 
with people who pose a threat to them. Just as there are places and 
activities in the physical world that are unsafe or inappropriate for 
children, there are places and activities online that can pose a risk 
to children's privacy and personal safety.
    In the United States, 71 percent of teens with online access have a 
social networking profile.\1\ Half of all British children aged 12 to 
18 use instant messaging.\2\ Among Australian children who use the 
Internet, 75 percent visit video-sharing websites and 95 percent play 
games online.\3\ In Brazil, 98 percent of children with online access 
download music.\4\ Children don't always apply the common-sense 
personal boundaries and social mores of the offline world to their 
online experiences. In this context, today's parents consider the 
Internet the greatest risk to their children among all types of media, 
according to one study.\5\
---------------------------------------------------------------------------
    \1\ Cox Communications Teen Internet Safety Survey, Wave II--in 
Partnership with the National Center for Missing & Exploited Children 
(NCMEC) and John Walsh, March 2007. http://www.cox.com/TakeCharge/
includes/docs/survey_results_2007.ppt. A social networking profile is a 
user's personal page on a social networking website. Profiles often 
include information about the person, photos, videos, personal blogs 
and contact information.
    \2\ ``A European Research Project: The Appropriation of New Media 
by Youth.'' Mediappro, 2006. http://www.mediappro.org/publications/
finalreport.pdf.
    \3\ ``Norton Online Living Report. Symantec, 2008. http://
www.symantec.com/content/en/us/home_homeoffice/media/pdf/nolr/
080214_aus_norton_online_living_report_nolr-final.pdf.
    \4\ Ibid.
    \5\ Common Sense Media Parents Study, Insight Research Group, May 
19, 2006. http://www.commonsensemedia.org/news/CS-Parent-Study.PPT.
---------------------------------------------------------------------------
    Parents and caregivers are in the best position to make decisions 
about what is appropriate for children and to talk to them about online 
safety. But they need help, particularly through tools and guidance. 
Microsoft has invested significantly in family safety online, 
incorporating family safety features into a broad range of Microsoft 
products and services that are available for consumer use. At the same 
time, we have made extensive efforts--often in collaboration with child 
development experts and non-profit partners--to provide guidance and 
education for teachers, parents and children. We also work with law 
enforcement, industry partners and governments to combat Internet crime 
and to strengthen legislation that protects children from online 
exploitation.
    Making the Internet safer for children aligns with Microsoft's 
overall commitment to increasing trust and safety online and to 
protecting consumer security and privacy. (See sidebar on page 2.) Our 
efforts to promote family safety in the digital world fall into three 
key areas:

   Tools and technology. Microsoft offers family safety 
        settings and parental controls in Windows Vista, Windows 
        LiveTM, Xbox 360, Xbox LIVE, Zune and other 
        products and services. We are also an industry leader in 
        developing interoperable technologies for identity management 
        and tools that independent software vendors can use to extend 
        the safety capabilities of the Windows Vista platform.
    Guidance and education. Microsoft works with governments, 
nonprofits and community organizations to help parents and children 
better understand online risks and how to reduce them. These efforts 
range from informational websites and Internet safety curricula to 
public-information campaigns.
    Law enforcement and public policy. Microsoft works with law 
enforcement agencies and other partners to offer tools and training 
that aid law enforcement efforts to apprehend and prosecute criminals 
who use the Internet to harm children. We also support government 
efforts to craft and enact effective public policies that help protect 
Internet users and penalize online criminals.

Security and Privacy at Microsoft
    Consumer security and safety are a top priority for Microsoft. Six 
years ago, the company launched its Trustworthy Computing Initiative, a 
company-wide top-to-bottom commitment to delivering secure, private and 
reliable computing experiences for everyone. In addition to improved 
software development practices, Trustworthy Computing includes support 
for strong laws addressing criminal online conduct; support for law 
enforcement training, investigations, coordination and prosecutions; 
and guidance for customers on adopting security and privacy best 
practices.
    Our corporate privacy policies--including a set of privacy 
principles released in 2007 related to search and online advertising--
reflect our long-held commitment that consumers should have the ability 
to control the collection, use and disclosure of their personal 
information.\6\ This is nowhere more crucial than in the area of young 
people's Internet use. From social networking sites to e-mail to online 
gaming, responsible user practices and technology safeguards must be 
applied to help keep young Internet users--and their personal 
information--safe.
---------------------------------------------------------------------------
    \6\ Details on Microsoft's privacy policies are available at http:/
/privacy.microsoft.com/.
---------------------------------------------------------------------------
Technology
    When it comes to children's safety online, there is no 
technological silver bullet that can substitute for parental 
involvement, supervision and guidance. But Microsoft is committed to 
developing tools and technologies that can help parents in this 
important task. Family safety tools and features have been built into a 
wide range of Microsoft products and services, including Windows Vista, 
Windows Live, Xbox 360, Xbox LIVE, Zune and MediaroomTM.\7\ 
These include tools that give parents greater control over what their 
children can access and how they can interact via the Web and elsewhere 
online--from Web content filtering and e-mail contact management to 
social networking restrictions.
---------------------------------------------------------------------------
    \7\ More information on these and other family safety technologies 
can be found at www.microsoft.com/protect.
---------------------------------------------------------------------------
Windows Vista
    In all home editions of Windows Vista, Microsoft's next-generation 
client operating system, separate accounts can be created for each 
member of the family.\8\ And using the centralized Parental Controls 
panel, parents can specify when their children can use the computer, 
which websites they can visit and which software applications they can 
use. Parents can also restrict access to PC software games based on 
title, content or rating. They can even view detailed reports about a 
child's computer use to look for potentially inappropriate sites that 
the child might be visiting.
---------------------------------------------------------------------------
    \8\ The Starter, Home Basic, Home Premium and Ultimate editions.
---------------------------------------------------------------------------
    Monitoring children's computer use not only helps parents keep 
track of what their kids are seeing, hearing and doing, but it enables 
them to refine and modify restrictions based on actual feedback and 
offers a basis for informed discussion with their kids about Internet 
use and online habits. The Parental Controls icon in the system tray is 
always visible to let children know that the Parental Controls feature 
is on.
    For Web content filtering, parents can create customized settings 
that block sites by type of content (such as mature content, 
pornography or sex education) or specifically allow only certain sites. 
Parents can also enable a setting that prevents children from 
downloading software.



    To restrict the amount of time kids spend using the computer, 
parents can use a simple point-and-click grid to indicate ``blocked'' 
and ``allowed'' days of the week and hours of the day. As the end of an 
approved time period approaches, the child receives a 15-minute and a 
1-minute notification. If the allotted time ends before the child logs 
off, Windows Vista suspends the session and saves all of the child's 
work.
    From the Windows Vista Parental Controls panel, users can also 
enable safety features--such as content filters--that are built into 
third-party software and services.\9\ Microsoft also offers application 
programming interfaces (APIs) so third-party developers can build to 
the Windows Vista platform.
---------------------------------------------------------------------------
    \9\ Windows Vista Parental Controls are configured to turn 
themselves off to prevent conflicts with third-party family safety 
applications.



Windows Media Center
    Windows Media Center in Windows Vista Home Premium and Ultimate 
editions is a feature that allows you to watch and record live TV on 
your computer. It includes Parental Controls that let parents restrict 
viewing of digital entertainment by industry ratings (including the 
Motion Picture Association of America). Parents can:

   Set a maximum allowed rating for television and movie 
        content (such as PG-13 or TV-14)

   Restrict access to unrated programming

   Block access to programming based on category: fantasy 
        violence, suggestive dialogue, offensive language, sexual 
        content or violence

Windows Live
    Windows Live (http://get.live.com) is a set of free Web services 
and PC applications that help people stay better connected and get the 
most out of their Windows experience. It includes the Windows Live 
Hotmail e-mail client, social networking with Windows Live Spaces, 
instant messaging with Windows Live Messenger and other services.



    A key offering of Windows Live is Windows Live OneCareTM 
Family Safety, a service that seamlessly integrates family safety 
options for Windows Live services. Family Safety offers adjustable 
content filtering, activity reports for each user in the family, and 
contact management features to help prevent children from interacting 
with unknown individuals. Parents can monitor online activity and 
update settings from any Internet-connected computer.
    Family Safety also includes expert guidance for parents on age-
appropriate settings. For certain markets, this guidance is country-
specific. For example, the U.S. version of Family Safety includes 
guidance from the American Academy of Pediatrics; in Germany, the 
guidance is from Deutsches Kinderhilfswerk.
    Family Safety can be used with Windows XP SP2 and later versions of 
the Windows operating system, and it supports Windows Internet 
Explorer 6 and later versions, as well as other browsers. Key elements 
of the service include:

    Contact management. Online contact with strangers is a significant 
concern for parents because of the potential for harassment, 
inappropriate online interaction and contact with predators. Parents 
can specify that their approval be required before their child can 
communicate with a new person using Windows Live services such as 
Windows Live Hotmail and Messenger or before a new person is allowed to 
see the child's social networking page or blog on Spaces. The contact-
management settings apply even when a child logs on to Windows Live 
from a computer outside the home.

   Content filtering. Parents can specify unique filtering 
        settings for each member of the family. These settings allow, 
        block or display a warning for a range of content categories, 
        which apply to all Web content viewing. Filtering guidance 
        helps parents determine age-appropriate settings and online 
        activities as well as how to talk to children about safe Web 
        browsing practices.

    In addition, abuse reporting is available throughout Windows Live 
and the MSN* network of Internet services so users can report 
inappropriate behavior or content.\10\
---------------------------------------------------------------------------
    \10\ For example, there is a Report Abuse button at the bottom of 
every Windows Live Space so customers can easily report issues.
---------------------------------------------------------------------------
    Other major Windows Live services also have their own specific 
safeguards and privacy tools. They allow users to do the following:
Live Search
   Filter search results for sexually explicit images and text
Windows Live Messenger
   Create a manually selected list of allowed instant messaging 
        contacts

   Be notified whenever someone tries to add you to their 
        Messenger Contacts list

   Block a person from contacting you or seeing if you are 
        online

Windows Live Hotmail
   Set your personal account filters so Windows Live Hotmail 
        will deliver mail only from people on your Contacts list and 
        trusted senders

   Block all e-mail from a particular e-mail address

   Identify, based on color-coded alerts, whether an incoming 
        message might be malicious or fraudulent
Windows Live Spaces
   Make your Windows Live Space completely private, available 
        only to selected people, or public

   Access safety information from any Spaces page

Xbox 360 and Xbox LIVE
    Xbox 360 and Xbox LIVE--Microsoft's gaming platform and online 
gaming environment, respectively--are designed to provide secure gaming 
and age-appropriate content for all users. The easy-to-use Family 
Settings console in Xbox 360 allows parents to set restrictions that 
apply to both offline and online play.



    The console recognizes game and video rating systems from countries 
around the world, allowing parents to specify categories of games and 
movies their children can access.\11\ It also has a Family Timer 
feature that parents can use to limit the duration of game play within 
each 24-hour period.
---------------------------------------------------------------------------
    \11\ Systems for rating age-appropriateness of video and game 
content vary by country or by region. They include the Entertainment 
Software Rating Board (www.esrb.org) in the United States and Canada, 
the British Board of Film Classification (www.bbfc.co.uk) in the UK, 
the Game Rating Board (www.grb.or.k) in Korea, Unterhaltungssoftware 
Selbstkontrolle (www.usk.de) in Germany, and Pan-European Game 
Information (www.pegi.info) in much of Europe.
---------------------------------------------------------------------------
    For Xbox LIVE, the console can be configured to allow online gaming 
and communication only with approved friends and to require parental 
approval for new friends. It also allows users to report inappropriate 
use of the service.
    Specifically, the Xbox 360 Family Settings console allows parents 
to:

   Customize each child's playing environment

   Specify how much time a child can spend playing games each 
        day or each week

   Specify which games a child can play, based on game rating

   Override parental restrictions on a case-by-case basis

   Create personal Xbox LIVE settings for a child that will 
        apply to that account no matter what machine is used to access 
        the account

   Require parental approval of each child's list of online 
        friends

   Specify which types of online communication are allowed 
        (i.e., text and voice, video)

   Limit exposure to content created by other members of the 
        Xbox LIVE community

   Limit sharing of personal profile information to friends 
        only, or block all sharing of personal profile information

Mediaroom
    Microsoft Mediaroom, the latest version of Microsoft's Internet 
Protocol Television (IPTV) software platform, allows cable operators 
and telecommunication companies to deliver content and services such as 
standard and high-definition TV channels, digital video recordings and 
video on demand.
    Mediaroom includes parental control features for managing 
children's access to channels, shows and services. Using a PIN or 
multiple PINs, parents can restrict:

   Access to programming by rating (with special functionality 
        for blocking adult-rated programming)

   Access to unrated programming

   Access to individual channels

   The ability to purchase video-on-demand and other content

Zune
    Parents can use Family Settings to restrict their children's access 
to and ability to purchase content from the Zune Marketplace online 
music store for use on their Zune portable media player. Specifically, 
parents can:

   Specify whether a child can make purchases from Zune 
        Marketplace.

   Restrict a child's access to explicit content available 
        through Zune Marketplace.

   Specify who can send messages to a child in the Zune Social 
        online community. (Children 12 and under are prohibited from 
        joining the community.)

   Specify whether a child can accept friend requests in the 
        Zune Social online community.

   Specify whether a child can share favorite artists and songs 
        with the Zune community.

   Specify who can see a child's friends list.

Guidance and Education
    While Microsoft continues to create tools and technologies to help 
promote child safety on the Internet, we believe that educating parents 
and children is the most effective way to respond to online risks. To 
this end we support numerous family safety educational organizations 
and outreach efforts, including:

   Ad Council's Internet Safety Coalition (ISC). Microsoft is a 
        member of the ISC, which is working to help kids understand 
        that the Internet is a public place and to explain the risks of 
        ill-considered Internet posting.

   Bad Guy Patrol. As part of Microsoft Canada's and the 
        Government of Alberta Children's Services shared commitment to 
        preventing child sexual exploitation, www.badguypatrol.ca 
        teaches children ages 5-10 critical Internet safety skills 
        through a series of games. A section for adults provides 
        additional tips on how to keep kids safe and the program is 
        being offered to other provinces across Canada.

   GetNetWise. Microsoft supports this public education 
        organization and website (www.getnetwise.org), which offer 
        Internet users resources for making informed decisions about 
        safer Internet use.

   Get Safe Online. Microsoft is a founding sponsor, along with 
        the UK government and other leading companies, of this campaign 
        and website (www.getsafeonline.org) devoted to teaching 
        consumers and businesses about Internet security and safety.

   i-SAFE America's i-LEARN. Microsoft is a sponsor of this 
        free online curriculum for educators, parents, teens and law 
        enforcement, which is available at www.ilearn.isafe.org.

   National Cyber Security Alliance (NCSA). Microsoft is part 
        of this nonprofit public-private partnership that offers online 
        safety and security information to the public on the 
        www.staysafeonline.org website and through educational efforts 
        such as National Cyber Security Awareness Month.

   NCMEC Netsmartz. Microsoft has provided video production 
        resources for the National Center for Missing and Exploited 
        Children's Netsmartz website (www.netsmartz.org), which helps 
        educate parents, kids, teachers and law enforcement about 
        online security and safety issues.

   NetSafe. NetSafe and Microsoft New Zealand developed this 
        online safety site (www.hectorsworld.com), which offers 
        Internet safety curricula for teachers as well as a range of 
        fun activities for children that teach them about safer 
        Internet use.

   OnGuard Online. Microsoft helped develop the U.S. Federal 
        Trade Commission's website at www.onguardonline.gov, which 
        offers consumers tips, articles, videos and interactive 
        activities related to online safety and security.

   ``Safety is no game. Is your family set?'' Tour. Microsoft, 
        Boys & Girls Clubs of America and Best Buy cosponsored a 20-
        city campaign to promote safer and age-appropriate gaming and 
        to teach kids and parents about the Xbox 360 family safety 
        features.\12\
---------------------------------------------------------------------------
    \12\ Educational materials from the campaign, including a parent-
child gaming pact that families can fill out, are available at http://
www.xbox.com/en-US/support/familysettings/isyourfamilyset/default.htm.

   Staysafe.org. Microsoft sponsors and finances a website at 
        www.staysafe.org that offers guidance and news about online 
        security and safety issues. In 2006, Microsoft joined with the 
        Federal Trade Commission, AARP, U.S. Chamber of Commerce, Best 
        Buy and other partners to sponsor Staysafe.org's Get Net Safe 
        Tour of 12 U.S. cities to raise awareness about Internet 
---------------------------------------------------------------------------
        security and safety.

   Wired Safety. Microsoft is helping to support Wired Safety's 
        first international conference on cyberbullying, at which 
        representatives from government, education, the media, the 
        technology industry and others will help raise awareness of 
        this important issue and spur appropriate action.

    In addition to these partnerships, at our www.microsoft.com/
protect/family website we offer our own broader information about 
consumer online safety in three key areas:

   Family Safety--With young people online in record numbers we 
        provide families with guidance to help promote personal safety 
        and privacy. Just as parents teach their children to look both 
        ways before they cross the street, Microsoft is working to help 
        parents engage with their children to apply similar safety 
        rules to protect kids online.

   Protect Your PC--Helping users protect their PCs from 
        threats like viruses and spyware is another key area of 
        continued focus.

   Protect Yourself--ID Theft is a significant concern for 
        consumers. Microsoft is actively addressing ways to help people 
        better protect themselves when online.

Law Enforcement and Public Policy
    Microsoft is committed to helping make the Internet safer for all 
users, especially children and families, but we can't do it alone. 
Partnerships with law enforcement agencies, governments, nonprofit 
organizations and other industry leaders are essential to combating 
cybercrime. Microsoft has also worked with governments to strengthen 
online safety and privacy laws and to develop mandatory Internet safety 
education programs in schools. These efforts address not only 
individual children's use of the Web but also broader criminal issues 
like online child pornography.
    One highly successful effort is the Child Exploitation Tracking 
System (CETS), a system jointly developed by Microsoft and Canadian law 
enforcement to manage investigations of child exploitation cases. CETS 
allows investigators to import, organize, analyze and search large 
volumes of information while conducting investigations and share 
information across law enforcement agencies. To date, CETS has been 
deployed in Canada, Brazil, Chile, Indonesia, Australia, Italy, Romania 
and the United Kingdom.
    In June 2006, Microsoft, AOL, Earthlink, United Online and Yahoo! 
announced a partnership with the National Center for Missing and 
Exploited Children (NCMEC) to fund a new Technology Coalition within 
NCMEC to develop and deploy technology solutions that disrupt the 
ability of online predators to exploit children or traffic in child 
pornography. The participating companies pledged US$1 million in 
combined initial funding as well as technical support and expertise.
    Microsoft has worked with Interpol and the International Centre for 
Missing & Exploited Children (ICMEC) to sponsor worldwide training 
sessions for law enforcement personnel on computer-facilitated crimes 
against children. As of February 2008, more than 2,600 law enforcement 
officers from more than 100 countries have been trained in methods of 
identifying suspects, investigating offenses and dealing with victims 
of online child predators.
    In 2006, Microsoft joined ICMEC, NCMEC, leading financial 
institutions and Internet industry leaders to form the Financial 
Coalition Against Child Pornography, which provides a forum for members 
to collaborate on strategies to cutoff funding for child pornographers 
and eradicate child pornography.
    Microsoft works extensively with the U.S. Department of Justice's 
Internet Crimes Against Children Task Force and is a member of the 
Virtual Global Taskforce, a public-private partnership that combats 
online child abuse worldwide.
    In 2008, Microsoft joined the Internet Safety Technical Task Force, 
a coalition of academics, industry, advocacy groups and others that 
examines issues related to Internet safety, online authentication and 
children's age verification.
    Microsoft includes tools in its online services that can help 
detect and prevent child pornography and exploitation, and it is 
continually developing new tools both independently and in conjunction 
with its partners. MSN uses a filtering tool to review images uploaded 
to Windows Live Spaces and MSN Groups. Microsoft reports any images 
identified as apparent child pornography to NCMEC and closes the site. 
Microsoft also has a complaint center where users can report incidents 
of abuse on our sites.
    Microsoft has worked with state attorneys general in Alabama, 
Colorado, Georgia, Kansas, Massachusetts, New Hampshire, New Mexico, 
South Carolina and Utah to provide comprehensive training for law 
enforcement on computer-facilitated crimes.\13\
---------------------------------------------------------------------------
    \13\ In the United States, the attorney general is the state 
government's chief legal advisor and law enforcement officer.
---------------------------------------------------------------------------
    In April 2006, Microsoft joined ICMEC in announcing ICMEC's model 
legislation on child pornography. This legislation seeks to modernize 
child pornography laws for the 184 member countries of Interpol; 
Microsoft has pledged to support efforts worldwide to develop and 
enforce these laws.
    Microsoft has joined industry partners to encourage countries to 
adopt and ratify the Council of Europe Convention on Cybercrime, which 
requires signatories to adopt and update laws and procedures to address 
crime in the online environment.

Conclusion
    Microsoft has long been committed to helping protect children 
online. We take a comprehensive approach to online safety that includes 
the development of family safety technologies, guidance and education 
for families and children, and partnerships with industry and law 
enforcement to combat online crime.
    Online child safety is directly in line with Microsoft's overall 
commitment to promoting greater trust online and to offering products 
and services built with consumer safety in mind. Microsoft will 
continue to invest in programs, technologies and partnerships that 
advance the goals of safe computing for children and families.
    [The information contained in this document represents the current 
view of Microsoft Corp. on the issues discussed as of the date of 
publication. Because Microsoft must respond to changing market 
conditions, it should not be interpreted to be a commitment on the part 
of Microsoft, and Microsoft cannot guarantee the accuracy of any 
information presented after the date of publication.
    Complying with all applicable copyright laws is the responsibility 
of the user. Without limiting the rights under copyright, no part of 
this document may be reproduced, stored in or introduced into a 
retrieval system, or transmitted in any form or by any means 
(electronic, mechanical, photocopying, recording or otherwise), or for 
any purpose, without the express written permission of Microsoft.
    Microsoft may have patents, patent applications, trademarks, 
copyrights or other intellectual property rights covering subject 
matter in this document. Except as expressly provided in any written 
license agreement from Microsoft, the furnishing of this document does 
not give you any license to these patents, trademarks, copyrights or 
other intellectual property.
    Microsoft, Internet Explorer, Mediaroom, MSN, OneCare, Xbox 360, 
Xbox LIVE, Windows, Windows Live, Windows Vista and Zune are either 
registered trademarks or trademarks of Microsoft Corp. in the United 
States and/or other countries. The names of actual companies and 
products mentioned herein may be the trademarks of their respective 
owners.]

    Senator Pryor. Thank you.
    Dr. Montgomery?

           STATEMENT OF KATHRYN C. MONTGOMERY, Ph.D.,

              PROFESSOR, SCHOOL OF COMMUNICATION,

                      AMERICAN UNIVERSITY

    Dr. Montgomery. Chairman Rockefeller, Chairman Pryor, 
Ranking Member Wicker, and members of the Committee--the 
Subcommittee, thanks so much for inviting me to testify about 
COPPA. It's a law I care very deeply about.
    During the 1990s, while President of the nonprofit Center 
for Media Education, I played a leadership role in passage of 
COPPA, working with Members of Congress on both sides of the 
aisle, as well as a coalition of prominent education, health, 
and consumer groups.
    And I think we need to remember that, in the early days of 
the World Wide Web, which was really a kind of Wild West 
period, the business model of one-to-one marketing, combined 
with the increasing value of children as a target market for 
advertisers, created, really, a ``perfect storm'' for marketers 
who wanted to use the Internet to take advantage of young 
people. We and others documented many of those practices. And 
if we need to remind ourselves of where we were, we can 
remember sites like the Young Investors site that asked for 
reams of personal financial information from children, or one 
of my favorites, which was the Batman site, which asked 
children to be good members of Gotham and fill out the census. 
That's what we were looking at, at the time. That's where the 
Internet was headed.
    My colleagues and I consulted with a broad spectrum of 
stakeholders, including industry groups, to craft a set of 
regulations that would successfully balance our collective 
interest in nurturing the growth of e-commerce while protecting 
the privacy of our children.
    And I think COPPA has served us all very well. It has 
created a level playing field by creating a law that applied to 
every online commercial player, from the largest children's 
media companies to the smallest startups, and it sends a signal 
to the industry, ``If you're going to do business with our 
Nation's children, you will have to follow some rules.'' And 
because it was passed during the early stages of e-commerce, it 
has created rules of the road that have helped to guide the 
development of the digital marketplace and, really, curtail 
many of the egregious practices that were coming into place.
    And I also think the Safe Harbor mechanism is very 
important, because it permits self-regulation, but within the 
context of clear government rules and enforcement authority by 
the FTC.
    But, as others have pointed out, recent developments in 
online marketing really warrant renewed attention by the FTC 
and the Congress. Today's children are growing up in an 
immersive and ubiquitous digital media environment, 24/7, and 
many of the practices we identified in the 1990s have been 
eclipsed by an entirely new generation of tracking and 
targeting technologies. Briefly, I'll highlight two.
    One is behavioral targeting, which is an invisible process 
and a covert process that tracks individual users, through 
cookies and other data files, to collect information about 
them, and to design personalized advertising to target them, 
based on their psychological profiles and their behavioral 
profiles. And this also raises the question of what constitutes 
``personally identifiable information.'' It's not just a matter 
of your giving your name. The marketers are able to know who 
you are, and get to you and target you.
    And the second is mobile marketing, which people have 
mentioned. And one of the important things is that it combines 
behavioral targeting with location targeting. And the research 
that I've done on children's food marketing and the obesity 
crisis has found fast-food companies creating discount coupons 
that will be sent to people's and children's cell phones when 
they get near a fast-food restaurant.
    So, what we need to do is to ensure the FTC--and I'm 
working with the agency to update the law, update the rules, as 
it was intended to do, as it was designed to do.
    Finally, I do want to say that, while COPPA has established 
important safeguards for the youngest consumers in the digital 
marketplace, adolescents have no such protections. We know 
they're avid users of social networks, like Facebook and 
MySpace and others. In many ways, they're living their lives 
online, and they're increasingly relying on these social 
networks and on search for personal information and for 
handling sensitive personal issues that they're coping with in 
their lives.
    So, I would argue, we--I'm not arguing for a parental 
verification system, like COPPA, but I do think we need a set 
of fair information and marketing practices that are tailored 
to the unique needs and vulnerabilities of adolescents.
    So, I hope the Committee will send a message to the FTC 
that COPPA remains important, but needs to be updated, and 
also, that the FTC should develop specific recommendations for 
protecting the privacy of adolescents as part of its broad new 
initiative on online privacy.
    Thank you.
    [The prepared statement of Dr. Montgomery follows:]

    Prepared Statement of Kathryn C. Montgomery, Ph.D., Professor, 
              School of Communication, American University

    Chairman Pryor, Senator Wicker, and members of the Subcommittee. My 
name is Kathryn Montgomery, and I am a Professor in the School of 
Communication at American University. I appreciate the opportunity to 
testify before you today about the Children's Online Privacy Protection 
Act (COPPA). During the 1990s, while president of the nonprofit Center 
for Media Education (CME), I played a leadership role in the passage of 
COPPA, working with a coalition of education, health, and consumer 
groups that included the National PTA, the Consumer Federation of 
America, the National Education Association, and the American Academy 
of Pediatrics. As you know, Congress passed the law in 1998 through the 
strong bi-partisan leadership of Sen. John McCain (R-Ariz.), Rep. Ed 
Markey (D-Mass), and then-Sen. Richard Bryan of Nevada. I worked 
closely with these Congressional leaders and with other members, as 
well as with the Federal Trade Commission and the White House, on the 
legislation. I also collaborated with a broad spectrum of industry 
stakeholders--including advertising trade groups, online content 
providers, and children's media companies--to craft a statute and a set 
of regulations that would successfully balance our collective interests 
in nurturing the growth of e-commerce, while protecting the privacy of 
our children.
    For the past decade, COPPA has served as an effective safeguard for 
young consumers under the age of 13 in the online marketing 
environment. Though the law took effect in the early formative period 
of Internet marketing, it was purposely designed to adapt to changes in 
both technology and business practices, with periodic reviews by the 
FTC to ensure its continued effectiveness. With the current expansion 
of digital media platforms and the growing sophistication of online 
data collection and profiling, however, it is now critically important 
that the intent of COPPA be fully implemented to protect young people 
from new commercial practices in today's digital media environment.
    As I document in my book, Generation Digital: Politics, Commerce 
and Childhood in the Age of the Internet, the emergence of the World 
Wide Web ushered in a host of online marketing and data collection 
practices that raised fundamental privacy concerns for children. The 
business model of one-to-one marketing, combined with the increasing 
value of children as a target market for advertisers, created a perfect 
storm for marketers who wanted to use the Internet to take advantage of 
young people. Numerous commercial websites offered prizes and other 
incentives to encourage children to supply personal information about 
themselves. For example, one site targeted at ``young investors,'' 
urged children to provide an astonishing amount of financial 
information, including any gifts they might have received in the form 
of stocks, cash, savings bonds, mutual funds or certificates of 
deposit. Another site, set up to promote the movie Batman, encouraged 
children to ``be good citizens of Gotham'' and fill out the ``census.'' 
\1\ Some of these practices were so disturbing that the Center for 
Media Education enlisted the help of Georgetown University Law Center's 
Institute for Public Representation to file a complaint with the FTC in 
1996. The commission found our complaint persuasive and, with the 
urging of our coalition and others, began examining the children's 
online data collection commercial market.\2\ The FTC's internal 
research played a key role in documenting the rampant spread of data 
collection and the failure of self-regulatory promises by industry. The 
commission's report, released just months prior to passage of COPPA, 
provided crucial evidence of the need for this important law.\3\
---------------------------------------------------------------------------
    \1\ Kathryn Montgomery, Generation Digital: Politics, Commerce, and 
Childhood in the Age of the Internet (Cambridge, MA: MIT Press, 2007); 
Kathryn Montgomery and Shelly Pasnik, Web of Deception: Threats to 
Children from Online Marketing (Washington, D.C.: Center for Media 
Education, 1996).
    \2\ Federal Trade Commission, ``FTC Staff to Survey Consumer 
Privacy on the Internet,'' 26 Feb. 1998, http://www.ftc.gov/opa/1998/
02/webcom2.shtm; Federal Trade Commission, ``Privacy Online: Fair 
Information Practices in the Electronic Marketplace,'' May 2000, 
www.ftc.gov/reports/privacy2000/privacy2000text.pdf (both viewed 26 
Apr. 2010).
    \3\ Federal Trade Commission, ``Privacy Online: A Report to 
Congress,'' June 1998, http://www.ftc.gov/reports/privacy3/priv-23a.pdf 
(viewed 26 Apr. 2010).
---------------------------------------------------------------------------
    Congress made a wise decision in 1998 to enact COPPA. I believe the 
law has been a clear legislative success. It was a balanced and 
sensible solution to a challenging problem. It established a level 
playing field by creating a law that applied to every commercial 
player--from the largest children's media companies to the smallest 
startups. And it sent a strong signal to the growing online marketing 
industry: If you are going to do business with our Nation's children, 
you will have to follow some basic rules. Because decades of research 
documented younger children's particular vulnerabilities to advertising 
and marketing, the law was narrowly tailored to apply only to 
commercial websites that were targeted at children under the age of 13, 
or where there was actual knowledge by the website operator that the 
user was under that age. In keeping with fair information principles, a 
key intent of the law was to minimize the collection of personally 
identifiable data from children, and to eliminate the practice of 
offering prizes and other incentives to encourage such data 
collection.\4\
---------------------------------------------------------------------------
    \4\ The FTC's COPPA rule applies to ``Operators of commercial 
websites and online services directed to children under 13 that collect 
personal information from them; operators of general audience sites 
that knowingly collect personal information from children under 13; and 
operators of general audience sites that have a separate children's 
area and that collect personal information from children under 13.'' 
Federal Trade Commission, ``Children's Online Privacy Protection Act,'' 
http://www.ftc.gov/privacy/privacyinitiatives/childrens.html (viewed 26 
Apr. 2010).
---------------------------------------------------------------------------
    No law is perfect, as everyone in this body is well aware. In the 
case of COPPA, children who are under 13 can lie about their age when 
visiting sites that are not intended for them. Parents are not always 
willing or able to be involved in the day-to-day online navigations of 
their children. But because the legislation was passed during the early 
stages of Internet e-commerce, COPPA established a clear set of ``rules 
of the road'' to help guide the development of the children's digital 
marketplace. As a result, some of the most egregious data collection 
practices that were becoming state-of-the-art in the online marketing 
environment were curtailed. A study in the Journal of Consumer Affairs 
found that more than ninety-five percent of the top 100 children's 
websites in the United States post privacy policies complying with 
COPPA's requirements for information collection and use.\5\ And by 
establishing a safe -harbor mechanism, the law created a system whereby 
self-regulatory guidelines--developed and implemented by a number of 
entities--operate within a framework of clear government rules and 
enforcement authority by the FTC. We are pleased that the commission 
has taken the initiative to examine and respond to specific cases, 
cracking down on those practices that violated the statute.\6\
---------------------------------------------------------------------------
    \5\ Anthony D. Miyazaki, Andrea J. S. Stanaland, and May O. Lwin, 
``Self-Regulatory Safeguards and the Online Privacy of Preteen 
Children, Journal of Advertising 38, n. 4 (Winter 2009): 79, 83; Andrea 
J. S. Stanaland, May O. Lwin, and Susanna Leong, ``Providing Parents 
with Online Privacy Information: Approaches in the U.S. and the UK,'' 
Journal of Consumer Affairs 42 n. 3 (Fall 2009): 474, 484-85.
    \6\ See for example, Federal Trade Commission, ``Iconix Brand Group 
Settles Charges Its Apparel Web Sites Violated Children's Online 
Privacy Protection Act,'' 20 Oct. 2009, http://www.ftc.gov/opa/2009/10/
iconix.shtm (viewed 26 Apr. 2010).
---------------------------------------------------------------------------
    Recent developments in the online marketing arena, however, pose 
new challenges that warrant the attention of the FTC and Congress. The 
Web has matured, thanks especially to broadband and mobile 
technologies. As a result, not only has the digital marketplace grown 
dramatically, it has become an even stronger presence in the lives of 
young people. Today's children are growing up in a ubiquitous digital 
media environment, where mobile devices, instant messaging, social 
networks, virtual reality, avatars, interactive games, and online video 
have become ingrained in their personal and social experience. Members 
of this generation of young people are, in many ways, living their 
lives online. As Advertising Age reported, ``more than 16 million 
children aged 2 to 11 are online, making for a growth rate of 18 
percent in the period 2004 to 2009--the biggest increase among any age 
group, according to Nielsen.'' The same report explains that according 
to a Nielsen Online survey conducted in July 2009, ``Time spent online 
for children ages 2 to 11 increased from about 7 hours to more than 11 
hours per week, or a jump of 63 percent over 5 years.'' \7\
---------------------------------------------------------------------------
    \7\ Beth Snyder Bulik, ``The On-Demand Generation,'' 12 Apr. 2010, 
http://adage.com/digital/article?article_id=143220 (viewed 26 Apr. 
2010).
---------------------------------------------------------------------------
    The online marketing practices we originally identified in the 
1990s have been eclipsed by a new generation of tracking and targeting 
techniques. For example, mobile marketing--combining text messaging, 
mobile video, and other new applications--is one of the fastest growing 
digital commerce platforms throughout the world, and a particularly 
effective way to reach and engage children.\8\ As a recent Kaiser 
Family Foundation study noted, ``Over the past 5 years, there has been 
a huge increase in [cell phone] ownership among 8- to 18-year-olds: 
from 39 percent to 66 percent. . . . During this period, cell phones . 
. . have become true multi-media devices: in fact, young people now 
spend more time listening to music, playing games, and watching TV on 
their cell phones (a total of :49 daily) than they spend talking on 
them (:33).'' \9\ According to the latest industry data, roughly half 
of all children use a mobile phone by age 10, and by age 12, fully 
three-fourths of all children have their own mobile phone.\10\ As one 
media executive commented, the mobile phone is ``the ultimate ad 
vehicle . . . the first one ever in the history of the planet that 
people go to bed with.'' \11\ Mobile advertising will increasingly rely 
on interactive video and become firmly embedded in ``mobile social 
networks.'' Advertising on mobile devices will be especially powerful, 
since it will be able to target users by combining both behavioral and 
location data.\12\ Ads on mobile phones will be able to reach young 
consumers when they are near a particular business and offer electronic 
pitches and discount coupons.\13\
---------------------------------------------------------------------------
    \8\ E. Burns, ``U.S. Mobile Ad Revenue to Grow Significantly 
through 2013,'' ClickZ, 25 Feb. 2009, http://www.clickz.com/3632919 
(viewed 4 Aug. 2009).
    \9\ Kaiser Family Foundation, ``Daily Media Use Among Children and 
Teens Up Dramatically from Five Years Ago,'' 20 Jan. 2010, http://
www.kff.org/entmedia/entmedia012010nr.cfm (viewed 7 Apr. 2010).
    \10\ Pete Blackshaw, ``A Pocket Guide to Social Media and Kids,'' 
Nielsen Wire, 2 Nov. 2009, http://blog.nielsen.com/nielsenwire/
consumer/a-pocket-guide-to-social-media-and-kids/ (viewed 16 Mar. 
2010).
    \11\ A. Klaassen, ``Why Google Sees Cellphones as the `Ultimate Ad 
Vehicle,''' Advertising Age, 8 Sept. 2008, http://adage.com/
mobilemarketingguide08/article?article_id=130697 (viewed 4 Aug. 2009).
    \12\ Center for Digital Democracy and U.S. PIRG, ``Complaint and 
Request for Inquiry and Injunctive Relief Concerning Unfair and 
Deceptive Mobile Marketing Practices,'' Federal Trade Commission 
Filing, 13 Jan. 2009, http://www.democraticmedia.org/current_projects/
privacy/
analysis/mobile_marketing (viewed 7 June 2009).
    \13\ A. Johannes, ``McDonald's Serves Up Mobile Coupons in 
California,'' PROMO Magazine, 26 Oct. 2005, http://promomagazine.com/
incentives/mcds_coupons_102605/ (viewed 4 Aug. 2009).
---------------------------------------------------------------------------
    Behavioral targeting uses a range of online methods--including 
cookies and invisible data files--to learn about the unique interests 
and online behaviors through the tracking and profiling of individual 
users. Through a variety of new techniques, marketers use this data to 
create personalized marketing and sales appeals based on a customer's 
unique preferences, behaviors, and psychological profile.\14\ Recent 
advances in behavioral targeting are enabling marketers to more 
accurately predict and influence user behavior. For example, 
``predictive behavioral targeting'' combines data from a number of 
different sources and makes inferences about how users are likely to 
behave in their response to marketing messages. Increasingly, 
behavioral profiles incorporate information from outside databases.\15\ 
Social media platforms are also embracing behavioral targeting, helping 
to drive ``robust advertising response and conversion.'' \16\
---------------------------------------------------------------------------
    \14\ David Hallerman, ``Behavioral Targeting: Marketing Trends,'' 
eMarketer, June 2008; I. Khan, B. Weishaar, L. Polinsky, et al., 
``Nothing but Net: 2008 Internet Investment Guide,'' 2008, https://
mm.jpmorgan.com/stp/t/c.do?i=2082C248&u=a_p*d_170762.pdf*h_-3ohpnmv 
(viewed 23 Mar. 2009).
    \15\ ``About Acxiom,'' http://www.acxiom.com/about_us/Pages/
AboutAcxiom.aspx (viewed 7 June 2009).
    \16\ ``ValueClick Media Launches Predictive Behavioral Targeting,'' 
21 July 2008, http://phx.
corporate-ir.net/phoenix.zhtml?c=84375&p=irol-newsArticle&ID=1177051; 
Acxiom, ``Digital Marketing Services,'' http://www.acxiom.com/
products_and_services/digital/Pages/DigitalMar
ketingServices.aspx; ``24/7 Real Media Launches Social Media Targeting 
to Improve Ad Performance and Response,'' 27 Apr. 2009, http://
www.247realmedia.com/EN-US/news/article
_445.html (all viewed 7 June 2009).
---------------------------------------------------------------------------
    Last year, a broad coalition of consumer, children, and privacy 
groups urged the FTC to ensure that new technologies involving mobile 
phones and data collection incorporate COPPA relevant safeguards. These 
groups also want the FTC to determine how behavioral marketing impacts 
children covered by COPPA, by analyzing, for example, the stealth data 
collection process delivered by online games, virtual worlds, and age-
relevant social sites.\17\ In its current review, the commission must 
ensure that its regulations implementing COPPA include the full range 
of Internet -enabled or connected services, including the increasingly 
ever-present cell phones children use, along with Web-connected gaming 
devices and online, interactive video.\18\ Congress intended COPPA's 
basic framework to be flexible, anticipating that the FTC would have to 
ensure that the law's implementation would cover new ways of collecting 
personal information from children.\19\ That's why I strongly support 
the FTC asking, in its recent Federal Register notice, whether COPPA's 
definition of personal information should be revised to include the 
latest methods of identifying and targeting online consumers, covering 
the so-called ``cookies'' that are used for interactive marketing data 
collection, as well as ``mobile geo-location information.'' \20\ As the 
February 2009 FTC staff report on online privacy acknowledged, ``in the 
context of online behavioral advertising, the traditional notion of 
what constitutes PII [personally-identifiable information] versus non-
PII is becoming less and less meaningful and should not, by itself, 
determine the protections provided for consumer data.'' \21\ I also 
support ensuring that parents have reasonable and effective methods to 
``review or delete personal information'' in their children's online 
file.
---------------------------------------------------------------------------
    \17\ ``Comments of American Academy of Child and Adolescent 
Psychiatry, the American Academy of Pediatrics, the American 
Psychological Association, Benton Foundation, Campaign for a Commercial 
Free Childhood, Center for Digital Democracy, Children Now, and the 
Office of Communications of the United Church of Christ. Online 
Behavioral Advertising Principles,'' Federal Trade Commission filing, 
11 Apr. 2009, http://www.democraticmedia.org/news_room/
letters/Letter_re_behavioral_advertising_comments; Center for Digital 
Democracy and U.S. PIRG, filing with the Federal Trade Commission 
concerning ``Online Behavioral Advertising Principles,'' 11 Apr. 2008, 
http://www.democraticmedia.org/files/FTCfilingApr08.pdf; Federal Trade 
Commission Staff Report, ``Beyond Voice, Mapping the Mobile 
Marketplace,'' Apr. 2009, 3 http://www.ftc.gov/reports/
mobilemarketplace/mobilemktgfinal.pdf (all viewed 26 Apr. 2010).
    \18\ Federal Trade Commission, ``FTC to Host Public Roundtable to 
Review Whether Technology Changes Warrant Changes to the Children's 
Online Privacy Protection Rule,'' 19 Apr. 2010, http://www.ftc.gov/opa/
2010/04/coppa.shtm; Federal Trade Commission, ``FTC Seeks Public 
Comment on Program to Keep Web Site Operators in Compliance With the 
Children's Online Privacy Protection Rule,'' 6 Jan. 2010, http://
www.ftc.gov/opa/2010/01/isafe.shtm (both viewed 26 Apr. 2010).
    \19\ See, especially, Section 1302980(F) of COPPA.
    \20\ Federal Trade Commission, ``COPPA Rule Review: 2010,'' http://
www.ftc.gov/privacy/privacyinitiatives/childrens_2010rulereview.html 
(viewed 26 Apr. 2010).
    \21\ Federal Trade Commission, ``Federal Trade Commission Staff 
Report: Self-Regulatory Principles For Online Behavioral Advertising,'' 
Feb. 2009, pp. 21-22, http://www.ftc.gov/opa/2009/02/behavad.shtm 
(viewed 26 Apr. 2010).
---------------------------------------------------------------------------
    Without question, digital media play a critically important role in 
the positive development of children and youth, helping them become 
better educated and providing a foundation for their engagement as 
citizens.\22\ But, there are also risks and dangers online, as many of 
us are aware. When COPPA was created, one of our concerns was to ensure 
that the ability to identify, track, and target a child--whether online 
or off--was mediated through Congressional safeguards mandating parent 
involvement. And while young people--and adults--today are being 
continually urged to make more of their personal information available 
in real-time, including their location, research indicates the few 
people understand how that information is collected and used. Even 
young adults, according to a new study released just last week, want to 
ensure their privacy is secured online. The study, conducted by 
scholars from UC Berkeley and the Annenberg School for Communication, 
University of Pennsylvania, found that ``large percentages of young 
adults (those 18-24 years) are in harmony with older Americans 
regarding concerns about online privacy, norms, and policy. . . . 
[Y]oung-adult Americans have an aspiration for increased privacy even 
while they participate in an online reality that is optimized to 
increase their revelation of personal data.'' \23\ As those responsible 
for the welfare of our children, adults must provide reasonable 
safeguards for protecting their privacy, especially to help them 
maneuver through an increasingly complex commercial online data 
collection marketplace.\24\
---------------------------------------------------------------------------
    \22\ MIT Press, ``The John D. and Catherine T. MacArthur Foundation 
Series on Digital Media and Learning,'' http://mitpress.mit.edu/
catalog/browse/browse.asp?btype=6&serid=170; John D. and Catherine T. 
MacArthur Foundation, ``Building the Field of Digital Media and 
Learning,'' http://digitallearning.macfound.org/site/c.enJLKQNlFiG/
b.2029199/k.94AC/Latest_News
.htm; Kathryn Montgomery, Barbara Gottlieb-Robles, and Gary O. Larson, 
``Youth as E-Citizens: Engaging the Digital Generation'' (Washington, 
D.C.: American University, 2004), http://www.centerforsocialmedia.org/
ecitizens/index2.htm (all viewed 26 Apr. 2010).
    \23\ Chris Jay Hoofnagle, Jennifer King, Su Li, and Joseph Turow, 
``How Different are Young Adults from Older Adults When it Comes to 
Information Privacy Attitudes and Policies?'' 14 Apr. 2010, http://
papers.ssrn.com/sol3/papers.cfm?abstract_id=1589864 (viewed 26 Apr. 
2010).
    \24\ Joseph Turow, Jennifer King, Chris Jay Hoofnagle, Amy 
Bleakley, and Michael Hennessy, ``Americans Reject Tailored Advertising 
and Three Activities that Enable It,'' 29 Sept. 2009, http://
papers.ssrn.com/sol3/papers.cfm?abstract_id=1478214; Center for Digital 
Democracy, U.S. PIRG, and World Privacy Forum, ``In the Matter of Real-
time Targeting and Auctioning, Data Profiling Optimization, and 
Economic Loss to Consumers and Privacy, Complaint, Request for 
Investigation, Injunction, and Other Relief: Google, Yahoo, PubMatic, 
TARGUSinfo, MediaMath, eXelate, Rubicon Project, AppNexus, Rocket Fuel, 
and Others Named Below,'' Federal Trade Commission filing, 8 Apr. 2010, 
http://www.democraticmedia.org/real-time-targeting; Center for Digital 
Democracy and U.S. PIRG, ``Complaint and Request for Inquiry and 
Injunctive Relief Concerning Unfair and Deceptive Mobile Marketing 
Practices,'' Federal Trade Commission filing, 13 Jan. 2009, http://
www.democraticmedia.org/files/FTCmobile_com
plaint0109.pdf (all viewed 26 Apr. 2010).
---------------------------------------------------------------------------
    Some people suggest that children are now so fully steeped in 
online technologies that they have become savvy about Internet 
marketing, and thus need no protections.\25\ But while children and 
youth have embraced new technologies, they cannot be expected to 
understand the subtle, often covert ways that online marketers are 
collecting, compiling, and analyzing user data. Nor should youth be 
held accountable for the public health implications of the new 
marketing environment. Over the last several years, I have closely 
examined these developments, helping direct a project examining how 
digital marketing targets both children and adolescents for food and 
beverage products linked to the country's youth obesity crisis.\26\
---------------------------------------------------------------------------
    \25\ Alice E. Marwick, Diego Murgia Diaz, and John Palfrey, 
``Youth, Privacy, and Reputation (Literature Review),'' Berkman Center 
Research Publication No. 2010-5, Mar. 2010, p. 10, http://
papers.ssrn.com/sol3/papers.cfm?abstract_id=1588163 (viewed 27 Apr. 
2010).
    \26\ Jeff Chester and Kathryn Montgomery, ``Interactive Food & 
Beverage Marketing: Targeting Children and Youth in the Digital Age,'' 
Berkeley Media Studies Group, May 2007, http://www.digitalads.org/
documents/digiMarketingFull.pdf (viewed 26 Apr. 2010).
---------------------------------------------------------------------------
    Finally, while passage of COPPA established an important framework 
for safeguarding our youngest consumers in the digital marketplace, 
adolescents have no such protections. Neither the online industry nor 
the Federal Trade Commission has adequately addressed the special 
privacy issues raised for adolescents. Because of their avid use of new 
media, adolescents are primary targets for digital marketing.\27\ 
Today's teens are being socialized into this new commercial digital 
culture, which resonates so strongly with many of their fundamental 
developmental tasks, such as identity exploration, social interaction, 
and autonomy.\28\ Many teens go online to seek help for their personal 
problems, to explore their own sexual identities, to find support 
groups for handling emotional crises in their lives, and sometimes to 
talk about things they do not feel comfortable or safe discussing with 
their own parents. Yet, this increased reliance on the Internet 
subjects them to wholesale data collection and profiling. The 
unprecedented ability of digital technologies to track and profile 
individuals across the media landscape, and to engage in ``micro'' or 
``nano'' targeting, puts these young people at special risk of 
compromising their privacy. Teens may be internalizing and normalizing 
these invasive practices that have been so integrally woven into their 
everyday actions and experiences.
---------------------------------------------------------------------------
    \27\ Kathryn C. Montgomery and Jeff Chester, ``Interactive Food and 
Beverage Marketing: Targeting Adolescents in the Digital Age,'' Special 
supplement to Journal of Adolescent Health (September 2009): 1-12.
    \28\ S. Harter, ``Processes Underlying the Construction, 
Maintenance and Enhancement of the Self-concept in Children,'' 
Psychological Perspective on the Self 3 (1990): 45-78; U. Uhlendorff, 
``The Concept of Developmental Tasks,'' Social Work & Society 2, n. 1 
(2004): 54-63; J. Hill, ``Early Adolescence: A Framework,'' Journal of 
Early Adolescence 3, n. 1 (1983): 1-21; K. Subrahmanyam and P. 
Greenfield, ``Online Communication and Adolescent Relationships,'' The 
Future of Children 18, n. 1 (2008): 119-146.
---------------------------------------------------------------------------
    As child advocacy and health groups explained in an April 2008 
filing with the FTC, ``although adolescents are more sophisticated 
consumers than young children are, they face their own age-related 
vulnerabilities regarding privacy.'' The prevailing formula embraced by 
industry and endorsed by regulators is rooted in the concept of 
``notice and choice.'' It is based on the expectation that consumers 
will read the privacy policies that online companies post on their 
websites, and if they don not like the terms, they will ``opt out.'' 
But most privacy policies offer no real choice; instead the policies 
are presented as a ``take-it-or-leave-it'' proposition. Surveys have 
shown that most adults don't read, nor can they readily understand, the 
often confusing, technical legalese that characterizes these 
policies.\29\ For under-aged youth, these challenges are further 
complicated. As the children's coalition filing points out, ``. . . 
adolescents, who have less education and are less likely to make the 
effort to read privacy policies,'' are ``more willing to forgo learning 
about or protecting against behavioral advertising practices. . . in 
order to move quickly and freely access websites and socially 
interact.'' \30\ Social networks have created privacy settings that 
create a false sense of security for teens. While young people may 
believe they are protecting their privacy, they remain totally unaware 
of the nature and extent of data collection, online profiling, and 
behavioral advertising that are becoming routine in these online 
communities.
---------------------------------------------------------------------------
    \29\ Institute for Public Representation (on behalf of the American 
Academy of Child and Adolescent Psychiatry, the American Academy of 
Pediatrics, American Psychological Association, Benton Foundation, 
Campaign for a Commercial Free Childhood, Center for Digital 
Democracy), filing with the Federal Trade Commission concerning 
``Online Behavioral Advertising Principles,'' 11 Apr. 2008, p. 6, 
http://www.democraticmedia.org/files/Children's%20Advocacy%20
Groups%20%20Behavioral%20Advertising%20Comments%20FINAL.pdf (viewed 15 
June 2008).
    \30\ Institute for Public Representation FTC filing, pp. 7, 9.
---------------------------------------------------------------------------
    Recent research within the fields of neuroscience, psychology, and 
marketing has identified key biological and psychosocial attributes of 
the adolescent experience that may make members of this age group 
particularly susceptible to interactive marketing and data collection 
techniques.\31\ A number of scholars have challenged the notion that 
cognitive defenses enable adolescents to resist advertising 
(particularly in new media) more effectively than younger children.\32\ 
Rather than communicating rational or factual appeals, many digital 
marketing techniques are forms of ``implicit persuasion'' that promotes 
``subtle affective associations,'' often circumventing a consumer's 
explicit persuasion knowledge.\33\
---------------------------------------------------------------------------
    \31\ C. Pechmann, L. Levine, S. Loughlin, et al., ``Impulsive and 
Self-conscious: Adolescents' Vulnerability to Advertising and 
Promotion,'' Journal ofPublic Policy & Marketing 24, n. 2 (2005): 202-
221. Frances M. Leslie, Linda J. Levine, Sandra E. Loughlin, and 
Cornelia Pechmann, ``Adolescents' Psychological & Neurobiological 
Development: Implications for Digital Marketing,'' June 2009, http://
digitalads.org/documents/Leslie_et_al_NPLAN_BMSG_memo.pdf (viewed 27 
Apr. 2010).
    \32\ S. Livingstone and E. J. Helsper, ``Does Advertising Literacy 
Mediate the Effects of Advertising on Children? A Critical Examination 
of Two Linked Research Literatures in Relation to Obesity and Food 
Choice,'' Journal of Communication 56, n. 3 (2006): 560- 584.
    \33\ A. Nairn and C. Fine, ``Who's Messing with My Mind? The 
Implications of Dual-process Models for the Ethics of Advertising to 
Children,'' International Journal of Advertising 27, n. 3 (2008): 447-
470.
---------------------------------------------------------------------------
    In addition to its review of COPPA, the FTC should develop specific 
recommendations for protecting the privacy of adolescents as part of 
its broad new initiative on online privacy. \34\ Child advocacy and 
health groups, for example, have called for an expanded definition of 
``sensitive data'' to include the online activities of all persons 
under the age of eighteen, as well as a prohibition against ``the 
collection of sensitive information for behavioral advertising 
purposes.'' \35\
---------------------------------------------------------------------------
    \34\ Federal Trade Commission, ``Exploring Privacy: A Roundtable 
Series,'' http://www.ftc.gov/bcp/workshops/privacyroundtables/
index.shtml (viewed 27 Apr. 2010).
    \35\ Institute for Public Representation FTC filing, 13.
---------------------------------------------------------------------------
    I hope this committee will send a message to the FTC, as you review 
the record, that COPPA remains a valuable safeguard for children 
online, but the rules for implementing it need updating to account for 
the latest developments in digital marketing. I also urge the Committee 
to encourage the FTC to protect the privacy of adolescent consumers.

    Senator Pryor. Thank you.
    Mr. Rotenberg.

        STATEMENT OF MARC ROTENBERG, EXECUTIVE DIRECTOR,

                  EPIC AND ADJUNCT PROFESSOR,

                GEORGETOWN UNIVERSITY LAW CENTER

    Mr. Rotenberg. Thank you very much, Mr. Chairman, members 
of the Committee. I appreciate the opportunity to be here 
today.
    I'm the Director of EPIC. We're a nonprofit research 
organization. I also teach privacy law at Georgetown.
    I actually wanted to begin by thanking Professor Montgomery 
for the leadership role she played in helping to ensure passage 
of the Act. We wrote to the FTC, back in 1995, and asked the 
Commission to look at the business practices involving the 
collection and use of personal information on children. And 
following that letter and the hearings and the subsequent work 
of the consumer coalition, Congress did, in fact, pass 
important legislation. And we think that legislation set up the 
simple principle that, in this new online environment, it was 
important to protect young people from the exploitation and 
manipulation of their personal information.
    And I think it's obvious that there have been dramatic 
changes since the time that COPPA has been enacted. And the 
most obvious change is the emergence of the social network 
services. Our kids live online, exchanging intimate information 
with their friends; and that information is then collected and 
used for marketing purposes. And while their disclosures to 
their friends appear, to them, to be very transparent and to 
give them a great deal of control over what they choose to post 
or not post, what's going on behind the scenes, in terms of the 
transfer of their data by companies, such as Facebook, to their 
advertising partners, to their application development 
partners, and now to the third-party websites that they propose 
to transfer information about, is much more opaque.
    Now, Facebook said earlier--and I think this is true--that, 
for the most part, they've tried to discourage the use of the 
service by children under the age of 13 so that they remain 
compliant with COPPA. But, what they haven't addressed, and I 
think the critical question now before the Committee, is, How 
do we deal with the collection and use of this personal 
information on teenagers, children between the ages of 13, 
whose data is being collected in this online environment, and 
then disclosed to marketers and others for purposes completely 
unrelated to the reasons that they made it available?
    The problem is more serious, still, because, in this 
setting, the user has to rely on the privacy policies and the 
privacy settings that they are presented with. That's 
essentially the only way, in a self-regulatory environment, you 
are going to get privacy protection. And what we are seeing, 
increasingly, is that companies, having collected the data on 
teenagers, will change the privacy policies, they will change 
the privacy settings, for the purpose of making this data more 
easily accessible to business partners for marketing purposes. 
This is a problem that COPPA never anticipated. And I think it 
is the single-biggest problem facing children in the online 
world today. The self-regulatory approach that relies on 
privacy settings and privacy policies is not working.
    And it's also not working, in part, I regret to say, 
because I don't think the Federal Trade Commission has been as 
aggressive as it needs to be to go after what are essentially 
unfair and deceptive trade practices. They do a very good job 
on the education side, no doubt about it; and they have 
provided very good materials, to families and teachers and 
educators and others, about what people need to do to protect 
the safety of their children online. But, they have not done 
enough to enforce these unfair and deceptive trade practices. 
And I think they need to do more.
    I want to tell you, briefly, one extraordinary story, a 
complaint that we filed with the Federal Trade Commission last 
year that was offering a product, ostensibly, for parental 
control. It was supposed to protect kids online from, you know, 
risks and dangers that parents might be worried about. The same 
company was gathering the data, through this product that they 
made available, for marketing purposes. And this is how they 
described their own product, ``Every single minute, Pulse is 
aggregating the Web's social media outlets, such as chat and 
chat rooms, blogs, forums, instant messaging, and websites, to 
extract meaningful user-generated content from your target 
audience: the teens.'' They're talking to a marketing firm 
about how they're able to surreptitiously gather information on 
kids online.
    We went to the FTC, and we said to the FTC, ``You need to 
shut down this company.'' The FTC acknowledged the receipt of 
our complaint, but never acted on it.
    But, the story doesn't end there. When the Department of 
Defense learned about how this product operated, and they were, 
at the time, planning to make it available online to military 
families through their online store, they said, ``This poses a 
risk, a privacy and security risk, to military families, and we 
will not make it available.''
    In other words, the Department of Defense, acting on 
information that anyone who had taken a close look at the 
product would have quickly recognized was a serious problem, 
made an appropriate decision.
    The FTC, which has the authority and the expertise to 
police COPPA, never acted.
    I think, in both of these areas, the need to update the law 
so that there are protections for teenagers, those between 13 
and 18, from the misuse of the commercial information, and also 
for the FTC to get much more aggressive on enforcement. 
Education is not enough in this area. They have to go after 
these companies that are not acting appropriately when they 
collect and use personal data.
    Thank you very much.
    [The prepared statement of Mr. Rotenberg follows:]

  Prepared Statement of Marc Rotenberg, Executive Director, EPIC and 
          Adjunct Professor, Georgetown University Law Center

Introduction
    Mr. Chairman and members of the Committee, thank you for the 
opportunity to testify today on ``An Examination of Children's Privacy: 
New Technologies and the Children's Online Privacy Protection Act 
(COPPA)'' My name is Marc Rotenberg and I am the Executive Director of 
the Electronic Privacy Information Center (EPIC) and Adjunct Professor 
at Georgetown University Law Center.
    EPIC is a non-partisan research organization, focused on emerging 
privacy and civil liberties issues. We have a particular interest in 
children's online privacy. In 1995, EPIC wrote to then-FTC Commissioner 
Christine Varney, exposing industry practices that ``ma[de] available 
to the public the names, addresses, ages and telephone numbers of young 
children.'' \1\ We urged the FTC to investigate these business 
practices and to develop appropriate safeguards.
---------------------------------------------------------------------------
    \1\ EPIC Letter to Christine Varney on Direct Marketing Use of 
Children's Data, EPIC, December 14, 1995 available at http://epic.org/
privacy/internet/ftc/ftc_letter.html.
---------------------------------------------------------------------------
    In 1996, I testified before the House Judiciary Committee in 
support of the bill that eventually became COPPA.\2\ I warned: ``The 
collection of data about children is growing at a phenomenal rate. 
Government agencies, private organizations, universities, associations, 
businesses, and club all gather information on kids of all ages. 
Records on our children are collected literally at the time of birth, 
segmented, compiled, and in some cases resold to anyone who wishes to 
buy them.''
---------------------------------------------------------------------------
    \2\ Testimony and Statement for the Record of Marc Rotenberg, 
director Electronic Privacy Information Center on the Children's 
Privacy Protection and Parental Empowerment Act, H.R. 3508 Before the 
House of Representatives, Committee on the Judiciary, Subcommittee on 
Crime, September 12, 1996 available at http://www.epic.org/privacy/
kids/EPIC_Testimony.html.
---------------------------------------------------------------------------
    EPIC worked with the Center for Media Education, which had 
published a groundbreaking study in 1996 on children's privacy, to 
develop COPPA and help ensure enactment. As the CME study found, young 
children cannot understand the potential effects of revealing their 
personal information; neither can they distinguish between substantive 
material on websites and the advertisements surrounding it. Targeting 
of children by marketing techniques resulted in the release of huge 
amounts of private information into the market and triggered the need 
for COPPA.\3\
---------------------------------------------------------------------------
    \3\ Center for Media Education, Web of Deception: Threats to 
Children from Online Marketing, 1996 available at http://www.cme.org/
children/marketing/deception.pdf; see also supra notes 1-2.
---------------------------------------------------------------------------
    For the past 15 years, EPIC has pursued many of the critical online 
privacy issues concerning children. We have testified before lawmakers 
in support of strong privacy safeguards for children. EPIC has also 
filed complaints with the Federal Trade Commission detailing unfair and 
deceptive trade practices that put children's privacy at risk.
    We are also interested in emerging new technologies and practices 
that increase the amount of data collected about children. For example, 
EPIC filed several complaints and a ``friend of the court'' brief 
concerning social networking sites' privacy practices.\4\ These sites 
encourage users to make social connections online, but also build 
detailed profiles about users, and disclose personal information to 
third parties. In addition, EPIC has filed regulatory complaints and 
court documents concerning behavioral marketing practices--practices 
that expose Internet users' personal information to marketers, 
advertisers, and others without users' knowledge.\5\ These emerging 
practices affect many consumers, but children are particularly 
vulnerable.
---------------------------------------------------------------------------
    \4\ EPIC, In re Facebook, http://epic.org/privacy/inrefacebook/; 
EPIC, In re Google Buzz; http://epic.org/privacy/ftc/googlebuzz/
default.html; EPIC, Harris v. Blockbuster, http://epic.org/amicus/
blockbuster/default.html.
    \5\ EPIC, Privacy? Proposed Google/DoubleClick Merger, http://
epic.org/privacy/ftc/google/; EPIC, Google Books Litigation, http://
epic.org/privacy/googlebooks/litigation.html.
---------------------------------------------------------------------------
    We appreciate your interest in children's privacy and new 
technology, and we are grateful for the opportunity to appear before 
the Committee today.
1The Purpose of COPPA and Structure of COPPA is Essentially Sound
    The Children's Online Privacy Protection Act, as set out in the FTC 
Rule, establishes a basic framework for privacy protection. COPPA 
requires any website that collects personal information from children 
to: (1) ``provide notice on the website of what information is 
collected from children by the operator, how the operator uses such 
information, and the operator's disclosure practices for such 
information;'' \6\ (2) ``obtain verifiable parental consent for the 
collection, use, or disclosure of personal information from children;'' 
\7\ (3) provide parents with access to the information collected from 
their children; \8\ and (4) ``establish and maintain reasonable 
procedures to protect the confidentiality, security, and integrity of 
personal information collected from children.'' \9\
---------------------------------------------------------------------------
    \6\ 15 U.S.C.  6502(b)(1)(A)(i) (2009).
    \7\ 15 U.S.C.  6502(b)(1)(A)(ii) (2009).
    \8\ 15 U.S.C.  6502(b)(1)(B) (2009).
    \9\ 15 U.S.C.  6502(b)(1)(D) (2009).
---------------------------------------------------------------------------
    The FTC Rule that was promulgated included several innovative 
provisions, including one that prohibits operators from conditioning a 
child's participation in an online activity on the child's providing 
more information than is reasonably necessary to participate in that 
activity.\10\ That provision wisely anticipated that websites would try 
to extract data from children unless it was made clear that only the 
information necessary to provide the service should be obtained.
---------------------------------------------------------------------------
    \10\ 15 U.S.C.  6502(b)(1)(C) (2009).
---------------------------------------------------------------------------
    Some websites,\11\ including social network websites,\12\ comply 
with COPPA by implementing privacy safeguards for their young users. 
Many other websites,\13\ including social network sites,\14\ allege 
that their sites do not collect personal information from children, and 
are therefore exempt from COPPA requirements. Disputes over COPPA 
typically focus on the age verification procedures and the scope of 
application.
---------------------------------------------------------------------------
    \11\ E.g. The Walt Disney Co., Kids' Privacy Policy, http://
corporate.disney.go.com/corporate/kids.html (``Building on our general 
Privacy Policy, we recognize the need to provide additional privacy 
protections when children visit the sites on which this Kids' Privacy 
Policy is posted.'').
    \12\ E.g. Yoursphere, Yoursphere For Parents, http://internet-
safety.yoursphere.com/news/twitter-facebook-coppa-the-yoursphere-
difference (``Yoursphere is a membership-based, online social community 
exclusively for youth through the age of 18. Here's how Yoursphere 
meets, and exceeds COPPA guidelines. . . .'').
    \13\ E.g. N.Y. Times, The New York Times Privacy Policy Highlights, 
(``The New York Times does not knowingly collect or store any personal 
information, even in aggregate, about children under the age of 13.''); 
U.S. Bank, Privacy Policy, https://loansandlines.usbank.com/loanslines/
privacyPopup.do (``We do not intentionally market to or solicit 
personal information from children under the age of 13.'').
    \14\ E.g. Facebook, Help Center, http://www.facebook.com/help/
?safety=parents (``Facebook requires its users to be at least 13 years 
old before they can create an account. Providing false information to 
create an account is a violation of our Statement of Rights and 
Responsibilities.'').
---------------------------------------------------------------------------
    Overall, COPPA has helped to establish a general understanding that 
the collection and use of information on young children should be 
treated with care and avoided if possible. This is a sensible approach 
that recognizes both the unique vulnerabilities of young children as 
well as the limitations of a self-regulatory approach, which would 
place the burden on minors to interpret privacy policies and make 
informed decisions about the disclosure and use of personal 
information.
    We supported COPPA at the time of enactment and continue to believe 
it provides a sound basis for privacy protection.

Social Networks Have Transformed Data Collection Practices
    It is clear that the single biggest change impacting the privacy of 
children since the adoption of COPPA has been the emergence of social 
network services, such as Facebook, MySpace, and Twitter. These web-
based platforms provide new opportunities for kids to interact online 
and also for companies to gather up information.
    Leaving aside for the moment whether sites are currently in 
compliance with COPPA as they tend to discourage participation by those 
thirteen and under, I would like to focus on the broader implications 
that this technological change has had on children's privacy. In the 
simplest terms, COPPA did not anticipate the immersive online 
experience that a social network service would provide or the extensive 
data collection of both the trivial and the intimate information that 
children would share with these friends. This is not to say that the 
COPPA rules do not apply to all forms of data collection, rather the 
point is that the data collection and use is much more extensive than 
was anticipated.
    We also see the increasingly opaque way that companies transfer 
user information to third parties. On the one hand, there is a great 
deal of transparency when users are able to see what they post and to 
make decisions about who should have access. On the other, the transfer 
of user data to application developers and now to websites is not so 
easy for users to observe and control.
    More specifically, there is growing concern that companies are 
manipulating their privacy policies and privacy settings of users to 
confuse and frustrate users so that more personal information will be 
revealed. EPIC raised this concern in a petition filed with the Federal 
Trade Commission last December concerning the business practices of 
Facebook.\15\ More recently, Senators Schumer, Bennet, Begich, and 
Franken have expressed to Facebook their concern about the most recent 
changes in Facebook's business model.\16\ Senator Schumer specifically 
asked the FTC to develop guidelines for these services.\17\ Similar 
concerns are likely to arise with Twitter as the company begins to 
incorporate advertising and to track the activities of its users.
---------------------------------------------------------------------------
    \15\ EPIC, In re Facebook, http://www.epic.org/privacy/
inrefacebook/EPIC-FacebookCom
plaint.pdf.
    \16\ Letter from Senator Charles Schumer, Senator Michael Bennet, 
Senator Mark Begich, and Senator Al Franken to Facebook CEO Mark 
Zuckerberg, Apr. 27, 2010 available at http://
voices.washingtonpost.com/posttech/Schumer-Franken-Bennet-
Begich%20Letter%20to%20Face
book%204.27.10.pdf.
    \17\ Id.
---------------------------------------------------------------------------
    There is a good argument that these data collection practices 
should be regulated for all users simply because all users have an 
interest in how their personal information is used by these firms. But 
the argument is particularly strong for teenagers, those between the 
ages of 13 and 18, who have no protection under COPPA and who cannot 
easily follow all of the changes taking place in this self- regulatory 
environment. In fact, in our recent complaint to the FTC concerning 
Facebook, we were struck by how many Internet commentators, bloggers, 
and security experts found it difficult to make sense of the recent 
changes in the Facebook privacy settings.\18\
---------------------------------------------------------------------------
    \18\ Supra note 15 at 16-23.
---------------------------------------------------------------------------
    Therefore, updates to COPPA should focus specifically on the 
collection and use of data in the social network world. Teenagers 
should be given much greater control over the collection of data about 
them.

The FTC Has Failed to Enforce Children's Privacy Rights Despite Clear-
        Cut Violations
    One of the growing concerns with COPPA is the failure of the 
Federal Trade Commission to vigorously enforce its provisions. Several 
years ago, there were notable enforcement actions by the FTC. For 
example, in September 2006, the FTC brought COPPA enforcement actions 
against several companies. The FTC fined the website Xanga $1 million 
for failing to obtain parental consent for children under 13 even 
though the site clearly targeted this population.\19\ And the FTC fined 
UMG Recordings $400,00 for similar violations.\20\
---------------------------------------------------------------------------
    \19\ FTC, Xanga.com to Pay $1 Million for Violating Children's 
Online Privacy Protection Rule, Sept. 7, 2006, http://www.ftc.gov/opa/
2006/09/xanga.shtm.
    \20\ FTC, UMG Recordings, Inc. to Pay $400,000, Bonzi Software, 
Inc. To Pay $75,000 to Settle COPPA Civil Penalty Charges, Sept. 13, 
2006, http://www.ftc.gov/opa/2004/02/bonz
iumg.shtm.
---------------------------------------------------------------------------
    But it is difficult to find news of any recent enforcement action. 

The FTC claims on its website:

        The FTC has obtained numerous Federal district court 
        settlements against website operators who are alleged to have 
        violated the COPPA Rule. Press releases, and the complaints and 
        orders may be found at www.ftc.gov/privacy/privacyinitiatives/
        childrens_enf.html.
    But if you go to this link, you will find just one enforcement 
action over the last several years, which was taken against the Iconix 
Brand group and produced a fine of $250,000.\21\
---------------------------------------------------------------------------
    \21\ FTC, Iconix Brand Group Settles Charges Its Apparel Web Sites 
Violated Children's Online Privacy Protection Act, Oct. 20, 2009, 
http://www.ftc.gov/opa/2009/10/iconix.shtm.
---------------------------------------------------------------------------
    EPIC's experience with the recent Echometrix complaint is 
particularly telling. In September 29, 2009, EPIC filed a detailed 
complaint with the Federal Trade Commission alleging that Echometrix, a 
software company, was selling ``parental control'' software that was in 
fact monitoring children's online activity for marketing purposes.\22\ 
As the company itself stated about its datamining service Pulse:
---------------------------------------------------------------------------
    \22\ EPIC, In re Echometrix, http://epic.org/privacy/ftc/
Echometrix%20FTC%20Complaint%20
final.pdf; see EPIC, EPIC-Echometrix, http://epic.org/privacy/
echometrix/.

        Every single minute, Pulse is aggregating the Web's social 
        media outlets such as chat and chat rooms, blogs, forums, 
        instant messaging, and websites to extract meaningful user 
        generated content from your target audience, the teens.\23\
---------------------------------------------------------------------------
    \23\ Wendy Davis, Company Allegedly Uses Monitoring Software To 
Collect Data From Children, MediaPost News (Sept. 29, 2009), http://
www.mediapost.com/publications/?fa=Articles.show
Article&art--aid=114428. The company has since changed its 
characterization of the Pulse service.

    The EPIC complaint asked the FTC to stop these practices, seek 
compensation for victims, and ensure that Echometrix's collection and 
disclosure practices comply with COPPA.
    The Federal Trade Commission acknowledged receipt of the complaint, 
but never took an enforcement action against the company. As far as we 
know, they never even opened an investigation.
    You might conclude that perhaps our complaint was mistaken or that 
maybe the company had changed its practices, but there is more to the 
Echometrix story. Not long after we filed the complaint with the FTC, 
we learned that the Department of Defense shared our concerns about 
this product, particularly as it would place at risk children in 
military families.
    In an e-mail that we obtained through a Freedom of Information Act 
request, we learned that the Manager of the AAFES' Exchange Online 
Mall, which provides products and services for military families around 
the world, wrote to Echometrix:

        I was forwarded the attached complaint submitted to the FTC by 
        EPIC. It is very unfortunate that you did not inform me of this 
        issue. Our customer's privacy and security is very important to 
        us, and we trust our Mall partners to maintain the security of 
        our customers.

        I have removed your site, and it will stay offline until this 
        matter with EPIC and the FTC is resolved.\24\
---------------------------------------------------------------------------
    \24\ E-mail from Matthew McCoy, AAFES to Kevin Sullivan and Jeffrey 
Supinsky, Echometrix, Oct. 14, 2009 available at http://epic.org/
privacy/echometrix/Excerpts_from_echometrix
_docs_12-1-09.pdf.

    The Department of Defense was able, with just a quick review of the 
privacy issues, to determine that this product should not be sold to 
military families. But the Federal Trade Commission, which has the 
statutory authority and presumably the expertise to investigate such 
matters, simply ignored it.\25\
---------------------------------------------------------------------------
    \25\ Jaikumar Vijayan, DOD nixes vendor of online monitoring 
software over privacy concerns: EchoMetrix suspended from selling 
products via military's shopping portal, Computerworld, Dec. 4, 2009, 
http://www.computerworld.com/s/article/9141821/
DOD_nixes_vendor_of_online
_monitoring_software_over_privacy_concerns.
---------------------------------------------------------------------------
    To this date, the FTC has not explained why it failed to take 
action.

Updates to COPPA
    One area where there is a clear need to update COPPA concerns the 
scope of Personally Identifiable Information. Under the original rule, 
traditional categories of personal information, such as name, address, 
phone number and social security number are treated as ``Personal 
information.'' \26\ The Rule also wisely treats persistent identifiers, 
such as cookies, as personal information.\27\ However, the Rule did not 
anticipate the emergence of the mobile web and location-based services. 
It is possible that such information could be considered as part of the 
catchall provision, section 312.2(g), but the better approach would be 
to make explicit that location information associated with an 
individual child should be included in the categories of personal 
information.
---------------------------------------------------------------------------
    \26\  312.2 (Definitions).
    \27\  312.2(f).
---------------------------------------------------------------------------
    We would also recommend that serious consideration be given to 
raising the age of COPPA coverage. This was a hotly debated issue at 
the time of the law's enactment. At the time of introduction, the 
Children's Privacy Protection and Parental Empowerment Act of 1996, 
which later became COPPA, set the age requirement at 16. Eventually, to 
help ensure passage, the age requirement was dropped to 13. But it 
remains an opportunity, particularly now with the bill up for review, 
whether the privacy obligations should extend to those who are 16 or 
perhaps even 18.
    Today, I recommend that Congress raise the age requirement in COPPA 
to 18. The emergence of social networks and the powerful commercial 
forces that are seeking to extract personal data on all users of these 
services, but particularly children, raise new challenges that the 
original COPPA simply did not contemplate. To the extent that companies 
choose to collect personal information on children between 13 and 18, 
they should be subject to privacy obligations. If they believe that the 
privacy obligations are too burdensome, the alternative is 
straightforward: provide an online experience that does not require the 
collection of so much personal data. Innovative companies, no doubt, 
will find clever new business models that respect users' privacy.
    If the Congress chooses not to raise the age on COPPA, then I 
anticipate that the privacy problems will grow more severe in the next 
few years. Not only will companies that target young teens gather more 
data, their business practices will become increasingly more opaque and 
more difficult for users to manage. We have seen just in the last few 
years how companies such as Facebook have found that they can 
manipulate privacy settings and change privacy policies to coax 
personal information out of users who had earlier made clear which 
information they would reveal and which information they would keep 
private.
    There is one proviso for this recommendation. For children in 
between the ages of 13 to 18, I believe that the companies subject to 
COPPA should have an obligation to provide privacy rights directly to 
the users of their services and not to their parents. By this I mean 
that it is the kids who should be able to learn how their personal data 
is being gathered and object where appropriate. I think this approach 
will encourage teenagers to exercise greater control over their online 
experience and to understand the privacy practices of the companies 
they deal with. While it is appropriate that parents make these 
decisions for younger children, creating privacy rights for teenagers 
is likely to lead to better informed decisions and greater 
consideration of privacy interests by companies providing online 
services.
    The growing concerns about the FTC's ability to safeguard online 
privacy raises another concern and that is whether the FTC has the 
authority and the competence to address emerging privacy challenges. It 
is not just in the area of COPPA enforcement that there are concerns. 
The FTC has also shown an inability to address such important new 
topics as cloud computing, location privacy, or the broader question of 
the effectiveness of web privacy policies and self-regulation.
    EPIC has had several important complaints pending at the FTC. 
Whereas previous Commissions acted forcefully on the recommendations of 
consumer privacy groups, the current FTC seems unwilling or unable to 
address the privacy challenges that confront users of new services 
every day.\28\ In one particularly egregious example, it took the 
attack on Google in China in January of this year to get the company to 
routinely encrypt Gmail, something that EPIC had specifically 
recommended to the FTC in our March 2009 complaint.\29\
---------------------------------------------------------------------------
    \28\ Marc Rotenberg, ``Does the FTC Care About Consumer Privacy?'' 
9 BNA Privacy and Security Law 453,478 (March 29, 2010).
    \29\ EPIC, in re Google and Cloud Computing, http://epic.org/
privacy/cloudcomputing/google/ftc031709.pdf at  9, 30, 47; see EPIC, 
In re Google and Cloud Computing, http://epic.org/privacy/
cloudcomputing/google/.
---------------------------------------------------------------------------
    There is another issue I would like to bring your attention to 
concerning children and new technology. While much of COPPA's focus is 
understandably directed toward the Internet and data gathering activity 
by commercial firms, it is important to consider also how new 
technologies are gathering data on children in public spaces and with 
new communications technologies. There is, for example, the use of RIFD 
technology for identity documents that makes it possible to track and 
record the location of children. Properly implemented there may be some 
security benefits. But there are also substantial risks that should be 
considered. In one case, public objections led a school to drop its 
plan to require RFID-enabled tags for identity documents.\30\
---------------------------------------------------------------------------
    \30\ Wired, School Drops RFID Tag Program, Feb. 16, 2005, http://
www.wired.com/techbiz/media/news/2005/02/66626.
---------------------------------------------------------------------------
Conclusion
    COPPA was a smart and forward-looking privacy law. It helped slow 
the commercialization of personal information concerning children and 
it promoted safety and respect for the treatment of minors using new 
online services. Around the edges, there are understandable questions 
about application and implementation. Age verification continues to be 
a challenge. But the central purpose--to establish privacy safeguards 
for the collection and use of personal information on children--is 
sensible and important. The critical task now is to carry forward this 
goal as new business practices continue to raise new privacy 
challenges.
    Thank you for your interest. I will be pleased to answer your 
questions.
References
    EPIC, ``EPIC--Children's Online Privacy Protection Act (COPPA)'' 
http://epic.org/privacy/kids/default.html
    EPIC, ``EPIC--Cloud Computing'' http://epic.org/privacy/
cloudcomputing/
    EPIC, ``EPIC--Echometrix'' http://epic.org/privacy/echometrix/
    EPIC, ``FTC Complaint on Amazon.com COPPA Compliance'' (Apr. 22, 
2003) http://epic.org/privacy/amazon/coppacomplaint.html
    EPIC, ``Radio Frequency Identification (RFID) Systems'' http://
epic.org/privacy/rfid/
    EPIC, ``In re Facebook'' http://epic.org/privacy/inrefacebook/
    EPIC, ``In re Google Buzz'' http://epic.org/privacy/ftc/googlebuzz/
default.html
    EPIC, ``In re Google and Cloud Computing'' http://epic.org/privacy/
cloudcomputing/google/
    FTC, ``Children's Online Privacy Protection Rule; Final Rule'' 
http://www.ftc.gov/os/1999/10/64fr59888.htm
    FTC, ``COPPA FAQs'' http://www.ftc.gov/privacy/coppafaqs.shtm
    FTC, ``How to Comply With The Children's Online Privacy Protection 
Rule'' http://www.ftc.gov/bcp/edu/pubs/business/idtheft/bus45.shtm 

    Senator Pryor. Thank you.
    Mr. Szoka.

            STATEMENT OF BERIN SZOKA, SENIOR FELLOW

           AND DIRECTOR, CENTER FOR INTERNET FREEDOM,

               THE PROGRESS & FREEDOM FOUNDATION

    Mr. Szoka. Mr. Chairman, Mr. Ranking Member, and Committee 
members, thank you for inviting me here today.
    Despite sitting at the kids' table, I am a Senior Fellow at 
The Progress & Freedom Foundation. So, you can just imagine how 
young my colleagues must be!
    But, I commend the Committee for studying COPPA, and also 
the Federal Trade Commission, for its review of the COPPA rule, 
which I think is an important distinction we should keep in 
mind.
    As Ms. Rich explained, for an ``Internet junior,'' as we 
have referred to it, of sites that are directed to children 
under 13, COPPA requires sites to either age-verify all users 
or to limit the functionality of the site to prevent children 
from making personal information publicly available, including 
the sharing of user-generated content.
    COPPA imposes the same requirement on general audience 
sites when they have actual knowledge that they are collecting 
information from a user under 13 or, again, enabling them to 
share information.
    Because of this forced separation and the costs of age 
verification, COPPA may well have unintentionally limited the 
choice and competition in the marketplace for children's 
content by driving consolidation in that marketplace.
    On the other hand, COPPA has been reasonably successful in 
fulfilling Congress's original goal of enhancing parental 
involvement to protect children's online privacy and safety.
    Whatever this tradeoff, I am here today to caution against 
expanding COPPA beyond its original, limited purpose. COPPA's 
unique value lies in its flexibility, its subtlety, and its 
intentional narrowness. And my concern here is not just about 
innovation, but also about free speech.
    COPPA is flexible, because it potentially applies the--to 
the entire Internet, regardless of the access device used, 
including services scarcely imaginable in 1998.
    COPPA is subtle, because it requires verifiable parental 
consent, not only if site and service operators gather personal 
information from kids for their own use, but also if they 
enable children to make that information publicly available 
online.
    Even more subtle, however, is COPPA's creative solution to 
the thorny problem of age verification. And, in a nutshell, I 
would say that 13 is just right. Unlike the similarly named 
Child Online Protection Act, or COPA, COPPA requires age 
verification of users on sites clearly directed at children 
only--and, again, where they have actual knowledge; whereas, 
COPA required age verification of all users for any site 
offering content deemed harmful to minors.
    Back in 1998, Congress considered, but wisely chose not, to 
apply COPPA to adolescents. Unfortunately, recent efforts to 
expand COPPA have put online privacy, child safety, free 
speech, and anonymity on a collision course. Several states 
have proposed what we, at PFF, have called ``COPPA 2.0 laws,'' 
extending COPPA to adolescents under 17 or 18. But, once the 
age threshold rises above 13, it becomes increasingly difficult 
to distinguish sites directed at children below the threshold 
from general audience sites. With this seemingly small change, 
COPPA would essentially converge with COPA. COPPA would extend 
beyond a discreet Internet junior to require age verification 
for sites used by many adults. And indeed, other states have 
proposed simply extending COPPA to all social networking sites.
    But, requiring adults and even older teens to prove their 
age by identifying themselves constitutes a prior restraint on 
anonymous or pseudo anonymous communications. And this would 
raise the same First Amendment concerns that caused the courts 
to strike down COPA.
    Ironically, broader age verification mandates would 
actually reduce online privacy by requiring more information to 
be collected, both from adolescents and from adults, which 
would include credit card information. While COPPA's safe 
harbor is playing a valuable part in administering self-
regulation under COPPA, government shouldn't put them in the 
awkward position of becoming repositories for huge troves of 
personal information in the name of protecting privacy.
    Nor would COPPA expansion make adolescents safer online. 
Some have argued that age-verification mandates could protect 
children by allowing sites to create safe spaces that exclude 
predators. Unfortunately, the reality is that technology for 
reliable age verification simply does not exist. Even the FTC 
has made it clear that it doesn't consider COPPA's verifiable 
parental consent methods, such as the use of a credit card, as 
equivalent to strict age verification.
    COPPA could--expansion could also undermine the viability 
of many online sites and services. As you've heard here today, 
some consider the real marketers--excuse me--marketers to be 
the real predators, even though advertising is what we have 
called ``the great hidden benefactor'' that funds the 
overwhelming majority of free online content and services. 
COPPA already applies to the collection of personal information 
that could potentially allow the contacting of children under 
13, and the Network Advertising Initiative already requires 
verifiable parental consent for behavioral advertising to 
children under 13. But, if COPPA were expanded to require 
general audience sites funded by tailored advertising to age-
verify all users, it would devolve into the unconstitutional 
approach found in COPPA.
    Importantly, COPPA expansion would also raise costs for 
smaller or new sites and services geared toward minors. And, in 
turn, this could discourage innovation, limit choice, and raise 
prices for consumers, and, as I mentioned before, also 
potentially restrict speech.
    But, ultimately, concerns about tailored advertising may be 
less about privacy or safety than what about--advertising 
scholar Jack Calfee, of the American Enterprise Institute, has 
called ``the fear of persuasion,'' the idea that advertising is 
inherently manipulative, and grows only more so with increased 
relevance. As he has noted, by 10 or so, children have a full 
understanding of the purpose of advertising, and, equally 
important, an active suspicion of what advertisers say. If 
government has a role in--to play in addressing concerns about 
tailored marketing, it lies in educating kids about 
advertising, to help them become smarter consumers.
    Last week, the FTC launched just such an education 
campaign, with its AdMongo tutorial website. The FTC excels in 
consumer education, and should be encouraged in these efforts 
as a less restrictive alternative to regulation.
    Finally, briefly, I want to caution that H.R. 4173, passed 
by the House in the fall, would give the FTC the capability, 
even if it didn't intend to do so today, to unilaterally change 
COPPA, including its age range. And I would simply suggest that 
such changes should be made by Congress, and not the FTC. If 
Congress wants to help the FTC implement COPPA, it should 
consider additional funding for education, and indeed for 
enforcement.
    Thank you for inviting me to testify.
    [The prepared statement of Mr. Szoka follows:]

    Prepared Statement of Berin Szoka, Senior Fellow and Director, 
     Center for Internet Freedom, The Progress & Freedom Foundation

    Mr. Chairman and Committee members, thank you for inviting me here 
today. My name is Berin Szoka.\1\ I'm a Senior Fellow at The Progress & 
Freedom Foundation (PFF). PFF is a market-oriented think tank and 
501(c)(3) non-profit founded in 1993 that studies the digital 
revolution and its implications for public policy. PFF's mission is to 
educate policymakers, opinion leaders, and the public about issues 
associated with technological change, based on a philosophy of limited 
government, free markets, and individual sovereignty.
---------------------------------------------------------------------------
    \1\ The views expressed here are his own, and not necessarily the 
views of the PFF board, other fellows or staff.
---------------------------------------------------------------------------
    I commend this committee for studying the Children's Online Privacy 
Protection Act or COPPA, and the FTC for its upcoming COPPA Review and 
Roundtable.\2\ My colleague Adam Thierer, PFF's President, has been 
actively engaged in debates about online child safety and privacy since 
joining PFF in 2005, and is the author of Parental Controls & Online 
Child Protection: Survey of Tools & Methods, a regularly updated 
compendium now in its fourth edition and available for free online.\3\ 
The constant theme in PFF's work in this area has been to emphasize the 
tools and methods available to parents to control their children's use 
of media, including the Internet and to the central role played by 
education efforts in helping both parents and children make smarter 
choices. We also highlight enforcement of existing laws as an 
additional ``less restrictive'' alternative to new regulation, and 
attempt to highlight the trade-offs involved in imposing new regulation 
of online communications.
---------------------------------------------------------------------------
    \2\ Federal Trade Commission, Request for Public Comment on the 
FTC's Implementation of the Children's Online Privacy Protection Rule, 
April 5, 2010, http://www.ftc.gov/os/2010/03/100324coppa.pdf; see also 
COPPA Rule Review Roundtable, http://www.ftc.gov/bcp/workshops/coppa/
index.shtml.
    \3\ Adam Thierer, Parental Controls & Online Child Protection: 
Survey of Tools & Methods, Version 4.0, Fall 2008, www.pff.org/
parentalcontrols/index.html.
---------------------------------------------------------------------------
    In May 2009, Adam and I published a 35-page paper entitled COPPA 
2.0: The New Battle over Privacy, Age Verification, Online Safety & 
Free Speech, providing an overview of COPPA, how it works, its costs 
and benefits, and explaining the dangers inherent in several then-
pending efforts to expand COPPA by expanding the law to cover 
adolescents or all social networking sites.\4\ We identified a number 
of legal, technical, and other practical problems with such proposals 
in that they would:
---------------------------------------------------------------------------
    \4\ Berin Szoka & Adam Thierer, COPPA 2.0: The New Battle over 
Privacy, Age Verification, Online Safety & Free Speech, Progress on 
Point 16.11, May 2009, http://pff.org/issues-pubs/pops/2009/pop16.11-
COPPA-and-age-verification.pdf.

   Burden the free speech rights of adults by imposing age 
        verification mandates on many sites used by adults, thus 
        restricting anonymous speech and essentially converging--in 
        terms of practical consequences--with the unconstitutional 
        Children's Online Protection Act (COPA),\5\ another 1998 law 
        sometimes confused with COPPA;
---------------------------------------------------------------------------
    \5\ 47 U.S.C.  231. While COPPA governs sites ``directed at'' 
children, COPA would have required age verification for content deemed 
``harmful to minors.'' COPA has been struck down on First Amendment 
grounds.

   Burden the free speech rights of adolescents to speak freely 
        on--or gather information from--legal and socially beneficial 
---------------------------------------------------------------------------
        websites;

   Hamper routine and socially beneficial communication between 
        adolescents and adults;

   Reduce, rather than enhance, the privacy of adolescents, 
        parents and other adults because of the massive volume of 
        personal information that would have to be collected about 
        users for authentication purposes (likely including credit card 
        data);

   Would likely be the subject of massive fraud or evasion 
        since it is not always possible to definitively verify the 
        parent-child relationship, or because the system could be 
        ``gamed'' in other ways by determined adolescents;

   Do nothing to prevent offshore sites and services from 
        operating outside these rules;

   Present major practical challenges for law enforcement 
        officials in the face of such evasion by both domestic users 
        and offshore sites;

   Could destroy opportunities for new or smaller website 
        operators to break into the market and offer competing services 
        and innovations, thus contributing to consolidation of online 
        content and services by erecting barriers to entry; and

   Violate the Commerce Clause of the U.S. Constitution if 
        enacted by states, since Internet activity clearly represents 
        interstate commerce that states have no authority to regulate.

    This testimony summarizes the key aspects of that paper, which I 
attach below for the Committee's convenience, but also provides 
additional context on subsequent developments and related issues. 
Subsequently, I filed written testimony with the Maine Legislature 
regarding proposals in Maine, including a law enacted over the summer 
but never enforced by the state attorney general, to apply the COPPA 
framework to the collection of health-related information from 
adolescents.\6\ We also look forward filing comments in the FTC's 
upcoming COPPA Review.
---------------------------------------------------------------------------
    \6\ Berin Szoka, Written to Maine Legislature on Act to Protect 
Minors from Pharmaceutical Marketing Practices, LD 1677, March 4, 2010, 
www.pff.org/issues-pubs/filings/2010/2010-03-04-
Maine_Law_Testimony.pdf.
---------------------------------------------------------------------------
    COPPA can best be summarized as follows: For an ``Internet Jr.'' of 
sites ``directed at'' children under 13, COPPA requires sites either to 
age-verify all users or limit functionality to prevent children from 
making personal information ``publicly available''--including the 
sharing of user-generated content. COPPA imposes the same requirement 
on general audience sites when they have actual knowledge a user is 
under 13.

The Costs of COPPA
    Because of this forced separation and the costs of age 
verification, COPPA may well have unintentionally limited choice and 
competition by driving increased consolidation in the marketplace for 
child-oriented sites and services online and discouraging new entry by 
smaller ``mom-and-pop'' sites that could cater to children. As early as 
2001, even some Congressmen recognized this ``unintended consequence'' 
of COPPA in Congressional hearings on privacy.\7\ There are significant 
costs associated with the verifiable parental consent methods used to 
comply with COPPA. Of course, it could be the case that there are other 
reasons that there are relatively few sites catering exclusively to 
children. But this is a question worth considering, and the FTC 
deserves credit for beginning its COPPA review with this question.\8\ 
As noted by Parry Aftab, Executive Director of the children's advocacy 
group Wired Safety, ``COPPA wasn't responsible for the demise of these 
sites, but when combined with the other factors [it] tipped the 
balance.'' \9\ She concludes, appropriately:
---------------------------------------------------------------------------
    \7\ Rep. Billy Tauzin (R-LA) noted that COPPA ``has now forced 
companies to discontinue a number of products targeted toward 
children'' and asked ``If we end up forcing private companies and 
nonprofits to eliminate beneficial products such as crime prevention 
material, have we done a good thing? If teen-friendly sites, those that 
totally respect the privacy of the users stop offering e-mail services 
to children, is that a good thing? An Examination of Existing Federal 
Statutes Addressing Information Privacy: Hearing of the House Committee 
On Energy and Commerce, 107th Cong. 6 (April 3, 2001) (statement of 
Rep. Tauzin.), available at http://
republicans.energycommerce.house.gov/107/action/107-22.pdf.
    \8\ Federal Trade Commission, Request for Public Comment on the 
FTC's Implementation of the Children's Online Privacy Protection Rule, 
at 2 April 5, 2010, http://www.ftc.gov/os/2010/03/100324coppa.pdf.
    \9\ Comments of Parry Aftab, Request for Public Comment on the 
Implementation of COPPA and COPPA Rule's Sliding Scale Mechanism for 
Obtaining Verifiable Parental Consent Before Collecting Personal 
Information from Children at 3, June 27, 2005, www.ftc.gov/os/comments/
COPPArulereview/516296-00021.pdf.

        It is crucial that at this tentative stage for the kids 
        Internet industry we don't do anything to make its survival 
        more difficult. We should be looking at easy to encourage safer 
        communities for preteens and innovations to help create fun, 
        entertaining and educational content for kids online.\10\
---------------------------------------------------------------------------
    \10\ Id.
---------------------------------------------------------------------------
The Success of COPPA
    On the other hand, COPPA has been reasonably successful in 
fulfilling Congress's original goals, as expressed by the law's 
Congressional sponsors:

        (1) to enhance parental involvement in a child's online 
        activities in order to protect the privacy of children in the 
        online environment; (2) to enhance parental involvement to help 
        protect the safety of children in online fora such as 
        chatrooms, home pages, and pen-pal services in which children 
        may make public postings of identifying information; (3) to 
        maintain the security of personally identifiable information of 
        children collected online; and (4) to protect children's 
        privacy by limiting the collection of personal information from 
        children without parental consent.\11\
---------------------------------------------------------------------------
    \11\ 144 Cong. Rec. S11657 (daily ed. Oct. 7, 1998) (statement of 
Rep. Bryan).

    Thus, as its name implies, COPPA is first and foremost about 
protecting the privacy of children. COPPA's primary means for achieving 
this goal is enhancing parental involvement or, as the FTC has put it, 
``provid[ing] parents with a set of effective tools . . . for becoming 
involved in and overseeing their children's interactions online.'' \12\ 
However admirable, ``protect[ing] the safety of children'' is merely an 
indirect goal of COPPA--something to be achieved through the means of 
enhancing parental involvement (COPPA's direct goal). The FTC declares 
that COPPA ``has provided a workable system to help protect the online 
safety and privacy of the Internet's youngest visitors.'' \13\
---------------------------------------------------------------------------
    \12\ Federal Trade Commission, Implementing the Children's Online 
Privacy Protection Act: A Report to Congress at 28, Feb. 2007, 
www.ftc.gov/reports/coppa/07COPPA_Report_to
_Congress.pdf.
    \13\ Id.
---------------------------------------------------------------------------
    Indeed, COPPA may succeed in achieving its original purpose of 
enhancing parental involvement, but strict age verification mandates 
intended to go beyond COPPA will ultimately fail because kids will 
simply lie to circumvent age verification requirements. As Microsoft 
researcher Danah Boyd has put it, ``COPPA did not stop most children 
from creating accounts, but it did teach children and their parents an 
important lesson: Lying is the path to access.'' \14\ Even though 
``there is no perfect solution'' and it is not possible to completely 
``stop a child from lying and putting themselves at risk,'' Denise 
Tayloe of Privo, one of the four FTC-approved providers of COPPA safe 
harbor age verification services, believes that COPPA ``provides a 
platform to educate parents and kids about privacy.'' \15\
---------------------------------------------------------------------------
    \14\ Danah Michele Boyd, Taken Out of Context American Teen 
Sociality in Networked Publics, at 151 Fall 2008, www.danah.org/papers/
TakenOutOfContext.pdf.
    \15\ E-mail from Denise Tayloe to Adam Thierer (Mar. 15, 2007) 
(copy on file with author).
---------------------------------------------------------------------------
    Especially given this practical limitation and whatever the trade-
offs involved in COPPA, I'm here today to caution against expanding 
COPPA beyond its original, limited purpose. COPPA's unique value lies 
in its flexibility, subtlety, and intentional narrowness.
COPPA is Flexible Enough to Cover a Rapidly Changing Landscape
    COPPA is flexible because it potentially applies to the entire 
Internet regardless of the access device used--including services 
scarcely imaginable in 1998. Specifically, COPPA applies to any 
``operator,'' which the statute defines to mean:

        any person who operates a website located on the Internet or an 
        online service and who collects or maintains personal 
        information from or about the users of or visitors to such 
        website or online service, or on whose behalf such information 
        is collected or maintained, where such website or online 
        service is operated for commercial purposes, including any 
        person offering products or services for sale through that 
        website or online service, involving commerce.\16\
---------------------------------------------------------------------------
    \16\ 15 U.S.C.  6501(2).

---------------------------------------------------------------------------
    COPPA defines the key term ``Internet'' broadly to mean:

        collectively the myriad of computer and telecommunications 
        facilities, including equipment and operating software, which 
        comprise the interconnected worldwide network of networks that 
        employ the Transmission Control Protocol/ Internet Protocol, or 
        any predecessor or successor protocols to such protocol, to 
        communicate information of all kinds by wire or radio.\17\
---------------------------------------------------------------------------
    \17\ 15 U.S.C.  6501(6).

---------------------------------------------------------------------------
    In interpreting its COPPA Rule, the FTC has said:

        The Rule's Statement of Basis and Purpose makes clear that the 
        term Internet is intended to apply to broadband networks, as 
        well as to intranets maintained by online services that either 
        are accessible via the Internet, or that have gateways to the 
        Internet.\18\
---------------------------------------------------------------------------
    \18\ Federal Trade Commission, Frequently Asked Questions about the 
Children's Online Privacy Protection Rule, Question 6 (``What types of 
online transmissions does COPPA apply to?''), www.ftc.gov/privacy/
coppafaqs.shtm.

    Because nearly all communications platforms have converged on the 
``Internet,'' thus defined, COPPA would reach a wide variety of 
services and media not commonly thought of as belonging to the 
``Internet.'' For example, if a video game console is networked through 
the Internet to allow users to play games with each other, COPPA would 
apply to potential sharing of personal information. To this extent, the 
FTC ought not need new statutory authority from Congress.
COPPA's Subtlety Lies in its Narrowness
    COPPA is subtle because it requires ``verifiable parental consent'' 
not only if site and service operators gather personal information from 
kids for their own use, but also if sites enable children to make 
personal information ``publicly available'' online. Even more subtle is 
COPPA's creative solution to the thorny problem of age verification. 
Unlike the similarly-named Child Online Protection Act of 1998 (COPA, 
pronounced ``koh-pah'' instead of ``kah-pah''),\19\ COPPA only requires 
age verification of users onsites clearly directed at children, whereas 
COPA required it for any site offering content deemed ``harmful to 
minors.''
---------------------------------------------------------------------------
    \19\ 47 U.S.C.  231.
---------------------------------------------------------------------------
Efforts to Expand COPPA Raise Serious First Amendment Concerns
    Back in 1998, Congress wisely chose not to apply COPPA to 
adolescents. Unfortunately, recent efforts to expand COPPA have put 
online privacy, child safety, free speech and anonymity on a collision 
course. Several states have proposed what we at PFF have called ``COPPA 
2.0'' laws, extending COPPA to adolescents up to 17 or 18. But once the 
age threshold rises above 13, it becomes increasingly difficult to 
distinguish sites ``directed at'' children below the threshold from 
general audience sites. With this seemingly small change, COPPA would 
essentially converge with COPA: COPPA would extend beyond a discrete 
``Internet, Jr.'' to require age verification for sites used by many 
adults--and, indeed, other states have proposed simply extending COPPA 
to all social networking sites. But requiring adults and even older 
teens to prove their age by identifying themselves constitutes a prior 
restraint on anonymous or pseudonymous communication. This raises the 
same First Amendment concerns that caused the courts to strike down 
COPA.
    After a decade-long court battle over COPA's constitutionality, the 
U.S. Supreme Court in January 2009 rejected the government's latest 
request to revive the law, meaning it is likely dead.\20\ Three of the 
key reasons the courts struck down COPA would also apply to COPPA 2.0 
proposals:
---------------------------------------------------------------------------
    \20\ See Adam Thierer, The Progress & Freedom Foundation, Closing 
the Book on COPA, PFF Blog, Jan. 21, 2009, http://blog.pff.org/
archives/2009/01/closing_the_boo.html. See also Alex Harris, Child 
Online Protection Act Still Unconstitutional, http://
cyberlaw.stanford.edu/packet/200811/child-online-protection-act-still-
unconstitutional.

   Anonymous Speech Rights of Adults. COPA burdened the speech 
        rights of adults to access information subject to age 
        verification requirements, both by making speech more difficult 
        and by stigmatizing it. In 2003, the Third Circuit noted that 
        age verification requirements ``will likely deter many adults 
        from accessing restricted content, because many Web users are 
        simply unwilling to provide identification information in order 
        to gain access to content, especially where the information 
        they wish to access is sensitive or controversial.'' \21\ The 
        Supreme Court has recognized the vital importance of anonymous 
        speech in the context of traditional publication.\22\ By 
        imposing broad age verification requirements, COPPA 2.0 would 
        restrict the rights of adults to send and receive information 
        anonymously just as COPA did. If anything, the speech burdened 
        by COPPA 2.0 deserves more protection, not less, than the 
        speech burdened by COPA: Where COPA merely burdened access to 
        content deemed ``harmful to minors'' (viz., pornography), COPPA 
        2.0 would burden access to material by adults as well as minors 
        not because that material is harmful or obscene but merely 
        because it is ``directed at'' minors! Thus, the content covered 
        by COPPA 2.0 proposals could include not merely pornography, 
        but communications about political nature, which deserved the 
        highest degree of First Amendment protection.
---------------------------------------------------------------------------
    \21\ American Civil Liberties Union v. Ashcroft, 322 F.3d 240, 259 
(3d Cir. 2003).
    \22\ McIntyre v. Ohio Elections Comm'n, 514 U.S. 334, 342 (1995) 
(striking down law that prohibited distribution of anonymous campaign 
literature); see also Talley v. California, 362 U.S. 60 (1960) 
(striking down a state law that forbade all anonymous leafletting).

   Speech Rights of Site Operators. The necessary corollary of 
        blocking adults from accessing certain content anonymously--and 
        thereby deterring some users from accessing that content--is 
        that COPPA 2.0 proposals would, like COPA, necessarily reduce 
        the audience size of websites subject to age verification 
        mandates. Furthermore, such mandates would encourage websites 
        to self-censor themselves to avoid offering content they fear 
        could be considered ``directed at'' adolescents because doing 
        so might subject them to an age verification mandate--or to 
        legal liability if they fail to implement age verification. The 
        substantial cost of age verification could significantly 
        impact, if not make impossible, sites that allow sharing of 
        personal information, including user-generated content, because 
        such sites generally do not charge for content and rely instead 
        on advertising revenues. The Third Circuit cited all of these 
        burdens on the free speech rights of website operators in 
        striking down COPA.\23\
---------------------------------------------------------------------------
    \23\ See ACLU III, 534 F.3d at 196-97 (citing ACLU v. Gonzales, 478 
F. Supp. 2d 775, 804). The Court held that websites ``face significant 
costs to implement [COPA's age verification mandates] and will suffer 
the loss of legitimate visitors once they do so.'' Id. at 197.

   Less Restrictive Alternatives to Regulation. The Third 
        Circuit drew on the Supreme Court's 2004 decision striking down 
        COPA on the grounds that ``[b]locking and filtering software is 
        an alternative that is less restrictive than COPA, and, in 
        addition, likely more effective as a means of restricting 
        children's access to materials harmful to them.'' \24\ 
        Similarly, parental control software already empowers parents 
        to restrict their kids' access to sites that ``collect'' 
        personal information. It's particularly easy for parents to 
        restrict access to the leading social networking sites that 
        seem to be driving so much of the push for COPPA 2.0.
---------------------------------------------------------------------------
    \24\ Id. at 198 (quoting ACLU v. Mukasey, 534 F.3d 181, 198 
(2008)).
---------------------------------------------------------------------------
COPPA Expansion Would Undermine Privacy
    Ironically, broad age verification mandates would reduce online 
privacy by requiring more information to be collected from both 
adolescents and adults, including credit card information, in order to 
verify age and the parent/child relationship (in the admittedly 
imperfect fashions prescribed by COPPA's ``Sliding Scale''). While 
COPPA's safe harbor administrators play a valuable role in 
administering self-regulation under COPPA,\25\ government shouldn't put 
them in the awkward position of becoming repositories for huge troves 
of personal information in the name of protecting privacy.
---------------------------------------------------------------------------
    \25\ The four safe harbor programs are administered by the 
Children's Advertising Review Unit of the Council of Better Business 
Bureaus (CARU); the Entertainment Software Rating Board (ESRB); TRUSTe; 
and Privo. See Federal Trade Commission, Safe Harbor Program, www.ftc
.gov/privacy/privacyinitiatives/childrens_shp.html.
---------------------------------------------------------------------------
COPPA Expansion Would Not Enhance Child Safety
    Some have argued that age verification mandates could protect 
children by allowing sites to create ``safe spaces'' that exclude 
predators. Unfortunately, the reality is that the technology for 
reliable age verification simply doesn't exist.
    Federal courts have found that there is ``no evidence of age 
verification services or products available on the market to owners of 
websites that actually reliably establish or verify the age of Internet 
users. Nor is there evidence of such services or products that can 
effectively prevent access to Web pages by a minor.'' \26\ Few public 
data bases exist that could be referenced to conduct such verifications 
for minors, and most parents do not want the few records that do exist 
about their children (e.g., birth certificates, Social Security 
numbers, school records) to become more easily accessible.\27\ Indeed, 
concerns about those records being compromised or falling into the 
wrong hands have led to legal restrictions on their accessibility.\28\ 
Even the FTC has made clear that it doesn't consider COPPA's ``sliding 
scale'' of verifiable parental consent methods--use of a credit card, 
print-and-fax forms, follow-up phone calls and e-mails, and using 
encryption certificates \29\--as equivalent to strict age 
verification.\30\
---------------------------------------------------------------------------
    \26\ Gonzales, 478 F. Supp. 2d at 806.
    \27\ See Adam Thierer, The Progress & Freedom Foundation, Age 
Verification Debate Continues; Schools Now at Center of Discussion, PFF 
Blog, Sept. 25, 2008, http://blog.pff.org/archives/2008/09/
age_verificatio_1.html.
    \28\ Various laws and regulations have been implemented that shield 
such records from public use, including various state statutes and the 
Family Educational Rights and Privacy Act of 1974, 20 U.S.C.  1232g, 
www.ed.gov/policy/gen/guid/fpco/ferpa/index.html.
    \29\ 16 C.F.R.  312.5(b)(2).
    \30\ In a February 2007 report to Congress about the status of the 
law and its enforcement, the FTC said that no changes to COPPA were 
then necessary because the law had ``been effective in helping to 
protect the privacy and safety of young children online.'' Federal 
Trade Commission, Implementing the Children's Online Privacy Protection 
Act: A Report to Congress at 1, Feb. 2007, www.ftc.gov/reports/coppa/
07COPPA_Report_to_Congress.pdf. In discussing the effectiveness of the 
parental consent verification methods authorized in the FTC's sliding 
scale approach, however, the agency acknowledged that ``none of these 
mechanisms is foolproof.'' Id. at 13. The FTC attempts to distinguish 
these parental consent verification methods from other kinds of age 
verification tools in noting that ``age verification technologies have 
not kept pace with other developments, and are not currently available 
as a substitute for other screening mechanisms.'' Id. at 12.
---------------------------------------------------------------------------
Fears of Advertising Should Not Drive COPPA Expansion
    COPPA expansion could also undermine the viability of many online 
sites and services. Some consider marketers the ``real predators''--
even though advertising is the great ``Hidden Benefactor'' \31\ that 
funds the overwhelming majority of ``free'' Internet content and 
services. COPPA already applies to the collection of information that 
could potentially allow the contacting of a child under 13. The Network 
Advertising Initiative already requires verifiable parental consent for 
behavioral advertising to children under 13. But if COPPA were expanded 
to require general audience sites funded by tailored advertising to 
age-verify all users, it would devolve into the unconstitutional 
approach found in COPA. Importantly, COPPA expansion would also raise 
costs for smaller or new sites and services geared toward minors. This 
could discourage new innovation, limit choice, and raise prices for 
consumers.\32\
---------------------------------------------------------------------------
    \31\ Adam Thierer & Berin Szoka, The Hidden Benefactor: How 
Advertising Informs, Educates & Benefits Consumers, Progress on Point 
6.5, Feb. 2010, www.pff.org/issues-pubs/ps/2010/pdf/ps6.5-the-
hiddenbenefactor.pdf.
    \32\ In 2005, the FTC has cited an estimate of $45/child as the 
cost of obtaining verifiable parental consent for child-oriented sites 
to comply with COPPA. See Comments of Parry Aftab, Request for Public 
Comment on the Implementation of COPPA and COPPA Rule's Sliding Scale 
Mechanism for Obtaining Verifiable Parental Consent Before Collecting 
Personal Information from Children at 2, June 27, 2005, www.ftc.gov/os/
comments/COPPArulereview/516296-00021.pdf.
---------------------------------------------------------------------------
    Ultimately, concerns about tailored advertising may be less about 
privacy than about what advertising scholar Jack Calfee has dubbed the 
``Fear of Persuasion''--the idea that advertising is inherently 
manipulative and only grows more so with increased relevance. But as 
Calfee notes, ``by the age 10 or so, children develop a full 
understanding of the purpose of advertising and equally important, an 
active suspicion of what advertisers say.'' \33\ If government has a 
role to play in addressing concerns about tailored marketing, it lies 
in educating kids about advertising to help them become smarter 
consumers. Last week, the FTC launched just such an education campaign 
with its AdMongo tutorial website (www.admongo.gov).\34\ The FTC excels 
in consumer education, and should be encouraged in these efforts as a 
less restrictive alternative to regulation. Other excellent examples of 
FTC education efforts include:
---------------------------------------------------------------------------
    \33\ Jack Calfee, American Enterprise Institute, Fear of 
Persuasion: A New Perspective on Advertising and Regulation, 59 (1997).
    \34\ Federal Trade Commission to Launch Advertising Literacy 
Campaign National Program Gives `Tweens' Ages 8 to 12 Skills to 
Recognize, Understand Advertising, April 26, 2010, www.ftc.gov/opa/
2010/04/admongo.shtm.

        OnGuardOnline.gov (tips on online security, fraud avoidance and 
---------------------------------------------------------------------------
        privacy);

        NetCetera: Chatting With Kids About Being Online 
        (www.onguardonline.gov/topics/netcetera.aspx); and

        You Are Here: Where Kids Learn to be Smarter Consumers 
        (ftc.gov/youarehere/).

Opening the Door to COPPA Expansion through FTC Overhaul via 
        Financial Reform
    Finally, financial reform legislation recently passed by the House 
would give the FTC sweeping new rulemaking powers, and could allow the 
FTC to unilaterally change COPPA, including its age range. 
Specifically, H.R. 4173 would give the FTC normal rulemaking authority 
under the Administrative Procedures Act, replacing the special 
rulemaking procedures crafted by Congress with the 1975 Magnuson-Moss 
Act, and strengthened through additional procedural safeguards in 1980, 
to ensure that the agency did not rush into preemptive regulation 
without carefully weighing the costs and benefits of government 
intervention.\35\
---------------------------------------------------------------------------
    \35\ See generally, Berin Szoka, How Financial Overhaul Could Put 
the FTC on Steroids & Transform Internet Regulation Overnight, Progress 
Snapshot 6.7, March 2010, www.pff.org/issues-pubs/ps/2010/pdf/ps6.7-
FTC_on_steroids.pdf.
---------------------------------------------------------------------------
    Such decisions should be made by Congress, not the FTC. If Congress 
wants to help the FTC implement COPPA, it should consider additional 
funding for education and enforcement. These, in conjunction with 
empowerment of parents and kids to manage their own privacy and other 
online preferences, offer a better approach to addressing concerns 
about online child privacy and safety than increased regulation.
    Thank you again for inviting me to testify.

Related PFF Publications
   COPPA 2.0: The New Battle over Privacy, Age Verification, 
        Online Safety & Free Speech, Berin Szoka & Adam Thierer, 
        Progress on Point 16.11, May 2009.

   Written to Maine Legislature on Act to Protect Minors from 
        Pharmaceutical Marketing Practices, LD 1677, Berin Szoka, March 
        4, 2010.

   Parental Controls & Online Child Protection: A Survey of 
        Tools & Methods, Adam Thierer, Special Report, Version 4.0, 
        Fall 2008.

   Five Online Safety Task Forces Agree: Education, Empowerment 
        & Self-Regulation Are the Answer, Adam Thierer, Progress on 
        Point 16.13, July 8, 2009.

   The Perils of Mandatory Parental Controls and Restrictive 
        Defaults, Adam Thierer, Progress on Point 15.4, April 11, 2008.

   Written Testimony before House Committee on the Judiciary on 
        Cyber Bullying and other Online Safety Issues for Children, 
        Berin Szoka & Adam Thierer, September 30, 2009.

   Privacy Trade-Offs: How Further Regulation Could Diminish 
        Consumer Choice, Raise Prices, Quash Digital Innovation & 
        Curtail Free Speech, Comments of Berin Szoka to FTC Exploring 
        Privacy Roundtable, Nov. 2009.

   Privacy Polls v. Real-World Trade-Offs, Berin Szoka, 
        Progress Snapshot 5.10, Oct. 2009.

   Online Advertising & User Privacy: Principles to Guide the 
        Debate, Berin Szoka & Adam Thierer, Progress Snapshot 4.19, 
        Sept. 2008.

   Targeted Online Advertising: What's the Harm & Where Are We 
        Heading?, Berin Szoka & Adam Thierer, Progress on Point 16.2, 
        April 2009.

   How Financial Overhaul Could Put the FTC on Steroids & 
        Transform Internet Regulation Overnight, Berin Szoka, Progress 
        Snapshot 6.7, March 2010.
                                 ______
                                 

The Progress & Freedom Foundation--Progress on Point--Volume 16, Issue 
                              11--May 2009

COPPA 2.0: The New Battle over Privacy, Age Verification, Online Safety 
                             & Free Speech

                     by Berin Szoka & Adam Thierer

Executive Summary
    Online privacy, child safety, free speech and anonymity are on a 
collision course. The 1998 Children's Online Privacy Protection Act 
(COPPA) already mandates certain online privacy protections for 
children under 13, but many advocate expanding online privacy 
protections for both adolescents and adults. Furthermore, efforts 
continue at both the Federal and state levels to institute new 
regulations, such as age verification mandates, aimed at ensuring the 
safety of children online. There is an inherent tension between these 
objectives: Attempts to achieve perfectly ``safe'' online environments 
will likely require the surrender of some privacy and speech rights, 
including the right to speak anonymously.
    These tensions are coming to a head with state-based efforts to 
expand COPPA, which requires ``verifiable parental consent'' before 
certain sites or services may collect, or enable the sharing of, 
personal information from children under the age of 13. Several 
proposed state laws would extend COPPA's parental-consent framework to 
cover all adolescents under 18. This seemingly small change would 
require age verification of not only adolescents and their parents, 
but--for the first time--large numbers of adults, thus raising grave 
First Amendment concerns. Such broad age verification mandates would, 
ironically, reduce online privacy by requiring more information to be 
collected from both adolescents and adults for age verification 
purposes, while doing little to make adolescents safer. In practical 
terms, the increased scale of ``COPPA 2.0'' efforts would present 
significant implementation and enforcement challenges. Finally, state-
level COPPA 2.0 proposals would likely conflict with the Constitution's 
Commerce Clause.
    Despite these profound problems, COPPA expansion has great 
rhetorical appeal and seems likely to be at the heart of future child 
safety debates--especially efforts to require mandatory age 
verification. There are, however, many better ways to protect children 
online than by expanding COPPA beyond its original, limited purpose.

I. Introduction
    When the debate about social networking safety first heated up a 
few years ago, some state attorneys general (AGs) and vendors of age 
verification services implied that the technology existed--or could be 
easily developed--to verify the age of any minor who sought access to 
an interactive website.\1\ Federal law currently requires--via the 
Children's Online Privacy Protection Act (COPPA) of 1998 \2\--that 
child-oriented website operators or service providers ``Obtain 
verifiable parental consent prior to any collection, use, and/or 
disclosure of personal information from children [under 13].'' \3\ But 
advocates of age verification mandates have argued that online child 
safety would be improved if websites--particularly ``social networking 
sites'' like MySpace, Facebook and Bebo--were required to do more: 
screen users by age and to limit or ban access by those over, or under, 
a certain age.
---------------------------------------------------------------------------
    \1\ See, e.g., Emily Steel & Julia Angwin, MySpace Receives More 
Pressure to Limit Children's Access to Site, Wall Street Journal, June 
23, 2006, http://online.wsj.com/public/article/SB115102268445288250-
YRxkt0rTsyyf1QiQf2EPBYSf7iU_20070624.html.
    \2\ 15 U.S.C.  6501-6506.
    \3\ See 16 C.F.R.  312.5. See infra at 6 and note 25 for a 
discussion of COPPA's other requirements, particularly that COPPA 
applies if a website has ``actual knowledge'' that it is collecting 
information from a child even if the website is not ``directed at'' 
children.
---------------------------------------------------------------------------
    Today, however, the practical limitations and dangers of age 
verification mandates have become more widely recognized. Few continue 
to argue for directly mandating verification of the age of minors 
online--or that such verification, in its strictest sense, is even 
technically feasible. Federal courts have found that there is ``no 
evidence of age verification services or products available on the 
market to owners of websites that actually reliably establish or verify 
the age of Internet users. Nor is there evidence of such services or 
products that can effectively prevent access to Web pages by a minor.'' 
\4\ Few public data bases exist that could be referenced to conduct 
such verifications for minors, and most parents do not want the few 
records that do exist about their children (e.g., birth certificates, 
Social Security numbers, school records) to become more easily 
accessible.\5\ Indeed, concerns about those records being compromised 
or falling into the wrong hands have led to legal restrictions on their 
accessibility.\6\
---------------------------------------------------------------------------
    \4\ ACLU v. Gonzales, 478 F. Supp. 2d 775, 806 (E.D. Pa. 2007) 
[hereinafter Gonzales]; see infra at 28.
    \5\ See Adam Thierer, The Progress & Freedom Foundation, Age 
Verification Debate Continues; Schools Now at Center of Discussion, PFF 
Blog, Sept. 25, 2008, http://blog.pff.org/archives/2008/09/
age_verificatio_1.html.
    \6\ Various laws and regulations have been implemented that shield 
such records from public use, including various state statutes and the 
Family Educational Rights and Privacy Act of 1974, 20 U.S.C.  1232g, 
www.ed.gov/policy/gen/guid/fpco/ferpa/index.html.
---------------------------------------------------------------------------
    There are a host of other concerns about age verification 
mandates.\7\ Some of these concerns were summarized in a recent report 
produced by the Internet Safety Technical Task Force, a blue ribbon 
task force assembled in 2008 by state AGs to study this issue:
---------------------------------------------------------------------------
    \7\ For a fuller exploration of these issues, see Adam Thierer, The 
Progress & Freedom Foundation, Social Networking and Age Verification: 
Many Hard Questions; No Easy Solutions, Progress on Point No. 14.5, 
Mar. 2007; Adam Thierer, The Progress & Freedom Foundation, Statement 
Regarding the Internet Safety Technical Task Force's Final Report to 
the Attorneys General, Jan. 14, 2008, www.pff.org/issues-pubs/other/
090114ISTTFthiererclosingstatement.pdf; Nancy Willard, Why Age and 
Identity Verification Will Not Work--And is a Really Bad Idea, Jan. 26, 
2009, www.csriu.org/PDFs/digitalidnot.pdf; Jeff Schmidt, Online Child 
Safety: A Security Professional's Take, The Guardian, Spring 2007, 
www.jschmidt.org/AgeVerification/Gardian_JSchmidt.pdf.

        Age verification and identity authentication technologies are 
        appealing in concept but challenged in terms of effectiveness. 
        Any system that relies on remote verification of information 
        has potential for inaccuracies. For example, on the user side, 
        it is never certain that the person attempting to verify an 
        identity is using their own actual identity or someone else's. 
        Any system that relies on public records has a better 
        likelihood of accurately verifying an adult than a minor due to 
        extant records. Any system that focuses on third-party in-
        person verification would require significant political backing 
        and social acceptance. Additionally, any central repository of 
        this type of personal information would raise significant 
        privacy concerns and security issues.\8\
---------------------------------------------------------------------------
    \8\ Internet Safety Technical Task Force, Enhancing Child Safety & 
Online Technologies: Final Report of the Internet Safety Technical Task 
Force to the Multi-State Working Group on Social Networking of State 
Attorneys General of the United States, Dec. 31, 2008, at 10, http://
cyber.law.harvard.edu/pubrelease/isttf [hereinafter ISTTF Final 
Report]. Full disclosure: Adam Thierer was a member of this task force.

    With opposition to strict age verification mandates growing, some 
regulatory advocates now seek to institute such mandates through the 
back door of ``parental consent'' mandates in the model of COPPA. Such 
``COPPA 2.0'' legislation has been introduced at the state level that 
would extend the COPPA parental-consent framework to cover all minors 
between the ages of 13 and 17 inclusive (``adolescents''). Some of 
these bills would also broaden the range of sites covered, increase the 
amount of information required to be collected to achieve ``verifiable 
parental consent'' or impose other mandates such as parental access.
    Two such bills were introduced in 2007, in North Carolina (with the 
support of that state's Attorney General Roy Cooper)\9\ and 
Georgia.\10\ While these bills were never passed, a similar bill is 
currently pending in Illinois.\11\ Because the scope of such bills 
would reach all ``social networking sites'' that offered certain 
functionality (e.g., user profiles), rather only those sites directed 
at a particular age bracket (as under COPPA),\12\ they would extend age 
verification mandates far beyond sites that might be considered 
``adolescent-oriented.'' Another bill is currently pending in New 
Jersey; like COPPA, this bill would reach only sites directed at 
adolescents, but it might reach a broader range of sites, because its 
scope is not limited specifically to ``social networking'' 
functionality.\13\ The introduction of these bills makes it clear that 
future online identity verification debates will be increasingly tied 
up with efforts to expand the COPPA framework. These mandates will 
likely arrive in the form of state-level expansions of, or Federal 
amendments to, COPPA, or such proposals will at least cite COPPA's 
regulatory framework as precedent. Yet COPPA 2.0 advocates seem to 
forget that, back in 1998, Congress considered, but ultimately 
rejected, a requirement in the original version of COPPA that operators 
make ``reasonable efforts to provide the parents with notice and an 
opportunity to prevent or curtail the collection or use of personal 
information collected from children over the age of 12 and under the 
age of 17.'' \14\ This requirement would have been significantly less 
burdensome than the COPPA 2.0 approaches advanced today, but it was 
stricken from the final version of COPPA after likely constitutional 
and practical problems were identified.\15\
---------------------------------------------------------------------------
    \9\ S.B. 132, 2007 Gen. Assem., Reg. Sess.  8 (N.C. 2007), 
available at www.ncga.state.nc.us/Sessions/2007/Bills/Senate/HTML/
S132v3.html; see also Roy Cooper, Protecting Children from Sexual 
Predators: SB 132, July 24, 2007, www.ncdoj.com/
DocumentStreamerClient?directory
=WhatsNew/&file=S132%20summary%20final.pdf; see also Adam Thierer, The 
Progress & Freedom Foundation, Age Verification Showdown in North 
Carolina, PFF Blog, July 26, 2007, http://blog.pff.org/archives/2007/
07/age_verificatio.html.
    \10\ S.B. 59, Gen. Assem., 2007-2008 Leg. Sess. (Ga. 2007), 
available at www.legis.ga.gov/legis/2007_08/fulltext/sb59.htm.
    \11\ H.B. 1312, 96th Gen. Assem., Synopsis as Introduced (Il. 2007) 
[hereinafter SNWARA], available at www.ilga.gov/legislation/
billstatus.asp?DocNum=1312&GAID=10&GA=96&Doc
TypeID=HB&LegID=43038&SessionID=76.
    \12\ See infra note 22 and associated text (noting that that COPPA 
also applies in cases of ``actual knowledge,'' even if a site is not 
``directed at'' children); see also infra Section V.A. (discussing the 
meaning of ``directed at'').
    \13\ A.B. 108, Gen. Assem., 213th Leg. Sess. (N.J. 2008) 
[hereinafter AOPPA], available at www.njleg.state.nj.us/2008/Bills/
A0500/108_I1.HTM.
    \14\ Children's Online Privacy Protection Act, S. 2326, 105th Cong. 
3(a)(2)(iii) (1998).
    \15\ Testimony of Deirdre Mulligan, Staff Counsel, Center for 
Democracy and Technology, before the Senate Committee on Commerce, 
Science, and Transportation Subcommittee on Communications, Sept. 23, 
1998, available at www.cdt.org/testimony/980923mulligan.shtml 
[hereinafter Mulligan Testimony].
---------------------------------------------------------------------------
    Today's COPPA 2.0 bills are fraught with even greater legal, 
technical, and other practical problems in that they would:

   Burden the free speech rights of adults by imposing age 
        verification mandates on many sites used by adults, thus 
        restricting anonymous speech and essentially converging--in 
        terms of practical consequences--with the unconstitutional 
        Children's Online Protection Act (COPA),\16\ another 1998 law 
        sometimes confused with COPPA;
---------------------------------------------------------------------------
    \16\ 47 U.S.C.  231. While COPPA governs sites ``directed at'' 
children, COPA would have required age verification for content deemed 
``harmful to minors.'' COPA has been struck down on First Amendment 
grounds. See infra at Section VI.

   Burden the free speech rights of adolescents to speak freely 
        on--or gather information from--legal and socially beneficial 
---------------------------------------------------------------------------
        websites;

   Hamper routine and socially beneficial communication between 
        adolescents and adults;

   Reduce, rather than enhance, the privacy of adolescents, 
        parents and other adults because of the massive volume of 
        personal information that would have to be collected about 
        users for authentication purposes (likely including credit card 
        data);

   Would likely be the subject of massive fraud or evasion 
        since it is not always possible to definitively verify the 
        parent-child relationship, or because the system could be 
        ``gamed'' in other ways by determined adolescents;

   Do nothing to prevent offshore sites and services from 
        operating outside these rules;

   Present major practical challenges for law enforcement 
        officials in the face of such evasion by both domestic users 
        and offshore sites;

   Could destroy opportunities for new or smaller website 
        operators to break into the market and offer competing services 
        and innovations, thus contributing to consolidation of online 
        content and services by erecting barriers to entry; and

   Violate the Commerce Clause of the U.S. Constitution, since 
        Internet activity clearly represents interstate commerce that 
        states have no authority to regulate.

    There are better approaches to protect adolescents that do not 
implicate the serious legal and societal issues raised by COPPA 2.0 
efforts.\17\ Attempts to expand COPPA to cover adolescents are thus 
unnecessary and misguided and should be rejected at both the state and 
Federal levels.
---------------------------------------------------------------------------
    \17\ See generally Adam Thierer, The Progress & Freedom Foundation, 
Parental Controls and Online Child Protection: A Survey of Tools and 
Methods, Special Report, Version 3.1, Fall 2008, www.pff.org/
parentalcontrols/index.html (cataloguing the tools and methods 
available to parents to control their kids' Internet use).
---------------------------------------------------------------------------
    The FTC should consider carefully the limitations of COPPA and the 
pitfalls of COPPA 2.0 as the agency prepares to begin an expedited 
review of COPPA (five years ahead of schedule).\18\
---------------------------------------------------------------------------
    \18\ Howard Buskirk & Yu-Ting Wang, FTC to Expedite Review of 
Children's Online Privacy Protection Rule, Communications Daily, April 
23, 2009, at 5-7.
---------------------------------------------------------------------------
    Before examining in greater detail the problems posed by COPPA 2.0 
proposals (Sections IV-VIII), we review how COPPA 1.0 currently works 
(Section II) and what it achieves (Section III).

II. Current Implementation of COPPA
Terminology
    ``Adult''--Anyone 18 and over
    ``Minor''--Anyone under 18
    ``Child''--Anyone under 13
    ``Adolescent''--Anyone 13 or over but less than 18
    ``Kid''--Because of the specific meaning of ``child'' under COPPA, 
we have used ``kid'' instead of ``child'' when discussing interaction 
with parents and as a colloquial catch-all where appropriate.
    ``PI-collecting site''--Any site that collects what COPPA considers 
``personal information,'' which includes contact information.
    ``Social networking site''--A generic term for a PI-collecting site 
focused on user profiles and connections among users. Some legislative 
proposals use this term to refer to sites with specific functionality.
    COPPA generally requires that commercial operators of websites and 
services obtain ``verifiable parental consent'' before collecting, 
disclosing or using ``personal information'' (e.g., name, contact 
information) \19\ about children under 13 \20\ if either (i) their 
website or service (or ``portion thereof'') is ``directed at children'' 
\21\ or (ii) they have actual knowledge that they are collecting 
personal information from a child.\22\ Even if sites and services that 
collect personal information (``PI-collecting sites'' \23\) are not 
``directed at'' children, they must still have such a process in place 
to deal with cases in which a child has disclosed that they are under 
13. The FTC has defined COPPA's scope so broadly that it could apply 
even to virtual worlds and multiplayer online games (e.g., Second Life, 
World of Warcraft).\24\ COPPA also requires certain notices about 
information collection, parental access to information collected about 
children, reasonable data security procedures, and restrictions on the 
collection of personal information through games and prizes.\25\
---------------------------------------------------------------------------
    \19\ The FTC has defined ``personal information'' to include:
    (a) A first and last name; (b) A home or other physical address 
including street name and name of a city or town; (c) An e-mail address 
or other online contact information, including but not limited to an 
instant messaging user Identifier, or a screen name that reveals an 
individual's e-mail address; (d) A telephone number; (e) A Social 
Security number; (f) A persistent identifier, such as a customer number 
held in a cookie or a processor serial number, where such identifier is 
associated with individually identifiable information; or a combination 
of a last name or photograph of the individual with other information 
such that the combination permits physical or online contacting; or (g) 
Information concerning the child or the parents of that child that the 
operator collects online from the child and combines with an identifier 
described.
    16 C.F.R.  312.2.
    \20\ The word ``child'' is sometimes used interchangeably with the 
legal term ``minor'' (someone under 18) in Federal law. See, e.g., 18 
U.S.C.  2256(1) (defining ``minor'' as ``any person under the age of 
eighteen years'') and 18 U.S.C.  2256(8) (defining ``child 
pornography'' as ``any visual depiction . . . of sexually explicit 
conduct [involving a minor]''). In common speech, the term ``child'' is 
often used to mean ``a son or daughter of any age.'' Dictionary.com, 
``child,'' Merriam-Webster's Dictionary of Law, 
dictionary.reference.com/browse/child. By contrast, COPPA defines 
``child'' as a subset of ``minor.'' COPPA 2.0 bills would apply to 
older minors not currently subject to COPPA, generally referred to as 
``adolescents.''
    \21\ 16 C.F.R.  312.2 (definition of ``website or online service 
directed to children''); see infra at 22-24 (discussing the FTC's 
criteria for deciding what constitutes a site ``directed to'' 
children).
    \22\ See 16 C.F.R.  312.3; see also 16 C.F.R.  312.2 (definition 
of ``website or online service directed to children'').
    \23\ We use the term ``PI-collecting sites'' to refer to both sites 
and services only for lack of a clearer catch-all.
    \24\ As the FTC has explained:
    COPPA applies to personal information collected online by websites 
and online services located on the Internet. The Rule defines 
``Internet'' to mean the myriad of computer and telecommunications 
facilities that make up the world-wide networks that employ the 
Transmission Control Protocol/Internet Protocol (TCP/IP), or any 
predecessor or successor protocols used to communicate information of 
all kinds by wire, radio, or other methods of transmission. See 16 
C.F.R.  312.2 (definition of ``Internet''). The Rule's Statement of 
Basis and Purpose makes clear that the term Internet is intended to 
apply to broadband networks, as well as to intranets maintained by 
online services that either are accessible via the Internet, or that 
have gateways to the Internet.
    Federal Trade Commission, Frequently Asked Questions about the 
Children's Online Privacy Protection Rule [hereinafter COPPA FAQ], 
Question 6 (``What types of online transmissions does COPPA apply 
to?''), www.ftc.gov/privacy/coppafaqs.shtm.
    \25\ Operators of PI-collecting sites must:
    Provide notice on the website or online service of what information 
it collects from children, how it uses such information, and its 
disclosure practices for such information; . . . (c) Provide a 
reasonable means for a parent to review the personal information 
collected from a child and to refuse to permit its further use or 
maintenance; (d) Not condition a child's participation in a game, the 
offering of a prize, or another activity on the child disclosing more 
personal information than is reasonably necessary to participate in 
such activity; and (e) Establish and maintain reasonable procedures to 
protect the confidentiality, security, and integrity of personal 
information collected from children.
    16 C.F.R.  312.3 (internal cross-references omitted).
---------------------------------------------------------------------------
A. The Difficulties in Obtaining ``Verifiable Parental Consent''
    In drafting the regulations that implemented COPPA (the ``COPPA 
Rule'' ),\26\ the Federal Trade Commission (FTC) in 1999 adopted a 
``sliding scale'' approach to obtaining parental consent.\27\ This 
approach allows operators of PI-collecting sites to use a mix of 
methods to comply with the law, including print-and-fax forms, follow-
up phone calls and e-mails, credit card authorizations and using 
encryption certificates.\28\ The FTC has also authorized four ``safe 
harbor'' programs operated by private companies that help website 
operators comply with COPPA.\29\
---------------------------------------------------------------------------
    \26\ 16 C.F.R. Part 312. We use ``COPPA Rule'' when referring 
specifically to the FTC's implementing regulations, but use ``COPPA'' 
both to refer to the statute itself and to the scheme generally where 
appropriate.
    \27\ See Federal Trade Commission, How to Comply with The 
Children's Online Privacy Protection Rule, Nov. 1999, www.ftc.gov/bcp/
edu/pubs/business/idtheft/bus45.shtm.
    \28\ 16 C.F.R.  312.5(b)(2). See generally Children's Online 
Privacy Protection Rule, 64 Fed. Reg. 59,888 (Nov. 3, 1999), available 
at www.ftc.gov/os/1999/10/64fr59888.pdf [hereinafter 1999 COPPA Order]; 
see also COPPA FAQ supra note 24, Question 32 (``How do I get parental 
consent?'').
    \29\ The four safe harbor programs are administered by the 
Children's Advertising Review Unit of the Council of Better Business 
Bureaus (CARU); the Entertainment Software Rating Board (ESRB); TRUSTe; 
and Privo. See Federal Trade Commission, Safe Harbor Program, 
www.ftc.gov/privacy/privacyinitiatives/childrens_shp.html.
---------------------------------------------------------------------------
    In a February 2007 report to Congress about the status of the law 
and its enforcement, the FTC said that no changes to COPPA were then 
necessary because the law had ``been effective in helping to protect 
the privacy and safety of young children online.'' \30\ In discussing 
the effectiveness of the parental consent verification methods 
authorized in the FTC's sliding scale approach, however, the agency 
acknowledged that ``none of these mechanisms is foolproof.'' \31\ The 
FTC attempts to distinguish these parental consent verification methods 
from other kinds of age verification tools in noting that ``age 
verification technologies have not kept pace with other developments, 
and are not currently available as a substitute for other screening 
mechanisms.'' \32\ This makes it clear that the FTC does not regard the 
methods the agency has prescribed for obtaining parental consent under 
COPPA as equivalent to strict age verification.
---------------------------------------------------------------------------
    \30\ Federal Trade Commission, Implementing the Children's Online 
Privacy Protection Act: A Report to Congress at 1, Feb. 2007, 
www.ftc.gov/reports/coppa/07COPPA_Report_to_
Congress.pdf [hereinafter 2007 COPPA Implementation Report].
    \31\ Id. at 13.
    \32\ Id. at 12.
---------------------------------------------------------------------------
    Although credit cards may seem the most robust tool for verifying 
parental consent (essentially, age verifying the parent), Federal 
courts have found, in rejecting the constitutionality of COPA, that, 
``payment cards cannot be used to verify age because minors under 17 
have access to credit cards, debit cards, and reloadable prepaid 
cards'' and, although ``payment card issuers usually will not issue 
credit and debit cards directly to minors without their parent's 
consent because of the financial risks associated with minors . . . 
there are many other ways in which a minor may obtain and use payment 
cards.'' \33\
---------------------------------------------------------------------------
    \33\ Gonzales, 478 F. Supp. 2d at 801. COPA would have prohibited 
the online dissemination of material deemed harmful to minors under 17 
for commercial purposes, 47 U.S.C.  231(a)(1), subject to a safe 
harbor for sites that made a ``good faith'' effort to restrict access 
by minors: ``(A) by requiring use of a credit card, debit account, 
adult access code, or adult personal identification number; (B) by 
accepting a digital certificate that verifies age; or (C) by any other 
reasonable measures that are feasible under available technology,'' 47 
U.S.C.  231(c)(1).
---------------------------------------------------------------------------
B. ``Collection'': When Parental Consent is Required
    COPPA requires that operators obtain verifiable parental consent 
``before any collection, use, and/or disclosure of personal information 
from children''--as well as for ``any material change in the 
collection, use, and/or disclosure practices to which the parent has 
previously consented,'' \34\ subject to certain narrow exceptions.\35\ 
Understanding how the COPPA Rule currently works and the pitfalls of 
COPPA expansion requires examining the three-pronged definition of 
``collection'' created by the FTC, which COPPA itself left 
undefined.\36\
---------------------------------------------------------------------------
    \34\ 16 C.F.R.  312.5(a).
    \35\ 16 C.F.R.  312.5(c).
    \36\ The FTC has provided three definitions of ``collection'':
    the gathering of any personal information from a child by any 
means, including but not limited to: (a) Requesting that children 
submit personal information online; (b) Enabling children to make 
personal information publicly available through a chat room, message 
board, or other means, except where the operator deletes all 
individually identifiable information from postings by children before 
they are made public, and also deletes such information from the 
operator's records; or (c) The passive tracking or use of any 
identifying code linked to an individual, such as a cookie.
    16 C.F.R.  312.2. See also infra at Section II.B.
---------------------------------------------------------------------------
1. Requests from Sites
    Most obviously, the COPPA Rule considers ``collection'' to occur 
each time a PI-collecting site requests ``that children submit personal 
information online.'' \37\ This requirement generally minimizes the 
amount of data collected from children and ensures that parents control 
the collection of information from their children.
---------------------------------------------------------------------------
    \37\ 16 C.F.R.  312.2 (definition of ``collection'').
---------------------------------------------------------------------------
2. Enabling Sharing of Personal Information
    Less intuitively, the COPPA Rule considers ``collection'' to occur 
when a PI-collecting site merely ``enabl[es] children to make personal 
information publicly available . . . except where the operator deletes 
all individually identifiable information from postings by children 
before they are made public, and also deletes such information from the 
operator's records.'' \38\
---------------------------------------------------------------------------
    \38\ Id.
---------------------------------------------------------------------------
    Unlike the first prong of ``collection,'' consent is not required 
each time a communications tool is used to ``make personal information 
publicly available,'' but merely for the child to gain access to the 
tool (e.g., upon creation of a user account). Thus, the FTC intends to 
make parents gatekeepers over which sites their children join or 
participate in, rather than to give parents a veto right over every 
instance in which a child wants to share personal information (e.g., by 
posting it to their profile or ``wall'' on a social networking site). 
Given the degree of interactivity on social networking sites, it is 
difficult to imagine how so granular a veto requirement could be 
feasibly implemented if COPPA were expanded.
    What it means to make information ``publicly available'' is 
unclear. COPPA clearly requires consent before granting a child access 
to a site that would allow the child to ``broadcast'' personal 
information, such as by posting their name, photo, contact information, 
etc. such that the ``public'' can access that information, whether that 
means posting information to a social networking profile, on a website, 
or in a ``public'' chat room or message board (the latter two being the 
specific examples cited in COPPA and the COPPA Rule).\39\ But does 
COPPA apply to communications that are not intended to be public? Would 
COPPA apply to a site that only allowed users to send ``private'' 
messages to each other? In short, how public is ``public'' enough that 
giving a child access to the underlying functionality would constitute 
collection? The FTC has never clearly answered these questions, but it 
has implied that it takes the ``maximalist'' view of what counts as 
collection: Allowing children to share personal information with 
anyone, even in one-to-one communications, constitutes ``collection'' 
subject to COPPA's parental consent requirement.\40\ By contrast, the 
``minimalist'' view would define ``collection'' in terms of the 
capability to ``publish'' or ``broadcast'' personal information such 
that it becomes ``available'' to anyone with access to the PI-
collecting site. Which view a court would accept, if presented with a 
challenge to COPPA, is beyond the scope of this paper, but the 
ambiguity is worth noting.\41\
---------------------------------------------------------------------------
    \39\ 15 U.S.C.  6501(4)(B)(iv-v) (definition of ``disclosure''); 
16 C.F.R.  312.2 (definition of ``collection'').
    \40\ In December 2007, the FTC added a question it its FAQ 
reflecting the agency's view that COPPA would require parental consent 
before allowing a child to send electronic greeting cards or forward 
items of interest to their friends. COPPA FAQ supra note 24, Question 
44 (``My child-directed website wants to offer electronic post cards 
and the ability for children to forward items of interest on my site to 
their friends. Can I take advantage of one of the e-mail exceptions to 
parental consent?''). The FTC requires parental consent if users can 
``freely type messages in either the subject line of the e-card or in 
any text fields''--presumably, because this might lead to the sharing 
of personal information with the card's recipient. See Jim Dunstan, E-
cards and ``Forward-to-a-Friend'' Promotions: Not Kid Friendly Anymore, 
www.gsblaw.com/practice/
notableevents.asp?StoryID=1137185152008&groupID=21; see also Jim 
Dunstan, FTC Issues Final Rules in CAN-SPAM Proceeding: Forward-To-A-
Friend Promotion Mystery Solved, www.gsblaw.com/practice/
notableevents.asp?StoryID=17866132008&groupID=21.
    \41\ The maximalist approach essentially reads the term ``publicly 
available'' out of the statute by construing collection to mean 
``available to anyone.'' Such a construction might, for example, 
violate the cannon of statutory interpretation against surplusage: 
``[T]he presence of statutory language `cannot be regarded as mere 
surplusage; it means something.' '' Chickasaw Nation v. United States, 
534 U.S. 84, 97 (2001) (quoting Potter v. United States, 155 U.S. 438, 
446 (1894)).
---------------------------------------------------------------------------
    However broad the definition of ``publicly available,'' the FTC's 
definition of ``collection'' to include the enabling of communication 
by children that might result in the any of personal information was 
itself controversial when the FTC first wrote the COPPA rules. The FTC 
(again) took a maximalist view of ``collection,'' \42\ overriding the 
objections of free speech advocates who argued that Congress intended 
``to place duties on those who collect information from children'' (in 
the normal sense of ``collection'' contained in the first prong of the 
definition) rather than ``to regulate children's behavior'' or ``limit 
children's ability to speak.'' \43\ These advocates proposed a 
minimalist definition of ``collection'' as ``gathering, by an operator, 
of personal information,'' such that merely providing functionality 
like chat rooms and message boards would not constitute collection 
unless the operator actually gleaned personal information from such 
fora.\44\
---------------------------------------------------------------------------
    \42\ 1999 COPPA Order, supra note 28, at 59,889-890.
    \43\ Supplemental Comments of The Center for Democracy and 
Technology, The American Civil Liberties Union, and The American 
Library Association, filed in Rulemaking to Implement the Children's 
Online Privacy Protection Act of 1998, Aug. 25, 1999, at  I.B 
www.ftc.gov/privacy/comments/supplementalcdtacluala.htm.
    \44\ Id. (emphasis original, indicating proposed addition to the 
FTC's rule as originally proposed).
---------------------------------------------------------------------------
3. Online Tracking & Cookies
    Finally, COPPA would consider collection to occur through the use 
of persistent identifiers such as cookies \45\ if associated with 
individually identifiable information or ``a combination of a last name 
or photograph of the individual with other information such that the 
combination permits physical or online contacting.'' \46\
---------------------------------------------------------------------------
    \45\ 16 C.F.R.  312.2 (definition of ``collects or collection'').
    \46\ 16 C.F.R.  312.2 (definition of ``personal information'').
---------------------------------------------------------------------------
C. COPPA's Place in an Evolving Landscape
    In the decade since Congress enacted COPPA, the kinds of 
information-sharing functionality governed by the ``publicly 
available'' prong of collection have exploded in popularity. New 
interactive communications tools and methods, now generally referred to 
as ``social networking'' capabilities, are a key hallmark of the ``Web 
2.0'' era.\47\ Of course, they had their precursors even in 1998, but 
the examples of such tools included in COPPA and the initial COPPA rule 
reveal just how much the web has evolved: ``Chat rooms'' and ``message 
boards'' certainly still exist but they have largely morphed into 
today's social networking sites (e.g., Facebook, Myspace), which would 
have been unrecognizable in 1998, while services like blogging and 
micro-blogging (e.g., Twitter) would have been inconceivable. Today, 
more users feel comfortable making personal information more ``publicly 
available'' than ever before, broadcasting their every thought and 
action, and even their exact physical location,\48\ for all the world 
to see.
---------------------------------------------------------------------------
    \47\ Tim O'Reilly, What Is Web 2.0?: Design Patterns and Business 
Models for the Next Generation of Software, Sept. 30, 2005, 
www.oreillynet.com/lpt/a/6228.
    \48\ See, e.g., Google Latitude, www.google.com/latitude/
intro.html; loopt, www.loopt.com; Pelago, http://pelago.com.
---------------------------------------------------------------------------
    The growing ubiquity of ``Web 2.0'' tools has two implications. 
First, the sites currently covered by COPPA are growing ever more 
limited in their functionality relative to the rest of the Internet, as 
discussed be low.\49\ For example, child-oriented sites must obtain 
verifiable parental consent before allowing children to send e-cards or 
use ``Forward-to-a-Friend'' functionality if the sites ``permit the 
sender to enter her full name, her e-mail address, or the recipient's 
full name'' or ``provide users with the ability to freely type messages 
in either the subject line of the e-card or in any text fields.'' \50\ 
Second, even under the minimalist view of ``publicly available,'' 
expanding COPPA's age scope would affect far more websites today than 
it would have 11 years ago, because the functionality that constitutes 
``collection'' (under the second prong of that term's definition) is 
now pervasive.
---------------------------------------------------------------------------
    \49\ See infra at Section III.A.
    \50\ Absent such sharing, the FTC allows child-oriented sites to 
use COPPA's exception for one-time communications, found at 16 C.F.R.  
312.5(c). See supra note 40.
---------------------------------------------------------------------------
III. Does COPPA Really Work?
    Before addressing the many challenges associated with COPPA 2.0 
proposals, one must ask the critical--but ignored--threshold question: 
Is ``COPPA 1.0'' really working? To answer this question, one must 
first decide what COPPA 1.0 is supposed to accomplish. The original 
goals of COPPA, as expressed by its Congressional sponsors, were to:

        (1) to enhance parental involvement in a child's online 
        activities in order to protect the privacy of children in the 
        online environment; (2) to enhance parental involvement to help 
        protect the safety of children in online fora such as 
        chatrooms, home pages, and pen-pal services in which children 
        may make public postings of identifying information; (3) to 
        maintain the security of personally identifiable information of 
        children collected online; and (4) to protect children's 
        privacy by limiting the collection of personal information from 
        children without parental consent.\51\
---------------------------------------------------------------------------
    \51\ 144 Cong. Rec. S11657 (daily ed. Oct. 7, 1998) (statement of 
Rep. Bryan).

    Thus, as its name implies, COPPA is first and foremost about 
protecting the privacy of children. COPPA's primary means for achieving 
this goal is enhancing parental involvement or, as the FTC has put it, 
``provid[ing] parents with a set of effective tools . . . for becoming 
involved in and overseeing their children's interactions online.'' \52\ 
However admirable, ``protect[ing] the safety of children'' is merely an 
indirect goal of COPPA--something to be achieved through the means of 
enhancing parental involvement (COPPA's direct goal). The FTC has 
attempted to blur this distinction, elevating child protection to a 
direct goal of COPPA.\53\ Indeed, this was the primary reason the FTC 
adopted the maximalist definition of ``collection'' to include enabling 
communication (rather than direct gathering of personal information by 
operators), over-ruling free speech concerns.\54\
---------------------------------------------------------------------------
    \52\ 2007 COPPA Implementation Report, supra note 30, at 28.
    \53\ The FTC has carefully--or perhaps simply carelessly--edited 
Congress's original statement of purpose: Where Congress had originally 
declared that COPPA was intended ``to enhance parental involvement to 
help protect the safety of children [online],'' 144 Cong. Rec. S11657 
(emphasis added), the FTC has declared that COPPA was intended ``to 
protect the safety of children [online].'' 2007 COPPA Implementation 
Report, supra note 30, at 3.
    \54\ The FTC based its adoption of the maximalist view of 
``collection'' by noting that:
    children's use of chat rooms and bulletin boards that are 
accessible to all online users present the most serious safety risks, 
because it enables them to communicate freely with strangers. Indeed, 
an investigation conducted by the FBI and the Justice Department 
revealed that these services are quickly becoming the most common 
resources used by predators for identifying and contacting children.
    1999 COPPA Order, supra note 28, at 59,890 (internal citations 
omitted). See also supra at 11 and note 43.
---------------------------------------------------------------------------
    The FTC claims COPPA ``has provided a workable system to help 
protect the online safety and privacy of the Internet's youngest 
visitors.'' \55\ Indeed, many of those advocating expansion of COPPA do 
so on the grounds that COPPA makes children safer online from sexual 
predators. What these advocates fail to acknowledge is that, to the 
extent COPPA has enhanced child safety--indeed, to the extent that 
COPPA can be effectively administered at all--it is because of the 
unique circumstances of the under-13 age bracket and the PI-collecting 
sites that have evolved to serve that community. In particular:
---------------------------------------------------------------------------
    \55\ 2007 COPPA Implementation Report, supra note 30, at 28.

        1. The functionality of child-oriented sites is usually tightly 
---------------------------------------------------------------------------
        limited: They are closed, walled gardens;

        2. Many smaller websites catering to children charge a fee for 
        admission--even as fee-based models have withered away on the 
        rest of the Internet; and

        3. There are relatively few sites that cater exclusively to the 
        under-13 crowd, which may be an unintended consequence of COPPA 
        itself.

    Each of these factors is discussed below, as relates to COPPA's 
perceived goals.

A. Child-Oriented Sites Limit Functionality
    Child-oriented sites typically have very limited functionality: In 
essence, their operators intentionally ``cripple'' the sort of 
functionality found in most PI-collecting sites (especially social 
networking sites) geared toward older users. That fact alone makes 
COPPA-covered sites far less likely to be subject to fraudulent entry 
or dangerous interactions: Why would an adolescent or an adult predator 
ever want to gain access to a site that offers little more than drop-
down menus and a few buttons to click on when interacting with others?
    The primary reason that children are likely safer in those 
environments probably has less to do with COPPA's parental consent 
requirements and much more to do with the fact that most of the PI-
collecting sites covered by COPPA are tightly controlled and highly 
moderated walled gardens with very limited functionality--a sort of 
``Junior Internet.''

B. Child-Oriented Sites Charge Fees
    While most Internet content and services are now ``free'' (i.e., 
advertising-supported ),\56\ many child-oriented PI-collecting sites 
charge admission fees. There are several reasons they do so:
---------------------------------------------------------------------------
    \56\ See, e.g., Chris Anderson, Free! Why $0.00 Is the Future of 
Business, Wired, Feb. 25, 2008, www.wired.com/techbiz/it/magazine/16-
03/ff_free. The most notable exception to this rule is Massively 
Multiplayer Online games such as World of Warcraft, which are also 
potentially subject to COPPA.

   ``[R]equiring a parent to use a credit card in connection 
        with a transaction'' is among the methods for obtaining 
        verifiable parental consent in the FTC's sliding scale.\57\ The 
        FTC requires that an operator charge some fee so that the 
        credit card will be verified by its issuer and ``because, 
        through receipt of a monthly statement, the parent is given 
        additional notice that the transaction occurred and has an 
        opportunity to investigate any suspicious activity and revoke 
        consent.'' \58\
---------------------------------------------------------------------------
    \57\ 16 C.F.R.  312.5(b)(2).
    \58\ See COPPA FAQ, supra note 24, Question 33 (``I would like to 
get consent by collecting a credit card number from the parent, but I 
don't want to engage in a transaction. Is this ok?'').

   Commercial child-oriented sites must somehow recoup the 
        costs of obtaining verifiable parental consent--estimated in 
        2005 at more than $45 per child.\59\ Because COPPA limits 
        operators' ability to effectively target advertising to 
        children, thereby reducing the value of advertising inventory 
        on PI-collecting sites, they usually must rely on direct fees.
---------------------------------------------------------------------------
    \59\ See Comments of Parry Aftab, Request for Public Comment on the 
Implementation of COPPA and COPPA Rule's Sliding Scale Mechanism for 
Obtaining Verifiable Parental Consent Before Collecting Personal 
Information from Children at 2, June 27, 2005, www.ftc.gov/os/comments/
COPPArulereview/516296-00021.pdf [hereinafter Aftab Comments].

   Many child-oriented sites rely heavily on constant human 
        moderation and oversight, which necessitates a method of 
---------------------------------------------------------------------------
        funding those workers.

   It is easier for child-oriented sites to continue charging 
        small fees once they have a credit card on file (something most 
        sites never accomplish) and because there is relatively less 
        competition in the child-oriented marketplace than in the 
        Internet generally.

    Importantly, the more a site charges for access, the more likely it 
is that the parent or guardian pays attention to what their child is 
doing on that site. The hassle for parents of having to pay a fee gets 
parents thinking, and talking to their kids, about those sites, argues 
Denise Tayloe of Privo, one of the four FTC-approved providers of COPPA 
safe harbor age verification services.\60\
---------------------------------------------------------------------------
    \60\ Denise Tayloe, It's Time to Comply with COPPA, The Privacy 
Advisor, Vol. 6, No. 10, Oct. 2006, at 5.
---------------------------------------------------------------------------
    However, Tayloe has noted that one of the problems associated with 
the current COPPA regime is that ``Children quickly learned to lie 
about their age in order to gain access to the interactive features on 
their favorite sites. As a result,'' she notes, ``data bases have 
become tainted with inaccurate information and chaos seems to be king 
where COPPA is concerned.'' \61\ The FTC, well aware that blocking 
access to children under 13 could simply encourage them to lie about 
their age, requires operators to ``design [their] age collection input 
screens in a manner that does not encourage children to provide a false 
age in order to gain access to [their] site.'' \62\ In particular, the 
FTC recommends ``using a temporary or a permanent cookie to prevent 
children from back-buttoning to enter a different age.'' \63\ But if 
children can learn to lie about their age, they can probably learn to 
delete cookies, too--since cookie deletion is a privacy feature now 
common in every browser.\64\
---------------------------------------------------------------------------
    \61\ Id.
    \62\ See COPPA FAQ, supra note 58, Question 39 (``Can I block 
children under 13 from my general audience website?'').
    \63\ Id.
    \64\ Adam Thierer, Berin Szoka & Adam Marcus, The Progress & 
Freedom Foundation, Privacy Solutions, PFF Blog, Ongoing Series, http:/
/blog.pff.org/archives/ongoing_series/privacy_
solutions.
---------------------------------------------------------------------------
    Despite these problems, Tayloe falls back on the original 
justification of COPPA: increasing parental involvement. Even though 
``there is no perfect solution'' and it is not possible to completely 
``stop a child from lying and putting themselves at risk,'' Tayloe 
believes that COPPA ``provides a platform to educate parents and kids 
about privacy.'' \65\ Providing a platform to educate parents and kids 
about online privacy or safety is certainly important, but there are 
other ways to do this besides imposing strict age verification 
mandates. Educational initiatives and public service announcements, for 
example, could also encourage greater parent-child interaction. Indeed, 
the courts have concluded that the First Amendment requires the 
government to utilize such educational initiatives as ``less 
restrictive'' alternatives to age verification technologies in other 
contexts.\66\
---------------------------------------------------------------------------
    \65\ E-mail from Denise Tayloe to Adam Thierer (Mar. 15, 2007) 
(copy on file with author).
    \66\ See infra at VI.A.3.
---------------------------------------------------------------------------
    While we don't really have any idea what level of parent-child 
interaction COPPA incentivizes, or how many children (or adults) are 
able to gain access to PI-collecting sites under false pretenses, the 
key operational assumption on which COPPA rests is that by creating an 
added economic hurdle or barrier to entry (in the form of entry fees or 
the hassle of filling out paperwork or forms), COPPA gets some--maybe 
even most--parents to put more thought into what their kids are doing 
online, and that in turn somehow improves online child safety.
    However useful COPPA might be in enhancing parental involvement, it 
does not necessarily mean that children are operating in perfectly 
``secure'' or ``verified'' environments. COPPA wasn't primarily put on 
the books to prevent ``bad guys'' from interacting with children 
online; it was about minimizing the collection of children's personal 
information and giving parents control over collection of information 
from their children.\67\ Thus, COPPA does not require excluding older 
users from child-oriented sites, some websites indeed may try to do so, 
building on COPPA's required age verification system, because of market 
demand from parents to exclude sexual predators. Of course, age 
verification is hardly fool-proof for either kids or adults. So, to the 
extent some ``bad guys'' are getting on those sites under false 
pretenses, both children and parents may be lulled into to a false 
sense of security after they are told the site is COPPA-verified--
whether or not the site actually attempts to exclude older users and 
regardless of how effective the site may be in doing so. This may 
actually increase the danger of predation to children.\68\
---------------------------------------------------------------------------
    \67\ See supra at 16.
    \68\ Internet security expert John Cardillo argues that even COPPA-
compliant sites are vulnerable:
    During an analysis of the security processes of certain sites we 
tested Imbee's. Our security team was able to create several fake 
children. More troubling was the inconsistency of the information used 
to do so. We used a fake name for the parent, a different fake name 
created for the Yahoo! e-mail account used at registration, and my 
credit card info (because the name on the CC is irrelevant). Fictional 
child, and three fake identifiers on supposedly the same adult. Not one 
red flag was raised, and we were allowed onto the site without a 
problem. Our team was able to do this multiple times. Had we been a 
real bad guy, we could have, at any time, chatted with other kids on 
the site as a child. One of several different children actually. Not 
only isn't it a security solution, it's downright dangerous.
    E-mail from John J. Cardillo to Adam Thierer (March 11, 2007) (copy 
on file with author). Cardillo's findings thus make it clear how real 
predators intent on doing harm to children could exploit age 
verification processes designed to exclude adults from a supposedly 
``teens-only'' site (just as predators already do with sites supposedly 
limited to kids under 13). Indeed, because many predators have children 
of their own, they might use this approach to obtain an ID for their 
own kids and then go online under their child's name to prey on other 
children. The fiction that all users of a site are ``verified'' creates 
a false sense of security--a serious problem for child safety. As 
Cardillo has noted elsewhere, predators who create a ``pedophile 
passport'' could operate freely in supposedly ``safe and secure'' 
environments. See Adam Thierer, The Progress & Freedom Foundation, Age 
Verification for Social Networking Sites: Is It Possible? Is It 
Desirable?, Progress on Point 14.8, May 2007, at 6, www.pff.org/issues-
pubs/pops/pop14.8ag
everificationtranscript.pdf.
---------------------------------------------------------------------------
C. Does COPPA Encourage Consolidation or Limit Competition?
    As noted above, there are significant costs associated with the 
verifiable parental consent methods that PI-collecting sites must 
implement to comply with COPPA. If we are to fully understand the 
experience of COPPA as a regulatory model, we must consider the extent 
to which COPPA may have had the unintended consequence of limiting 
choice and competition by driving increased consolidation in the 
marketplace for child-oriented sites and services online--a question 
the FTC should consider answering. As early as 2001, even some 
Congressmen recognized this ``unintended consequence'' of COPPA in 
Congressional hearings on privacy.\69\
---------------------------------------------------------------------------
    \69\ Rep. Billy Tauzin (R-LA) noted that COPPA ``has now forced 
companies to discontinue a number of products targeted toward 
children'' and asked ``If we end up forcing private companies and 
nonprofits to eliminate beneficial products such as crime prevention 
material, have we done a good thing? If teen-friendly sites, those that 
totally respect the privacy of the users stop offering e-mail services 
to children, is that a good thing? An Examination of Existing Federal 
Statutes Addressing Information Privacy: Hearing of the House Committee 
On Energy and Commerce, 107th Cong. 6 (April 3, 2001) (statement of 
Rep. Tauzin.), available at http://
republicans.energycommerce.house.gov/107/action/107-22.pdf.
---------------------------------------------------------------------------
    Of course, it could be the case that there are other reasons that 
there are relatively few sites catering exclusively to children. 
Nonetheless, as discussed below, it's worth considering how expanding 
COPPA might lead to more consolidation in the marketplace or how it 
discourages greater entry by smaller ``mom-and-pop'' sites that could 
cater to children. As noted by Parry Aftab, Executive Director of the 
children's advocacy group Wired Safety, ``COPPA wasn't responsible for 
the demise of these sites, but when combined with the other factors 
[it] tipped the balance.'' \70\ She concludes, appropriately:
---------------------------------------------------------------------------
    \70\ Aftab Comments, supra note 59, at 3.

        It is crucial that at this tentative stage for the kids 
        Internet industry we don't do anything to make its survival 
        more difficult. We should be looking at easy to encourage safer 
        communities for preteens and innovations to help create fun, 
        entertaining and educational content for kids online.\71\
---------------------------------------------------------------------------
    \71\ Id.
---------------------------------------------------------------------------
IV. What if COPPA Were Expanded to Cover Adolescents?
    However effective COPPA might be in fulfilling its purposes, and 
whatever its unintended consequences, the COPPA Rule's requirements are 
relatively easy for the private sector to implement and for the 
government to enforce because, as mentioned, they apply only to the 
collection of information about children under 13 by commercial 
operators only when (i) the operator's PI-collecting Site or service is 
``directed to children'' or (ii) the operator has actual knowledge that 
they are collecting personal information from a child. But how well 
would the COPPA approach ``scale up'' to the 13-17 age bracket?
    The key practical difficulty in implementing a COPPA 2.0 system for 
adolescents is in the anonymity inherent in the technical architecture 
of the Internet. To quote a memorable cartoon from The New Yorker of 
all time: ``On the Internet, nobody knows you're a dog.'' \72\ Because 
website operators generally do not know who is accessing their site, 
requiring any special treatment of minors (e.g., parental consent prior 
to the collection of personal information, access to the child's user 
profile) is tantamount to requiring age-verification of all users.\73\
---------------------------------------------------------------------------
    \72\ Peter Steiner, On the Internet, Nobody Knows You're a Dog, The 
New Yorker, July 5, 1993 at 61, available at www.unc.edu/depts/jomc/
academics/dri/idog.html (cartoon of a dog, sitting at a computer 
terminal, talking to another dog).
    \73\ Of course, the COPPA's second prong of age-verification 
requirement applies only when the website operator has ``actual 
knowledge'' that the user is a minor. See supra at 7 & note 22.
---------------------------------------------------------------------------
    Because ``child-oriented'' websites are generally easy to define 
and are very rarely used by adults, COPPA 1.0s age verification mandate 
has not significantly impacted the free speech rights of adults. But it 
is far more difficult to define a class of ``adolescent-oriented'' 
websites (as proposed in New Jersey) that are not also used by 
significant numbers of adults. Indeed, the Illinois bill does not even 
attempt to do so, defining its scope not in COPPA's ``directed at'' 
terms but purely in terms of site functionality.\74\ In this sense, the 
Illinois bill is more restrictive than the New Jersey bill, since it 
would apply to sites with a certain functionality regardless of to whom 
they are ``directed at.'' On the other hand, the New Jersey proposal is 
far more sweeping, since it applies to any site that collects user 
information if the site is ``directed at'' adolescents.\75\ Whichever 
bill might ultimately affect more websites, the practical result of 
both COPPA 2.0 proposals is the same: They would, without explicitly 
saying so, require age verification of a large numbers of adults. This 
raises profound First Amendment concerns--particularly about the right 
of Americans to speak and receive information anonymously online.\76\
---------------------------------------------------------------------------
    \74\ The Illinois Bill defines a ``social networking site'' as:
    an Internet website containing profile web pages of the members of 
the website that include the names or nicknames of such members, 
photographs placed on the profile web pages by such member, or any 
other personal or personally identifying information about such members 
and links to other profile web pages on social networking websites of 
friends or associates of such members that can be accessed by other 
members or visitors to the website. A social networking website 
provides members of or visitors to such website the ability to leave 
messages or comments on the profile web page that are visible to all or 
some visitors to the profile web page and may also include a form of 
electronic mail for members of the social networking website.
    SNWARA, supra note 11, 5. This definition seems almost tailor-made 
for MySpace and Facebook: The second sentence of the definition would 
exclude sites like LinkedIn, which includes profiles but does not allow 
users to post public comments on other users' profiles. While this 
focus on specific site functionality seems to differ from COPPA's 
approach, in fact it does little more than apply COPPA's second 
definition of ``collection'' as ``Enabling children to make personal 
information publicly available.'' See 16 C.F.R.  312.2 (definition of 
``collection''); see also supra at 8.
    \75\ See supra note 13.
    \76\ Adam Thierer, The Progress & Freedom Foundation, USA Today, 
Age Verification, and the Death of Online Anonymity, PFF Blog, Jan. 23, 
2008, http://blog.pff.org/archives/2008/01/usa_today_doesn.html.
---------------------------------------------------------------------------
V. The Differences Between Children (0-12) & Adolescents (13-17)
    Before examining these First Amendment concerns (which are more 
directly apparent in the case of the Illinois proposal), one must ask 
how they arise in the case of the more complicated New Jersey proposal, 
which applies to PI-collecting sites ``directed at'' adolescents.\77\ 
This examination reveals the fundamental flaw in any attempt to extend 
COPPA to cover adolescents: COPPA 1.0 works only because of the unique 
characteristics of the under-13 age bracket.
---------------------------------------------------------------------------
    \77\ Like COPPA, New Jersey's AOPPA bill also applies to cases of 
actual knowledge that an operator is collecting personal information 
from an adolescent. See supra note 13.
---------------------------------------------------------------------------
A. Subjective Assessments about Intended Audiences Are Significantly 
        Easier for Children than for Adolescents
    In determining whether a PI-collecting Site or service is 
``directed at children,'' the FTC considers the site or service's 
``subject matter, visual or audio content, age of models, language or 
other characteristics of the website or online service, as well as 
whether advertising promoting or appearing on the website or online 
service is directed to children . . . and whether a site uses animated 
characters.'' \78\ The following excerpts from FTC complaints 
illustrate how the agency has applied these criteria:
---------------------------------------------------------------------------
    \78\ 16 C.F.R.  312.2 (definition of ``website or online service 
directed to children'').

        The . . . subject matter [of www.lilromeo.com] is Lil' Romeo, a 
        twelve-year-old recording artist who ``enjoys `just being a 
        regular kid.' '' The website features content directed to 
        children such as an animated game in which the player helps 
        Lil' Romeo save an elementary school from aliens by answering 
        simple math and history questions. The website also features 
        music and lyrics from Lil' Romeo's album ``Game Time,'' which 
        is ``about having fun, and also about, you know, kids['] things 
        . . .'' \79\
---------------------------------------------------------------------------
    \79\ U.S. v. UMG Recordings, Inc., Civil Action No. CV-04-1050, 
Complaint at 4-5 (C.D. Ca. 2004), www.ftc.gov/os/caselist/
umgrecordings/040217compumgrecording.pdf.

---------------------------------------------------------------------------
    And:

        Defendant operates the www.etch-a-sketch.com website, which 
        provides information about its toys, including the ``Etch A 
        Sketch'' drawing toy. The subject matter, visual content, and 
        language of this website are directed to children under the age 
        of 13. For example, the site features a cartoon character named 
        ``Etchy''--an Etch A Sketch sporting sunglasses, purple hair 
        and legs. Etchy invites visitors to play ``cool games,'' such 
        as drawing with an online Etch A Sketch, finding hidden 
        numbers, letters and shapes, and coloring pictures of Etchy and 
        friends. The site also contains an ``interactive story'' 
        titled, ``Etchy Goes to a Birthday Party.'' \80\
---------------------------------------------------------------------------
    \80\ U.S. v. The Ohio Art Company, Complaint,  12 (N.D. Oh. 2002), 
www.ftc.gov/os/2002/04/ohioartcomplaint.htm.

    The FTC settled both cases with consent decrees--like, apparently, 
all the FTC's COPPA enforcement actions.\81\ These examples demonstrate 
that subjective standards can sometimes work reasonably well in certain 
contexts. As Justice Potter Stewart famously said of obscenity, ``I 
know it when I see it.'' \82\ The same could probably be said, in many 
cases, about what constitutes child-oriented content; and this approach 
seems to have worked well enough for the FTC's COPPA enforcement 
efforts. But how well, if at all, would such a standard work in 
determining the scope of COPPA 2.0 proposals (like New Jersey's) that 
retain COPPA's requirement that a site be ``directed at'' a certain 
audience when that audience is not children (0-12) but adolescents (13-
17)? \83\
---------------------------------------------------------------------------
    \81\ See Federal Trade Commission, Children's Privacy Enforcement 
Cases, www.ftc.gov/privacy/privacyinitiatives/childrens_enf.html 
(including a consent decree for each case).
    \82\ Jacobellis v. Ohio, 378 U.S. 184, 197 (1964) (Stewart, J., 
concurring).
    \83\ While New Jersey's proposal retains this approach, hewing 
closely to COPPA's current structure, see supra note 13 and 
accompanying text , Illinois's proposal drops the concept and simply 
applies to all sites with certain social networking functionality, see 
supra note 11.
---------------------------------------------------------------------------
    Any regulatory system that, like COPPA, rests on age stratification 
inevitably requires the drawing of arbitrary boundaries. But 
ultimately, some age must be chosen. Whatever the differences between 
12 and 13, the differences between 12 (COPPA's ceiling) and 17 (the 
ceiling established in some COPPA 2.0 measures) are significant. 
Although the original version of the COPPA legislation would have 
required ``reasonable efforts to provide the parents with notice and an 
opportunity to prevent or curtail the collection or use of personal 
information'' for kids 13-16, the legislation never required verifiable 
parental consent for minors above 12.\84\ The FTC explains Congress's 
rationale for this distinction as follows:
---------------------------------------------------------------------------
    \84\ See supra note 14 and associated text.

        Congress and industry self-regulatory bodies have traditionally 
        distinguished children aged 12 and under, who are particularly 
        vulnerable to overreaching by marketers, from children over the 
        age of 12, for whom strong, but more flexible protections may 
        be appropriate. In addition, distinguishing adolescents from 
        younger children may be warranted where younger children may 
        not understand the safety and privacy issues created by the 
        online collection of personal information.\85\
---------------------------------------------------------------------------
    \85\ COPPA FAQ, supra note 58, Question 8 (``Why does COPPA apply 
only to children under 13? What about protecting the online privacy of 
teens?''), www.ftc.gov/privacy/coppafaqs.shtm. The FTC also reminds 
companies:

    websites' information practices regarding teens and adults are 
subject to Section 5 of the FTC Act, which prohibits unfair or 
deceptive acts and practices. See Staff Opinion Letter to Center for 
Media Education (July 15, 1997) for guidance on how Section 5 applies 
to information practices involving teens. In addition, recent concern 
about the risks of child participation on social networking websites 
led the FTC to issue a set of safety tips for social networking. See 
``Social Networking Sites: A Parents' Guide'' (September 2007), 
available at www.ftc.gov/opa/2006/05/socialnetworking.shtm; see also 
www.onguardonline.gov/docs/onguardonline_socialnetworking.
pdf.

    Thus, it appears that Congress was simply following a long-standing 
distinction based on the cognitive capabilities of children under 13. 
But whether anyone realized it at the time, this distinction has proved 
essential for the administration of COPPA as a statute that defines its 
scope by the audience to which sites are ``directed.'' Whenever the 
``tipping point'' in cognitive capabilities occurs, the age of 13 
roughly corresponds to an important point of departure in psychological 
growth between ``childhood'' and ``adolescence.''
    This moment was best described two thousand years ago by the 
Apostle Paul of Tarsus, when he wrote, ``When I was a child, I spake as 
a child, I understood as a child, I thought as a child: but when I 
became a man, I put away childish things.'' \86\ Paul equated what we 
think of as ``adolescence''--a profoundly modern invention \87\--with 
adulthood. Paul had no more conception of ``adolescence'' than did 
Shakespeare, who--like Congress with COPPA--chose thirteen as the age 
of Juliet, his greatest star-crossed lover.\88\ But Paul offered 
perhaps the best reason why COPPA's scope ends at thirteen: this is the 
roughly point at which minors begin to shun ``childish things''--say, 
losing interest in Club Penguin in favor of more ``grown-up'' sites 
like MySpace or Facebook. If one has to choose a clear bright line rule 
as to when, on average, that shift occurs, 13 seems to be about as 
accurate as any. (Indeed, modern Jews--like the Jewish Paul before 
them--continue to recognize this as the threshold of maturity by 
generally holding a Bar Mitzvah for boys at age 13, and a Bat Mitzvah 
ceremony for girls at age 12.\89\) This is less a question of how much 
protection minors of any particular age require, and more a question of 
when their interests change: At about this age, adolescents begin to 
share interests with adults in ways that children 12 and below do not; 
if left to their own devices, adolescents would spend far more time on 
``general audience'' \90\ websites than would children. Thirteen is 
probably about the point at which this transformation begins to 
accelerate. But regardless of precisely when it happens, it should be 
apparent that the sites favored by adolescents 13 and over will be 
difficult to distinguish as ``adolescent-oriented'' because they are 
rarely, if ever, as thoroughly dominated by adolescents as ``child-
oriented'' sites are by children 12 and under. This problem gives rise 
to the significant constitutional concerns raised by COPPA 2.0 
proposals.
---------------------------------------------------------------------------
    \86\ The First Epistle of Paul the Apostle to the Corinthians 13:11 
(King James), available at www.bartleby.com/108/46/13.html (emphasis 
added).
    \87\ Sociologist Rowan Wolf explains:

    [F]or much of the history of human society, there has not really 
been the concept of ``childhood'' as we know it today. Once a child was 
able to speak and eat on its own, it was essentially considered a 
miniature adult capable of participating in a limited way in the 
survival of the family. Once ``children'' hit puberty, they were 
considered adults, though they might not take on adult roles until they 
formed their own family. There was no concept of adolescence. . . . 
Children went from ``miniature adults'' expected to act like adults but 
without the rights of adults, to a carefree, dependent period of 
exploration and learning. When we look at the expectations of 
``teenagers,'' we define this as a rebellious period of individuation. 
We simultaneously expect adolescents to act like adults and rebel from 
them at the same time. This is a period where people are sexually 
mature, but socially and economically dependent.

    Age Stratification, Sept. 2005, www.srwolf.com/wolfsoc/
articlearchives/2008/11/age_strati
fication.html.
    \88\ See, e.g., The Invention of Adolescence, Psychology Today, 
Jan./Feb. 1995, www.psycho
logytoday.com/articles/pto-19950101-000024.html.
    \89\ See, e.g., Bar Mitzvah, Bat Mitzvah and Confirmation, Judaism 
101, http://www.jew
faq.org/barmitz.htm.
    \90\ The term ``general audience'' is commonly used instead of 
``adult-oriented'' for content that is not directed at children.
---------------------------------------------------------------------------
B. The Difficulties of Empirical Assessments about Intended Audiences
    If the subjective ``I know it when I see it standard'' is not so 
easily applied for determining what constitutes adolescent-oriented PI-
collecting sites, the alternative under the FTC's COPPA rules is to 
examine ``competent and reliable empirical evidence.'' \91\ Could 
demographic data about a site's membership provide sufficiently clear 
guidance about the scope of a law that (like New Jersey's proposal) 
retains COPPA's current ``directed at'' approach? \92\
---------------------------------------------------------------------------
    \91\ 16 C.F.R.  312.2 (definition of ``website or online service 
directed to children'').
    \92\ See supra note 13.
---------------------------------------------------------------------------
    The FTC has never addressed the difficult question of setting a 
minimum threshold of child membership/participation in a site above 
which the site would be considered ``directed at children:'' Not one of 
the complaints brought by the FTC under COPPA cites demographic 
evidence. Because, as discussed above, child-oriented websites tend to 
exist in a virtually distinct ``Junior Internet,'' with little overlap 
between adults and children, and because many parents use technological 
controls to keep their children (but not their adolescents) within this 
Junior Internet, it is hardly surprising that the FTC has never 
answered this question: Subjective criteria are generally sufficient to 
identify child-oriented sites, and those sites are likely to be used 
overwhelmingly by children or young adolescents with very little adult 
participation.
    But as discussed above, few of the websites frequented by 
adolescents are dominated so overwhelmingly by adolescents as children 
dominate the membership of the Junior Internet to which COPPA currently 
applies. Instead, adolescents participate in many of the same PI-
collecting sites used by adults, as demonstrated by the following 
sample of some of the more popular Web 2.0 sites, including demographic 
estimates:

                  Exhibit 1: Popular Web 2.0 Sites\93\
------------------------------------------------------------------------
                     Unique U.S.    Annual U.S. Page   % of Users Under
    Site Name           Users            Views              Age 18
------------------------------------------------------------------------
myyearbook.com          2,000,000        860,000,000             50.00%
bebo.com                2,400,000        340,000,000             35.00%
nickjr.com              2,400,000        210,000,000             31.67%
myspace.com            67,000,000     43,000,000,000             28.36%
photobucket.com        25,000,000      1,300,000,000             26.80%
movie6.net              1,100,000         24,000,000             26.36%
fanpop.com              1,100,000         16,000,000             21.82%
xanga.com               1,600,000         82,000,000             20.00%
tagged.com              3,500,000      1,100,000,000             19.71%
zango.com               2,900,000         21,000,000             17.93%
aol.com                37,000,000      4,000,000,000             16.49%
hi5.com                 2,800,000        870,000,000             15.00%
facebook.com           74,000,000     30,000,000,000             12.16%
yahoo.com             140,000,000     36,000,000,000             11.43%
friendster.com          1,600,000        490,000,000             11.25%
wordpress.com          23,000,000        300,000,000             10.43%
gametrailers.com        1,200,000         50,000,000             10.00%
flickr.com             21,000,000      1,000,000,000              9.52%
------------------------------------------------------------------------

    So would some of these sites be considered ``adolescent-oriented'' 
even though most of their users are actually adults? Perhaps not in New 
Jersey (depending on the circumstances of any particular site ),\94\ 
but this is essentially what the Illinois bill requires: \95\ The 
approximately 88 percent of Facebook's users 18 and above must be age 
verified for the sake of obtaining parental consent for the 12 percent 
under 18. This example is apt, because 12 percent happens to coincide 
with the estimated percentage of American Internet users under 18: 12.6 
percent or 28 million Americans.\96\
---------------------------------------------------------------------------
    \93\Data obtained from Google Ad Planner on Mar. 1, 2009, https://
www.google.com/adplanner/planning (by dividing ``UV users'' for the 0-
17 ``audience'' by ``UV users'' for the entire population).
    \94\ See supra note 13 and at 17.
    \95\ See supra note 74.
    \96\ Data obtained from Google Ad Planner on Mar. 1, 2009, https://
www.google.com/adplanner/planning (by limiting age to 0-17).
---------------------------------------------------------------------------
C. Possible Reactions to COPPA 2.0s Uncertain Scope
    Of the top 250 sites ranked by audience reach, only a handful stand 
out as being obviously child-oriented, such as cartoonnetwork.com and 
nick.com (Nickelodeon). A number of leading social networks top the 
list and many, if not most, of these sites require the sharing of some 
personal information (if only an e-mail address) for full 
functionality. But how would any of these operators--let alone the 
millions of sites in the ``Long Tail'' of Internet content--determine 
whether they would be considered adolescent-oriented? By the same 
token, how should a legislator following Illinois's approach (defining 
the scope of the COPPA 2.0 law in terms of site functionality) decide 
which features should trigger age verification requirements?
    To the extent PI-collecting Site operators might be unsure whether 
a COPPA 2.0 age verification mandate would apply to them, they would 
likely take one of the following steps to minimize their potential 
liability.

1. Trying to Block All Adolescents
    Of course, since PI-collecting Site operators do not know which 
would-be users are minors without an age verification system (and 
perhaps not even then!), the most they could do would be to claim that 
they block access by adolescents. Websites can certainly try to block 
users who initially admit to being under 18 from trying to register 
again for the site.\97\ But this approach is only effective to the 
extent that adolescents are naive enough to admit their true age in the 
first place and not to know how to circumvent whatever system the 
operator has in place for preventing users from trying to register for 
the site after initially being blocked--which should be relatively 
simple to do (e.g., by deleting cookies from the site).
---------------------------------------------------------------------------
    \97\ See supra at 29.
---------------------------------------------------------------------------
2. Avoiding Actual Knowledge
    Some PI-collecting Site operators may give up on the ``directed 
at'' prong and try to avoid gaining ``actual knowledge'' that a user is 
under 18 simply by ceasing to ask for age information upon the creation 
of a user account--or perhaps by no longer requiring the creation of 
user accounts altogether. But this is a dangerous gamble because, if a 
site is ultimately found to be ``adolescent-oriented,'' not asking for 
age upon sign-up might be considered a serious violation in itself.\98\ 
This ``Catch-22'' places site operators in a difficult and legally 
precarious position--especially significant smaller site operators 
trying to raise funding.
---------------------------------------------------------------------------
    \98\ For example, the amount of a penalty imposed on an operator 
deemed to be in violation would depend on ``Respondent's good faith'' 
and ``The deterrent effect of the penalty action.'' 16 C.F.R.  1.67(b) 
& (d).
---------------------------------------------------------------------------
    Other operators may reduce human moderation of their site in order 
to avoid situations in which an employee might learn that a user is 
under 18 (e.g., by reading their comments or profile). This is 
precisely the sort of perverse incentive that Congress attempted to 
avoid in passing Section 230 of the Communications Decency Act of 1996, 
which fully immunized online intermediaries from liability even if they 
made ``good Samaritan'' efforts to self-police their sites for 
objectionable content.\99\ (The FTC has already created this perverse 
incentive under COPPA, but given the demand among parents for heavy 
moderation on child-oriented sites, COPPA's perverse incentive may have 
had little effect.\100\ ) Thus, COPPA 2.0 proposals could lead to less 
protection for minors, not more, by discouraging site operators from 
``chaperoning'' interaction on their sites.\101\
---------------------------------------------------------------------------
    \99\ ``No provider or user of an interactive computer service shall 
be held liable on account of . . . any action taken to enable or make 
available to information content providers or others the technical 
means to restrict access to material . . . material that the provider 
or user considers to be obscene, lewd, lascivious, filthy, excessively 
violent, harassing, or otherwise objectionable. . . .'' 47 U.S.C.  
230(c)(2).
    \100\ See COPPA FAQ, supra note 58, Question 41(b) (``What happens 
if a child visits a chat room or creates a blog and announces his or 
her age?''). The FTC answers: ``You may be considered to have actual 
knowledge with respect to that child if someone from your organization 
sees the post, or if someone alerts you to the post (for example, a 
concerned parent who learns that his child is participating on your 
site). However, if no one in your organization is aware of the post, 
then you may not have the requisite actual knowledge under the Rule.'' 
Id.
    \101\ See infra at 30.
---------------------------------------------------------------------------
3. Age-Verifying All Users
    COPPA 2.0s greatest threat is that large numbers of PI-collecting 
Site operators would be--or would feel--compelled to require age-
verification of large numbers of adults as users. There is currently no 
age verification requirement other than COPPA, which affects adults 
only to the extent that parents need to establish their parental 
relationship to their kids. But COPPA affects few other adults because 
few adults want to use child-oriented PI-collecting sites like Disney's 
Club Penguin. COPPA 2.0 proposals would either directly require age 
verification of all adults who wanted to use ``social networking 
sites'' (as proposed in Illinois) or indirectly require much the same 
thing by mandating age verification for ``adolescent-oriented sites'' 
(as proposed in New Jersey). Indeed, this may be precisely what some 
COPPA 2.0 advocates want, since they may envision it as the only way to 
make the Internet truly ``safe'' for adolescents.
    But few proponents would make such a goal explicit, for they know 
that such a ``scaled-up'' COPPA would essentially converge with COPA as 
a broad age verification mandate. As noted below, this highlights the 
First Amendment implications of trying to turn COPPA into something it 
was not designed to be: not merely a tool for enhancing parental 
involvement and kids' privacy, but a broad mandate for child safety.

VI. The First Amendment Implications of Broad Age Verification Mandates
    Both COPPA and COPA rest on a stratification of users by age, but 
the approach of the two laws is very different: While COPPA requires 
age verification if content is ``directed at'' minors under age 13, 
COPA would have required that all website operators restrict access to 
material deemed ``harmful to minors'' by minors under the age of 17 and 
therefore requires age verification of all users who attempt to access 
such content (in order to identify minors). COPPA is focused on certain 
kinds of potentially harmful contacts \102\ while COPA is focused on 
potentially harmful content.\103\
---------------------------------------------------------------------------
    \102\ See supra at 9.
    \103\ COPA makes it illegal to ``knowingly . . . make[ ] any 
communication for commercial purposes that is available to any minor 
and that includes any material that is harmful to minors.'' 47 U.S.C. 
231.
---------------------------------------------------------------------------
    But by expanding the age range of COPPA to include adolescents, 
COPPA 2.0 proposals essentially converge with COPA, reaching the same 
practical consequence: age verification mandates for large numbers of 
adults as users (not as parents). Only the scope of sites covered by 
the laws is different: under COPA, sites deemed ``harmful to minors,'' 
and, under COPPA 2.0, adolescent-oriented or certain social networking 
sites. Thus, to the extent that COPPA 2.0 proposals require age 
verification of adults, they would be subject to constitutional attacks 
similar to those against COPA. But COPPA 2.0 proposals would also 
burden the rights of adults to communicate with adolescents and the 
free speech rights of adolescents.
    Finally, the fact that COPPA (like COPA) applies only to commercial 
sites would do little to protect it from constitutional attack, because 
in a world of user-generated content, the commercial nature of a site 
has little to do with the commercial/non-commercial nature of the 
speech carried on it. For example, obviously commercial sites like 
MySpace and Facebook serve as platforms for a wide variety of not-for-
profit and political communications.

A. First Amendment Rights of Adults
    After a decade-long court battle over the constitutionality of 
COPA, the U.S. Supreme Court in January 2009 rejected the government's 
latest request to revive the law, meaning it is likely dead.\104\ Three 
of the key reasons the courts struck down COPA would also apply to 
COPPA 2.0 proposals.
---------------------------------------------------------------------------
    \104\ See Adam Thierer, The Progress & Freedom Foundation, Closing 
the Book on COPA, PFF Blog, Jan. 21, 2009, http://blog.pff.org/
archives/2009/01/closing_the_boo.html. See also Alex Harris, Child 
Online Protection Act Still Unconstitutional, http://
cyberlaw.stanford.edu/packet/200811/child-online-protection-act-
stillunconstitutional.
---------------------------------------------------------------------------
1. Anonymous Speech Rights of Adults
    COPA burdened the speech rights of adults to access information 
subject to age verification requirements, both by making speech more 
difficult and by stigmatizing it. In 2003, the Third Circuit noted that 
age verification requirements ``will likely deter many adults from 
accessing restricted content, because many Web users are simply 
unwilling to provide identification information in order to gain access 
to content, especially where the information they wish to access is 
sensitive or controversial.'' \105\ In 2008, in striking down COPA for 
the third and final time, the Third Circuit approvingly quoted the 
district court, which had noted that part of the reason age 
verification requirements deterred users from accessing restricted 
content was ``because Internet users are concerned about security on 
the Internet and because Internet users are afraid of fraud and 
identity theft on the Internet.'' \106\ The district court had held 
that:
---------------------------------------------------------------------------
    \105\ American Civil Liberties Union v. Ashcroft, 322 F.3d 240, 259 
(3d Cir. 2003) (ACLU II).
    \106\ American Civil Liberties Union v. Ashcroft, 534 F.3d 181, 196 
(3d Cir. 2008) (ACLU III) (Gonzales, 478 F. Supp. 2d 775 at 806).

        Requiring users to go through an age verification process would 
        lead to a distinct loss of personal privacy. Many people wish 
        to browse and access material privately and anonymously, 
        especially if it is sexually explicit. Web users are especially 
        unlikely to provide a credit card or personal information to 
        gain access to sensitive, personal, controversial, or 
        stigmatized content on the Web. As a result of this desire to 
        remain anonymous, many users who are not willing to access 
        information non-anonymously will be deterred from accessing the 
        desired information.\107\
---------------------------------------------------------------------------
    \107\ Gonzales at 805.

    The Supreme Court has recognized the vital importance of anonymous 
---------------------------------------------------------------------------
speech in the context of traditional publication:

        Anonymous pamphlets, leaflets, brochures and even books have 
        played an important role in the progress of mankind. Great 
        works of literature have frequently been produced by authors 
        writing under assumed names. Despite readers' curiosity and the 
        public's interest in identifying the creator of a work of art, 
        an author generally is free to decide whether or not to 
        disclose his or her true identity. The decision in favor of 
        anonymity may be motivated by fear of economic or official 
        retaliation, by concern about social ostracism, or merely by a 
        desire to preserve as much of one's privacy as possible. 
        Whatever the motivation may be, at least in the field of 
        literary endeavor, the interest in having anonymous works enter 
        the marketplace of ideas unquestionably outweighs any public 
        interest in requiring disclosure as a condition of entry. 
        Accordingly, an author's decision to remain anonymous, like 
        other decisions concerning omissions or additions to the 
        content of a publication, is an aspect of the freedom of speech 
        protected by the First Amendment.\108\
---------------------------------------------------------------------------
    \108\ McIntyre v. Ohio Elections Comm'n, 514 U.S. 334, 342 (1995) 
(striking down law that prohibited distribution of anonymous campaign 
literature); see also Talley v. California, 362 U.S. 60 (1960) 
(striking down a state law that forbade all anonymous leafletting).

    By imposing broad age verification requirements, COPPA 2.0 would 
restrict the rights of adults to send and receive information 
anonymously just as COPA did. If anything, the speech burdened by COPPA 
2.0 deserves more protection, not less, than the speech burdened by 
COPA: Where COPA merely burdened access to content deemed ``harmful to 
minors'' (viz., pornography), COPPA 2.0 would burden access to material 
by adults as well as minors not because that material is harmful or 
obscene but merely because it is ``directed at'' minors! Thus, the 
content covered by COPPA 2.0 proposals could include not merely 
pornography, but communications about political nature, which deserved 
the highest degree of First Amendment protection.

2. Speech Rights of Site Operators
    The necessary corollary of blocking adults from accessing certain 
content anonymously--and thereby deterring some users from accessing 
that content--is that COPPA 2.0, like COPA, would necessarily reduce 
the audience size of PI-collecting sites subject to age verification 
mandates. Furthermore, such mandates would encourage websites to self-
censor themselves to avoid offering content they fear could be 
considered ``directed at'' adolescents because doing so might subject 
them to an age verification mandate--or to legal liability if they fail 
to implement age verification. The substantial cost of age verification 
could significantly impact, if not make impossible, the business models 
of many PI-collecting sites, which generally do not charge for content 
and rely instead on advertising revenues. The Third Circuit cited all 
of these burdens on the free speech rights of website operators in 
striking down COPA.\109\
---------------------------------------------------------------------------
    \109\ See ACLU III, 534 F.3d at 196-97 (citing Gonzales at 804). 
The Court held that websites ``face significant costs to implement 
[COPA's age verification mandates] and will suffer the loss of 
legitimate visitors once they do so.'' Id. at 197.
---------------------------------------------------------------------------
3. Less Restrictive Alternatives to Regulation
    The Third Circuit drew on the Supreme Court's 2004 decision 
striking down COPA on the grounds that ``[b]locking and filtering 
software is an alternative that is less restrictive than COPA, and, in 
addition, likely more effective as a means of restricting children's 
access to materials harmful to them.'' \110\ Similarly, parental 
control software already empowers parents to restrict their kids' 
access to PI-collecting sites. (It's particularly easy for parents to 
restrict access to the leading social networking sites that seem to be 
driving so much of the push for COPPA 2.0, so that their kids.)
---------------------------------------------------------------------------
    \110\ Id. at 198 (quoting ACLU v. Mukasey, 534 F.3d 181, 198 
(2008)).
---------------------------------------------------------------------------
    Thus, the free speech rights burdened COPPA 2.0 proposals are at 
least as important as those burdened by COPA, and blocking software 
already empowers parents to restrict their kids' access to PI-
collecting sites, just as it allows parents to restrict access to 
pornography. Of course, if COPPA 2.0 laws were actually enacted and 
subject to legal challenge, the outcome of the case would depend 
largely on the level of constitutional scrutiny involved. COPPA 2.0 
advocates might argue that, whatever the rights at stake, a lower level 
of constitutional scrutiny should apply because COPPA 2.0 does not 
target a special category of content. If true, this could mean that, 
although age verification mandates to restrict access to ``harmful'' 
material are unconstitutional, far more sweeping mandates restricting 
access to non-harmful information could be constitutional. Such 
inconsistency is indeed a perverse consequence of the fact that our 
First Amendment jurisprudence focuses not on the rights at stake, but 
on whether a regulation is ``content-neutral'' in deciding what level 
of scrutiny to apply--which, in turn, often determines the outcome of 
the case.\111\ But in this case, COPPA 2.0 proposals likely would be 
subject to strict scrutiny to the extent that they are, like COPA, 
focused on a certain category of content: that ``directed at'' 
adolescents (rather than ``harmful to minors'').
---------------------------------------------------------------------------
    \111\ Ashutosh Avinash Bhagwat, The Test that Ate Everything: 
Intermediate Scrutiny in First Amendment Jurisprudence, 2007 U. Ill. 
Law. Rev. 783 (2007), available at http://papers
.ssrn.com/sol3/papers.cfm?abstract_id=887566.
---------------------------------------------------------------------------
    Legislators who attempt to escape strict scrutiny by defining the 
scope of their bill (as in Illinois) not by its targeted audience but 
by reference to specific functional capabilities (in the definition of 
``social networking site'') \112\ will likely find that a court will 
see through such window-dressing: If they recognize that such bills are 
nonetheless aimed at a certain category of adolescent-oriented content, 
they will apply strict scrutiny anyway. But even under intermediate 
scrutiny, COPPA 2.0 proposals would be subject to serious attack.
---------------------------------------------------------------------------
    \112\ See supra note 74.
---------------------------------------------------------------------------
B. First Amendment Rights of Adolescents
    In addition, in COPPA 2.0 approaches, the government would restrict 
the ability of adolescents to access content, not because it could be 
harmful to them or because it is obscene, but merely because it is 
``directed to'' them. While the First Amendment rights of minors may 
not be on par with those of adults, adolescents do have the right to 
access certain types of information and express themselves in certain 
ways.\113\ The Supreme Court has held that ``constitutional rights do 
not mature and come into being magically only when one attains the 
state-defined age of majority.'' \114\ It remains unclear how an 
expanded COPPA model might interfere with the First Amendment rights of 
adolescents, but it is clear that privacy and speech rights would come 
into conflict under COPPA 2.0, as they do in other contexts.\115\
---------------------------------------------------------------------------
    \113\ See Theresa Chmara & Daniel Mach, Minors' Rights to Receive 
Information Under the First Amendment, Memorandum from Jenner & Block 
to the Freedom To Read Foundation, Feb. 2, 2004, www.ala.org/ala/
aboutala/offices/oif/ifissues/issuesrelatedlinks/minorsrights.cfm 
(summarizing case law regarding minors' first amendment rights, 
especially in schools and in the context of mandates that public 
libraries filter Internet content); United States v. American Library 
Ass'n, 123 S. Ct. 2297 (2003), available at laws.findlaw.com/us/000/02-
361.html (upholding the constitutionality of a filtering software 
system applicable to minors); see generally, Tinker v. Des Moines Ind. 
Comm. School Dist., 393 U.S. 503 (1969) (upholding students' rights to 
wear protest armbands and affirming that minors have speech rights) 
available at www.oyez.org/cases/1960-1969/1968/1968_21; cf. Morse v. 
Frederick, 551 U.S. 393 (2007), available at www.oyez.org/cases/2000-
2009/2006/2006_06_278/ (holding that the First Amendment rights of 
students in school and at school-supervised events are not as broad as 
those of adults in other settings).
    \114\ Planned Parenthood of Cent. Mo. v. Danforth, 428 U.S. 52, 74 
(1976) (minors' right to abortion). See also Bellotti v. Baird, 443 
U.S. 622, 635 n.13 (minors possess close to the ``full capacity for 
individual choice which is the presupposition of First Amendment 
guarantees''); Catherine Ross, An Emerging Right for Mature Minors to 
Receive Information, 2 U. Pa. J. Const. L. 223 (1999); Lee Tien & Seth 
Schoen, Reply Comments of the Electronic Frontier Foundation filed in 
Implementation of the Child Safe Viewing Act; Examination of Parental 
Control Technologies for Video or Audio Programming, MB Docket No. 
0926, Federal Communications Commission, May 18, 2009, http://
fjallfoss.fcc.gov/prod/ecfs/retrieve.cgi?native_or_pdf=pdf&id_docu
ment=6520216901.
    \115\ See generally Solveig Singleton, Privacy Versus the First 
Amendment: A Skeptical Approach, 11 Fordham Intell. Prop. Media & Ent. 
L.J. 97 (2000), available at http://law.fordham.edu/publications/
articles/200flspub6588.pdf; Eugene Volokh, Freedom of Speech and 
Information Privacy: The Troubling Implications of a Right to Stop 
People from Speaking About You, 52 Stan. L. Rev. 1175 (2000), available 
at www.law.ucla.edu/volokh/privacy.htm.
---------------------------------------------------------------------------
    For example, how might the parental-consent based model limit the 
ability of adolescents to obtain information about ``safer sex'' or how 
to deal with trauma, depression, family abuse, or addiction. Would an 
abusive father authorize a teen to visit a website about how to report 
child abuse? Would a parent of an adolescent struggling with their 
sexual identity let their kid participate in a self-help social 
networking page for gay and lesbian youth? \116\ What rights are at 
play here and how do we reconcile them?
---------------------------------------------------------------------------
    \116\ ``There are parents who, for a variety of reasons (political, 
cultural, or religious beliefs, ignorance of the facts, fear of being 
exposed as abusers, etc.), would deliberately prevent their teens from 
accessing social-network sites (SNS).'' ISTTF Final Report, supra note 
8, Appendix F, Statement of Connect Safely, at 262 (listing examples of 
unintended consequences of age verification mandates).
---------------------------------------------------------------------------
    Maintaining the ability of kids to participate online interactions 
goes beyond content that most people would recognize as ``serious''--
from the perspective of both First Amendment values and the education 
of children. As a recent MacArthur Foundation study of the online youth 
Internet use concluded:

        Contrary to adult perceptions, while hanging out online, youth 
        are picking up basic social and technological skills they need 
        to fully participate in contemporary society. Erecting barriers 
        to participation deprives teens of access to these forms of 
        learning. Participation in the digital age means more than 
        being able to access ``serious'' online information and 
        culture.\117\
---------------------------------------------------------------------------
    \117\ John D. and Catherine T. MacArthur Foundation, Living and 
Learning with New Media: Summary of Findings from the Digital Youth 
Project, at 2 [hereinafter MacArthur Study] http://
digitalyouth.ischool.berkeley.edu/files/report/digitalyouth-
WhitePaper.pdf.

    It was at least in part in recognition of such difficult First 
Amendment questions that Congress removed the requirement in the 
initial legislative draft of COPPA that would have required PI-based 
sites to ``use reasonable efforts to provide the parents with notice 
and an opportunity to prevent or curtail the collection or use of 
personal information collected from children over the age of 12 and 
under the age of 17.'' \118\
---------------------------------------------------------------------------
    \118\ This requirement was contained in the original bill, supra 
note 14  3(a)(2)(A)(iii), but was removed when that bill was 
reintroduced in its final form. In the interim, Congress held a hearing 
at which testimony was offered by, among others, Deirdre Mulligan of 
the Center for Democracy and Technology, which generally supported 
COPPA but argued for the very revisions that were ultimately made. In 
particular, Mulligan argued that:
    Under the bill each time a 15 year old signs-up to receive 
information through e-mail his or her parent would be notified. For 
example if a 15 year old visits a site, whether a bookstore or a 
women's health clinic where material is made available for sale and 
requests information about purchasing a particular book or merely 
inquires about books on a particular subject (abuse, religion) using 
their e-mail address the teenager's parent would be notified. This may 
chill older minors in pursuit of information.
    Mulligan Testimony, supra note 15.
---------------------------------------------------------------------------
    Even if parents have an absolute right to block their adolescents' 
access to such data, they can already exercise that right by applying 
strict controls on the computers in their home. COPPA 2.0 proposals go 
well beyond recognizing this right by setting the default to ``parental 
consent required'' for adolescents to access a wide range of content--
meaning that parents must ``opt-in'' on behalf of their children before 
their children can participate in PI-collecting sites. This, in turn, 
burdens the ability of adolescents to communicate, because their 
parents might censor (rightly or wrongly) certain information, or 
simply fail to understand the technologies involved or to be actively 
engaged. But whatever the free speech rights of adolescents, if anyone 
should be interfering with those rights, it should be their parents--
not the government.
    Some parents may object that, however effective parental control 
software may be in the home, it does not allow parents to control what 
their kids' access outside the home. This argument is understandable on 
some level, but in the end, it amounts to a demand that roadblocks be 
put up everywhere for the sake of particularly sensitive parents at the 
expense of everyone else in society, including potentially huge numbers 
of adult users--and of online anonymity in general.
    But Illinois's COPPA 2.0 proposal goes even further, not merely 
expanding COPPA to cover a particular variety of social networking 
sites,\119\ but requiring that such sites ``allow the parent or 
guardian of the minor unrestricted access to the profile web page of 
the minor at all times.'' \120\ Congress considered just such a 
parental access mandate in the initial draft of COPPA legislation back 
in 1998, but ultimately removed it from the final version of the 
legislation,\121\ apparently because even some of COPPA's supporters 
worried, given the bill's initial application to the 13-16 age bracket, 
that ``The establishment of a parental right to access all personal 
information about a teenager may intrude on older minors' privacy, 
rather than protect.'' \122\
---------------------------------------------------------------------------
    \119\ See supra note 74.
    \120\ SNWARA, supra note 11,  10(c).
    \121\ The original COPPA bill required that parents have ``access 
to the personal information of the child of that parent collected by 
that website,'' S. 2326, supra note 14,  3(a)(2)(iv)(I), while the 
bill as passed instead requires only that parents be given ``a 
description of the specific types of personal information collected 
from the child by that operator,'' 15 U.S.C.  6502(b)(1)(B)(I) 
(emphasis added).
    \122\ See Mulligan Testimony, supra note 118.
---------------------------------------------------------------------------
C. Communication between Adolescents & Adults
    Finally, COPPA 2.0 could infringe on the free speech rights of 
adults to communicate with adolescents online by driving PI-collecting 
sites to segregate users by age or to attempt to block access by 
adolescents. The vast majority of adult-minor interactions online are 
not of a harassing or predatory nature--indeed, they generally involve 
adults looking to help or assist minors in various ways. As the 
MacArthur Foundation study cited above concluded:

        In contexts of peer-based learning, adults . . . have an 
        important role to play, though it is not the conventionally 
        authoritative one. In friendship-driven practices, direct adult 
        participation is often unwelcome, but in interest-driven groups 
        we found a much stronger role for more experiences participants 
        to play. Unlike instructors in formal educational settings, 
        however, these adults are passionate hobbyists and creators, 
        and youth see them as experienced peers, not as people who have 
        authority over them. These adults exert tremendous influence in 
        setting communal norms and what educators might call ``learning 
        goals,'' though they do not have direct authority over 
        newcomers.\123\
---------------------------------------------------------------------------
    \123\ MacArthur Study, supra note 117, at 39 (emphasis added).

    A substantial portion of those interactions involve parents talking 
to their own kids, older and younger siblings communicating with one 
another, teachers and mentors talking to their students, or even co-
workers of different ages communicating. Even when adult-minor 
communications involve complete strangers, there is typically a 
socially-beneficial purpose. Think of two people--one an adult and one 
a minor--debating politics on a discussion board, or creating a 
Wikipedia entry together. What about a Presidential campaign website 
that involves millions of volunteers of all ages communicating and 
collaborating to a common purpose? There are countless other examples. 
How would such interactions be affected by COPPA 2.0? Restricting such 
interactions would raise profound First Amendment concerns about 
freedom of speech as well as of association.
    In any First Amendment analysis, a court must consider not only the 
free speech rights at stake and the availability of less restrictive 
alternatives to regulation, but the governmental interest being 
advanced. Again, neither COPPA nor the COPPA 2.0 proposals discussed 
herein (in New Jersey and Illinois) requires exclusion of older users 
from a website, nor directly governs the sharing of personal 
information among users (where that sharing does not also constitute 
collection by the site itself). But separation of adolescents from 
adults is likely to be an indirect effect of COPPA 2.0 requirements--as 
COPPA 2.0 advocates probably realize--because, once PI-collecting sites 
are required to age-verify users, they will face reputational, 
political and potentially legal pressure to make interactions between 
adolescents and children more difficult in the name of ``child 
safety.'' More subtly, if PI-collecting site operators have an 
incentive to avoid being considered ``directed at'' adolescents, they 
will also have an incentive to discourage adolescent participation on 
their site--which achieves a similar result.
    Here, one must further ask if attempting to quarantine children 
from adults (however indirectly) actually advances, on net, a strong 
governmental interest in child protection. Such a quarantine is 
unlikely to stop adults with truly nefarious intentions from 
communicating with minors, as systems designed to exclude participation 
by adults in a ``kids-only'' or ``adolescents-only'' area can be easily 
circumvented. Given the lack of strong identity records for minors, 
it's much easier for an adult to pretend to be a minor than vice versa. 
The effect of age stratification on truly bad actors is likely to be 
marginal at best--or harmful at worst: Building walls around 
adolescents through age-verification might actually make it easier for 
predators to target teens, since a predator who gains access to a 
supposedly teen-only site will be less likely to be exposed as a 
predator by targeting an adult they think is a teen. So for the sake of 
marginal (if any) gains in child protection, would we not be excluding 
beneficial interaction between adults and minors?
    To hear some of the advocates of COPPA 2.0 talk about how teens 
currently behave online, one might think that online environments in 
which adolescents were left to their own devices--imagine a ``Teen 
MySpace'' for the 13-17 crowd, walled off from the rest of MySpace--
would be far worse, perhaps an online version of Lord of the Flies. 
These concerns are clearly exaggerated: The critics frequently complain 
about ``the way kids talk to each other these days'' while looking at 
their own past adolescent banter with rose-colored lenses. What is 
clear is that adolescents (and young adults) behave better in online 
environments where adults are present, too. Perhaps the best 
demonstration of this fact has been the uproar from adolescents and 
young adults that has accompanied Facebook's explosive growth in 
popularity among older users in recent months.\124\ Many kids hate the 
idea of adults joining Facebook precisely because the presence of 
adults encourages kids to ``self-regulate'' by exercising better 
judgment and following better netiquette.\125\
---------------------------------------------------------------------------
    \124\ Justin Smith, Number of U.S. Facebook Users Over 35 Nearly 
Doubles in Last 60 Days, Inside Facebook Blog Mar. 25, 2009, 
www.insidefacebook.com/2009/03/25/number-of-us-facebook-users-over-35-
nearly-doubles-inlast-60-days/.
    \125\ See, e.g., Lori Aratani, When Mom or Dad Asks To Be a 
Facebook ``'Friend,'' The Washington Post, Mar. 9, 2008, 
www.washingtonpost.com/wp-dyn/content/article/2008/03/08/
AR2008030801034.html. ```I do not know if this has happened to anybody, 
but this morning I log on to Facebook and I have a new friend request!' 
wrote 19-year-old Mike Yeamans, a sophomore at James Madison 
University, on one of several `No Parents on Facebook' groups that have 
popped up on the site. `I am excited to make a new friend so I click on 
the link. I could not believe what I saw. My father! This is an 
outrage!''' Id.
---------------------------------------------------------------------------
    Anne Collier, founder and executive director of the child safety 
advocacy organization Net Family News, Inc. and editor of 
NetFamilyNews.org and ConnectSafely.org, suggests that the push for 
``segregation'' by age (e.g., creating a teen-only version of Second 
Life) for safety's sake is ``losing steam'' because:

        it's a response to the predator panic teens and parents have 
        been subjected to in U.S. society, not to the realities of 
        youth on the social Web. What nearly a decade of peer-reviewed 
        academic research shows is that peer-to-peer behavior is the 
        online risk that affects many more youth, the vast majority of 
        online kids who are not already at-risk youth offline. 
        Segregating teens from adults online doesn't address 
        harassment, defamation, imposter profiles, cyberbullying, etc. 
        It may help keep online predators away from kids (even though 
        online predation, or abuse resulting from online communication, 
        constitutes only 1 percent of overall child sexual exploitation 
        . . .), which is a great outcome, but it's not enough unless 
        all that parents are worried about is predators.\126\
---------------------------------------------------------------------------
    \126\ Anne Collier, Where Will OnlineTeens Go Next?, May 1, 2009, 
www.netfamilynews.org/2009/05/wherewill-online-teens-go-next.html 
(internal citations omitted). For evidence of at-risk youth, Collier 
sites the ISTTF Final Report, supra note 8. Regarding the percentage of 
all child sexual exploitation that results from online communication, 
she cites Janis Wolak, David Finkelhor & Kimberly Mitchell, Crimes 
Against Children Research Center, Trends in Arrests of Online 
Predators, 2009) www.unh.edu/ccrc/pdf/CV194.pdf; see also, Anne 
Collier, Major Update on Net predators: CACRC study, March 31, 2009, 
www.netfamilynews.org/2009/03/major-update-on-net-predators-mostly.html 
(summarizing study).

    Collier discusses the particularly acute problem of ``actual or 
perceived sexual orientation and gender expression,'' which the Salt 
Lake Tribune has noted are ``two of the top three reasons secondary 
school students said their peers were most often bullied at school.'' 
\127\ This kind of harassment recently attracted widespread public 
attention after two 11-year-old boys committed suicide after 
experiencing anti-gay harassment and bullying at school.\128\
---------------------------------------------------------------------------
    \127\ Anne Collier, Anti-Gay Bullying Most Pervasive, April 29, 
2009, www.netfamilynews.org/2009/04/anti-gaybullying-most-
pervasive.html (quoting Charles Robbins & Eliza Byard, Gay Suicide: 
Addressing Harassment in Schools, Salt Lake Tribune, April 24, 2009, 
www.sltrib.com/opinion/ci_12220931 [hereinafter Gay suicide]).
    \128\ Gay suicide, supra note 127.
---------------------------------------------------------------------------
    Nationwide, ``Lesbian, gay, bisexual, transgender and questioning 
youth are up to four times more likely to attempt suicide than their 
heterosexual peers.'' \129\ This child safety risk is painfully real, 
with anti-gay harassment being only its most obvious form. But 
``segregating'' teens from adults seems likely to aggravate this 
problem by removing adults from the mix as a potential source of 
discipline.
---------------------------------------------------------------------------
    \129\ Id.
---------------------------------------------------------------------------
    Of course, adults play a critical role in disciplining interaction 
among the 0-12 age bracket, but not as direct participants in on-site 
interaction. Again, how many adults actually want to use Club Penguin? 
Instead, parents can supervise what their kids do online through 
parental control software. Parents could, of course, use that same 
software to monitor what their adolescent kids do, too. But as kids get 
older, most parents realize that the training wheels have to come off 
at some point. Few parents will want to spy on their 17-year-old until 
the day before the kid starts college (or enlists in the military or 
gets married). But most parents probably would prefer that, if their 
kids are interacting in an online environment, they think twice about 
what they do and say online. It is by no means clear that restricting 
online interaction between teens and adults will serve that end.
VII. The Commerce Clause Implications of State-Level COPPA 2.0
    State-based efforts to expand COPPA or to impose other forms of 
age/identity verification raise additional constitutional concerns: 
State-level efforts by state government or state AGs to push through an 
expansion of COPPA would likely violate the Commerce Clause of the U.S. 
Constitution.
    For simplicity, the preceding discussion did not consider how PI-
collecting sites would respond to COPPA obligations imposed in one U.S. 
state but not others. Sites might default to the ``lowest common 
denominator'' of whatever would be acceptable in the most restrictive 
states--especially if those states has populations as large as Illinois 
or New Jersey. But websites could also attempt to configure their 
services to function differently depending on what state the user is 
in. Thus, age verification mandates might also require location 
mandates (again, perversely requiring the collection of more 
information in the name of protecting adolescents' privacy). If a site 
relied only on location information provided by the user, adolescents 
would quickly learn to lie about what state they live in just as 
children have learned to lie about how old they are to avoid triggering 
COPPA's ``actual knowledge'' requirement. Alternatively, websites could 
attempt to determine a user's location automatically based on their IP 
address, but such ``IP geocoding'' is not always accurate and can be 
subverted by use of a proxy.
    This technical discussion should help to illustrate why state-level 
COPPA 2.0 proposals would burden communication over the Internet, a 
uniquely ``interstate'' medium whose architecture makes it difficult, 
if not impossible, to isolate the effects of state regulation on 
residents of that state. There is a long string of ``Dormant Commerce 
Clause'' cases that have consistently struck down state laws attempting 
to regulate commerce (or speech) that originates or takes place outside 
the state's borders.\130\ If it is not possible for a state government 
to isolate the effects of its regulatory actions to merely those PI-
collecting site operators or users living within its jurisdiction, 
Federal courts will block such measures. Consequently, the 
extraterritorial impact of state-based COPPA expansion would likely 
result in an immediate constitutional challenge and such regulation 
would almost certainly be overturned.
---------------------------------------------------------------------------
    \130\ See Adam Thierer, The Delicate Balance: federalism, 
Interstate Commerce, and Economic Freedom in the Technological Age at 
58-61 (The Heritage Foundation, 1999).
---------------------------------------------------------------------------
    It is also possible that COPPA 2.0 proposals may already be pre-
empted by COPPA because, although COPPA authorizes state attorneys 
general to bring enforcement actions under certain circumstances,\131\ 
COPPA bars states from enacting any laws ``inconsistent'' with 
COPPA.\132\
---------------------------------------------------------------------------
    \131\ 15 U.S.C.  6504.
    \132\ ``No State or local government may impose any liability for 
commercial activities or actions by operators in interstate or foreign 
commerce in connection with an activity or action described in this 
chapter that is inconsistent with the treatment of those activities or 
actions under this section.'' 15 U.S.C.  6502(d).
---------------------------------------------------------------------------
VIII. Summary of Implementational Challenges Regarding COPPA 
        Expansion
    Even if one somehow overcame the many policy and constitutional 
arguments against COPPA 2.0, there would remain a slew of difficult, if 
not impossible, challenges to overcome in implementing such a system. 
Most critically, the threshold practical question remains the same as 
it does for most other forms of online identity verification: How do we 
verify the parent-child relationship when someone asserts they are the 
parent or guardian? But there are many other questions regarding how 
well COPPA would ``scale up'' that must be considered:

        1. Verification Mechanisms. What sort of mechanisms will need 
        to be put in place to guarantee that the parent or guardian is 
        who they claim to be (for both initial enrollment and 
        subsequent visit authentication)? Sign-and-fax forms can be 
        easily forged, so credit cards (and perhaps mandatory user 
        fees) will likely become the default solution. A third method, 
        follow-up phone calls, just doesn't seem practical. But might 
        lawmakers demand a mix of all of the above?

        2. Obtaining Consent. Regardless, how burdensome will those 
        mandates be on parents or guardians? As Parry Aftab has noted, 
        ``The more difficult we make the consent mechanism, the fewer 
        parents we will get to consent.'' \133\
---------------------------------------------------------------------------
    \133\ Aftab Comments, supra note 59, at 5.

        3. Costs to Business. How burdensome will those mandates be for 
        PI-collecting site operators? What kind of compliance costs or 
---------------------------------------------------------------------------
        legal penalties are we talking about?

        4. Costs to Users. Will those costs be passed on to users as 
        fees beyond the nominal transactions required to achieve 
        verification via credit cards? (Since most PI-collecting sites 
        websites and almost all social networking sites are free-of-
        charge today, that's not going to be a very popular mandate!) 
        \134\
---------------------------------------------------------------------------
    \134\ Aftab also notes that ``Parents do not trust a site to use 
their credit card to verify their consent. They barely trust online 
credit card use when they want to buy something.'' Id.

        5. Disparate Socio-economic Effects. How would increased fees 
        or credit card mandates impact low-income families and youth, 
---------------------------------------------------------------------------
        especially those without credit cards?

        6. Industry Consolidation. If compliance costs--in the form of 
        additional staff, insurance and litigation expenses--explode 
        for website operators, will this cause the kind of industry 
        consolidation that seems to have occurred with child-oriented 
        websites since COPPA's adoption? Would the increased hassle of 
        accessing new sites lead to consolidation by reducing adoption 
        rates by users? How would online innovation and creative 
        expression suffer as a result of such consolidation?

        7. Increased Privacy Risks. Who would collect the massive data 
        bases of information created by such a mandate? Who has access 
        to all that new data? What might government use it for if they 
        get their hands on it?

        8. Offshore Sites. Could this new regime be applied effectively 
        to offshore sites? Or, will kids flock to offshore sites as a 
        result of such mandates on domestic sites? If some do, how will 
        we stop them?

        9. Credential Transferring. Even if the parental permission 
        verification process worked during initial enrollment, how 
        would it work in the ``subsequent visit'' stage? Once minors 
        are given credentials or digital tokens, how do we prevent them 
        from sharing or selling their credentials? In particular, how 
        do we prevent older siblings from sharing their credentials 
        with younger siblings? What would be the penalty for them doing 
        so? What about older minors with independent access to credit 
        cards?

        10. Law Enforcement Priorities. How many law enforcement or 
        regulatory agencies will be tasked with administering this 
        regulatory regime? Might this be diverting resources from 
        better priorities, such as serious law enforcement efforts and 
        online safety educational programs?

IX. Conclusion
    The future of age verification battles--at least on the social 
networking front--will likely be fundamentally tied up with COPPA and 
the question of how well parental consent-based forms of age 
verification might work on a scale larger than COPPA's very limited 
scale. It is unlikely, however, that such a framework could be easily 
applied on ``Internet scale.'' There is a world of difference between a 
site like Disney's Club Penguin, for example, and sites like MySpace or 
Facebook. This ultimately reflects the uniquely insular nature of the 
under-13 age bracket and the lack of any clear line between adolescent-
oriented and ``general audience'' content.
    Moreover, as social networking capabilities become increasingly 
ubiquitous, integrated into every site and service--from Change.gov 
\135\ to the San Francisco Chronicle (sfgate.com) to CNN.com, from 
Microsoft's Xbox Live service to Linden Labs' Second Life--the costs 
and hassles of compliance with COPPA 2.0 age verification mandates will 
increase dramatically. Are parents really going to be forced to 
authenticate themselves and then their kids for every website their 
kids want to participate in that requires so much as an e-mail address? 
That mandate seems unnecessary and unworkable. Are other adults going 
to have to prove they're not adolescents? By creating such a 
requirement, COPPA 2.0 would also constitute a functional convergence 
of COPPA with COPA--a law the courts have rejected as inconsistent with 
America's tradition of anonymous speech, something central to our 
evolution as a democracy, pre-dating even the First Amendment that 
protects it from government interference.
---------------------------------------------------------------------------
    \135\ Like many social networking sites, Change.gov allows users to 
comment on news items the IntenseDebate comment platform, which allows 
users to create profiles, upload profile photos, etc.
---------------------------------------------------------------------------
    Finally, the irony of COPPA 2.0 proposals is that lawmakers would 
be applying a law that was meant to protect the privacy and personal 
information of children to gather a great deal more information about 
them, their parents, and many other adults! These privacy implications 
should make us think twice about trying to expand COPPA beyond its 
primary purpose to encourage parental involvement in what kids do 
online. Even those who support COPPA in its current form should 
recognize that there are better ways to protect adolescents 
online.\136\
---------------------------------------------------------------------------
    \136\ See Parental Controls and Online Child Protection: A Survey 
of Tools and Methods, supra note 17.
---------------------------------------------------------------------------
Related PFF Publications
   Targeted Online Advertising: What's the Harm & Where Are We 
        Heading?, Berin Szoka & Adam Thierer, Progress on Point 16.2, 
        April 2009.

   Parental Controls & Online Child Protection: A Survey of 
        Tools and Methods, Adam Thierer, Special Report, Version 3.1, 
        Fall 2008.

   Social Networking and Age Verification: Many Hard Questions; 
        No Easy Solutions, Adam Thierer, Progress on Point 14.5, March 
        21, 2007.

   Social Networking Websites & Child Protection: Toward a 
        Rational Dialogue, Adam Thierer, Progress Snapshot 2.17, June 
        2006.

   Age Verification for Social Networking Sites: Is It 
        Possible? And Desirable?, Adam Thierer, Progress on Point 14.8, 
        March 23, 2007.

   Is MySpace the Government's Space?, Adam Thierer, Progress 
        Snapshot 2.16, June 2006.

   Rep. Bean's `SAFER Net Act': An Education-Based Approach to 
        Online Child Safety, Adam Thierer, Progress on Point 14.3, Feb. 
        22, 2007.

   Online Advertising & User Privacy: Principles to Guide the 
        Debate, Berin Szoka & Adam Thierer, Progress Snapshot 4.19, 
        Sept. 2008.

    The Progress & Freedom Foundation is a market-oriented think tank 
that studies the digital revolution and its implications for public 
policy. Its mission is to educate policymakers, opinion leaders and the 
public about issues associated with technological change, based on a 
philosophy of limited government, free markets and civil liberties. 
Established in 1993, PFF is a private, non-profit, non-partisan 
research organization supported by tax-deductible donations from 
corporations, foundations and individuals. The views expressed here are 
those of the authors, and do not necessarily represent the views of 
PFF, its Board of Directors, officers or staff.

    Senator Pryor. Thank you.
    I want to thank all the witnesses for their testimony.
    And we're going to start off with Senator Rockefeller.
    The Chairman. Thank you, Mr. Chairman.
    I have this odd feeling about this panel, except you and 
you and you. It's like we're discussing some kind of--Is a 
breakfast cereal good for you, or not? And children have 
somehow already disappeared from this process. And it comes 
down, I think--I mean, and the both of you--Microsoft, 
Facebook--had good things to say, but you always ended up with 
the idea, ``Well, we can--we'll do this by ourselves, and we 
really don't need the government telling us what to do.''
    And I have to leave, very shortly, because I have to give a 
speech on cybersecurity to a business group. Cybersecurity is 
the Nation's number-one national security threat, ahead of 9/
11s, dirty bombs, weapons of mass destruction, according to all 
analysis. The private companies--this is very parallel to me--
they always said, at the beginning, ``We''--Olympia Snowe and I 
have been working on this for 2 years--``We can do this 
ourselves. We don't want government to be involved with this.'' 
We knew that couldn't happen, because we knew that they didn't 
have, really, any idea what they were doing about how to take 
on cybersecurity. Some of the larger companies did, to a 
certain extent, but, for the most part, they didn't.
    That's like parents. We want parents to make these 
judgments, and which is a little bit like saying that some 
people here don't know how average American families have to 
live, where people are trying to keep down two jobs, and they, 
themselves, may not be skilled on the Internet, and in any 
event, they're tired, they have things to do. And so, we've got 
to do this for the parents. And so, ``Well, let's not let FTC 
do this, let the Congress do that.''
    Well, maybe that was your idea, because you thought the 
Congress wouldn't be able to pass it. I thought your testimony 
was particularly unhelpful, to be honest with you. I thought 
both of your testimonies were terrific, because you were 
focused on the problem.
    And, Mr. Rotenberg, or Dr. Montgomery--either one--we 
haven't, here, discussed, really, what the problem is. And the 
problem is, kids are watching filth. They're watching filth, 
and lascivious, horrible things, and we're trying to argue 
about 13, when, as you say, it should be 18 or 22, or whatever. 
And the companies, here, are in favor of cleaning this up, but 
not at the expense of being regulated. They want to do it 
themselves. They'd appreciate working with the FTC a little 
bit, but the clear message is, they want to do it themselves.
    My clear message is, I don't really think they do. I think 
money trumps on this. Money always trumps when it comes to 
information. Money always trumps. This committee has come up 
with so many scam hearings in the last year or so. Money drives 
bad behavior, and then kids, or people, or whoever, or Internet 
users and popup--you know, all of these things are just left to 
the side.
    So, I'd like you to describe, What damage do you think is 
being done to children by the inaction? And, you know, I agree 
with you some--agree with the FTC; they're not heavily staffed, 
they're not well funded. We need to change that. We're trying 
to protect them from being wiped out altogether under this 
financial services thing. And I think we have. I think we have 
done that. But, what is the damage that you see being done to a 
generation of kids coming up, with parents who are purportedly 
hovering over, watching every move they make, when you know 
perfectly well they're not?
    Mr. Rotenberg. Senator, I think the primary problem is that 
young people are being coaxed to reveal a great deal of 
intimate information. And the data is gathered and collected 
and disclosed to strangers, for any purpose that generates 
commercial value. And, as a parent of two teenagers, I have a 
problem with that. I think technology is great, and I want, you 
know, my kids to grow up and to be technologically literate and 
to make smart decisions online. Because I can't always be 
there, they need to have the tools and the experience to make 
those decisions for themselves. But, I know that there's a 
point where, if I can't help them and they can't figure it out, 
if the business practices are designed to conceal from them 
what's really going on. And that's why I think the Congress 
needs to act. I think the Congress needs to give kids the 
ability to control how the information about them is being used 
by others.
    The Chairman. My time is up. Do you have----
    Dr. Montgomery. Senator----
    The Chairman.--one brief comment?
    Dr. Montgomery. Yes. I mean, I would agree with Marc. We 
have created--industry has created a system of ongoing 
monitoring and surveillance of teenagers, encouraging them. And 
it taps into their natural developmental needs to reach out to 
their peers and to become independent, encouraging them to give 
out a lot of information, and tracking everything they do, 
without their knowledge. It's also socializing them into a 
system where privacy is not valued. And I think that's a very 
deep loss to our society.
    And then, finally, I do want to respond to what Mr. Szoka 
said about advertising. We're not talking about traditional 
advertising, here, by the way. We're talking about viral 
advertising and branded environments and interactive games and 
Avatars and a whole lot of things that are not what you 
traditionally think about as advertising.
    And recent research has found that teenagers can be quite 
susceptible to this advertising; they're not necessarily aware 
of all of this, and we know they don't know what's being done 
behind the scenes.
    The Chairman. I thank you both very much.
    I thank you, Mr. Chairman.
    Senator Pryor. Thank you, Mr.----
    Mr. Hintze. Senator Rockefeller, could I make one brief 
comment, please?
    The Chairman. Sure.
    Mr. Hintze. I just want to--I apologize if I gave the 
impression that Microsoft does not want government involvement, 
that we want to do this on our own. That's certainly not the 
case. We have been supportive, for a long time, of a 
multifaceted approach to protecting privacy online, not just 
for kids, but for all consumers, including our support for 
comprehensive Federal privacy legislation, which we think is 
essential.
    But, self-regulation certainly plays a role. Industry best 
practices certainly play a role. But, education, law, 
regulation, and enforcement also play a role, as well, and 
we're very supportive of all of that.
    The Chairman. I hear you.
    Senator Pryor. Thank you, Mr. Chairman.
    Senator Wicker.
    Senator Wicker. Well, thank you very much. And this is a 
very, very serious topic, with implications for the next 
generation. I appreciate the Chair's willingness to get into 
the weeds on this.
    I do think that the testimony of all of our panelists has 
been helpful. I think it's important that we hear a variety of 
viewpoints, and all sides to this. And I do think that there's 
a way to--there must be a way to have it both ways, to 
encourage innovation and to protect the privacy of children's 
information at the same time.
    So, I'll ask the panel, What do they think about what I 
just said? Has the law reduced innovation and caused 
consolidation among children's websites? Have we created a 
barrier to entry into the children's website market? Has the 
law resulted in limitations on beneficial content specifically 
for children?
    So, if we could just start with Ms. Rich and go down the 
panel, that'll be my question.
    Ms. Rich. That's obviously--Tim keeps helping me with the 
button, here--that's obviously one of the key issues that we're 
going to look at in our review, especially since that was one 
of the goals of COPPA, is to preserve that access, even as kids 
were protected. We did review that issue that last time we 
reviewed COPPA, which was 2005, and we published a report. We 
sent a report to Congress, and we said, at that time, all of 
the commenters and all of the people we spoke to and the 
research we conducted indicated it had not, that children were 
being protected, and they still had access, and innovation was 
not being stifled. But, we are very interested in the answers 
to those questions today.
    Mr. Sparapani. Senator, speaking only for Facebook, I can 
say that I have seen a strange disincentive because of the law. 
My whole testimony was focused on trying to identify all of the 
innovative things that Facebook has done for the teenaged users 
of our site. But, what you didn't hear me saying was that we're 
not spending a lot of energy on the under-13 set, because 
they're typically not on our site. But, there's a line that's 
drawn between the 13-and-over and the 13-and-under, and I think 
that that line has created a disincentive for companies to work 
toward innovating on the 13-and-under side. And I think that we 
need to look at that. And I think that's the point I was trying 
to make in my testimony, Senator.
    Mr. Hintze. I look forward to seeing what comes out of the 
FTC's current rule review. I can speak for our own company, 
that, yes, some of the parental consent mechanisms required 
under COPPA can be challenging, and sometimes frustrating to 
implement. But, I think that, for the most part, it has not 
discouraged us from continuing to provide services to general 
audiences, including young children and some specifically 
tailored to children, as well. It does create additional work 
and additional cost. It's a barrier to entry, in some cases, 
because anytime you're designing a sign-up process where 
there's a speed bump or even in some cases a significant 
barrier in having to involve the parent--yes, some consumers 
will go away and go elsewhere. But, we think it's in the--for 
the most part, the right thing to do. Involving the parent is 
the right thing to do. Creating those speed bumps so that you 
can inform children about the appropriate use of these 
services, and help educate their parents, is the right thing to 
do.
    So, I would say, on the whole, COPPA has been successful in 
encouraging websites to do the right thing, even though there 
is a cost involved.
    Dr. Montgomery. One of the goals of the law was to minimize 
this massive data collection that was really becoming state-of-
the-art in the early days of the dot-com boom and e-commerce. 
And I'm telling you, that is where the business was headed. So, 
what we were able to do--and, again, I repeat that we were 
worked with industry to come up with a set of principles that 
would honor the privacy rights of young people, but, at the 
same time, not interfere with the healthy development of e-
commerce.
    But, if you're going to market to kids, what we were able 
to establish is, there need to be some operating principles, 
here. And I think the industry has done a very good job of 
working that out. It was not easy to sit around the room and 
try to figure out, ``OK, how do we do this?'' You know, the 
parental verification mechanism was a tricky one, not easy to 
do. But, the idea was, first, enable the parents to know what 
their children are doing, and, second, make the industry aware 
that they have a responsibility, when they are collecting 
personal information from children.
    We've seen a growth--a healthy growth of lots of wonderful 
websites for kids, lots of terrific content areas. And I think 
that has been a very, very good development, and I'm happy 
about it.
    As I said, I think the 13 is not--kids don't become 
automatically mature at 13, as any parent can tell you. But, at 
that time, we decided, ``Let's create this clear mark, here, 
for where we will have these guidelines.'' And now, I think 
we've seen a whole new development, with the web, that raises 
the issue about how--``OK, now what do we do about teens?'' 
Again, not the same model, but, What can we do to ensure that 
they're treated fairly in this digital marketplace?
    Mr. Rotenberg. Thank you.
    Senator I just want to say, I very much appreciate your 
question about the relationship between innovation and privacy. 
And I suspect we're going to hear a lot more about this.
    But, if I could say, directly, sir, I think the 
relationship is not generally well understood. I don't see this 
as a tradeoff. My wife is a public schoolteacher. When we talk 
about innovation in the technology field and privacy, we think 
in terms of the privacy safeguards that enable children to take 
advantage of new technology. In other words, in the absence of 
privacy protection, I think you actually diminish the 
opportunity for technical literacy and training and education 
that parents and educators would like to see happen.
    The real innovation that people are talking about, which is 
what they're not saying explicitly, is on the marketing side. 
They don't like the privacy rules, because they don't want to 
do the types of behavioral targeting, brand-based targeting, 
you know, ``get your child to friend an advertising figure'' 
targeting. That's the innovation they have in mind, and that's 
why they object to the privacy rules.
    But, if we take a step back and talk about technical 
literacy, bringing more children to the online environment, 
creating great products and services so that they get excited 
about new technology, privacy actually plays a very big part in 
helping to make that happen.
    Senator Wicker. Before we move to Mr. Szoka, let me follow 
up, Mr. Rotenberg. You mentioned that you have children. I take 
it that they are teenage?
    Mr. Rotenberg. Yes, sir.
    Senator Wicker. Do you mind telling us how old they are?
    Mr. Rotenberg. Fifteen and sixteen.
    Senator Wicker. OK. And I dare say that, in terms of 
knowledge about the protections that children need, you're 
probably in percentile 99.9----
    Mr. Rotenberg. Right.
    Senator Wicker.--nationwide. That being the case, what do 
you need the government to do for your above-age-13 children, 
that it's not doing now?
    Mr. Rotenberg. I need the government----
    Senator Wicker. Because you're a good parent.
    Mr. Rotenberg. Yes. Well, I appreciate that, sir. But, I 
need government to step in to control the things we can't 
control. In other words, if we sit down with our children and 
go through the privacy settings and say, ``This makes sense,'' 
or, ``This doesn't make sense,'' or, ``That's really your 
call,'' and that's how we understand privacy protection, and 
then, the next week, the company says, ``We've got a whole new 
approach now. We're going to do something different,'' and 
we're left with a sense that the tools that the company 
provided us to try to safeguard our privacy and the privacy of 
our children have basically become meaningless.
    So, I--I'm not saying that parents don't play an important 
role. I think parents do. But, I'm saying it can't be made so 
difficult. And the businesses can't hide the way they collect 
and use data, as they do, because there's nothing that the 
user--the parent can do to change that. That's completely on 
the business side, and it's done because there is no 
regulation. There's nothing that prevents them from saying, to 
all the teenagers who they have data on right now, ``You know, 
we've got a great idea, and we want to just go ahead and do 
this,'' or not tell them and go ahead and do it. Parents can't 
control that.
    Senator Wicker. Thank you.
    Mr. Szoka, you can respond to that, but also to the 
question about innovation versus privacy.
    Mr. Szoka. Well, thank you, Senator.
    Let me be clear about three points.
    First, there are always tradeoffs involved in regulation. 
And here, the tradeoff is not simply a question of economics 
versus privacy, but, indeed, the tradeoff involves free speech. 
And again, I stress that that's because ``collection,'' as the 
term is used in COPPA, does not just apply to collection, as we 
mean it in the colloquial sense, such as is used for 
advertising or marketing purposes. But, under the statute, it's 
any sharing of information. It is the enabling of sharing of 
user-generated content.
    So, when I talk, here, about the tradeoffs, I want to be 
very clear, I am talking about the ability of users to join 
tools, and the innovation in those tools that allow them to 
share and communicate and collaborate. And that's--this has 
been the flourishing of the Web 2.0. And that is exactly what 
is at stake here if COPPA were to be expanded in its age scope.
    So, my second point is, I wanted to emphasize that I think 
one of the beauties of COPPA is that it gives the FTC great 
flexibility in shaping the rule within the confines given to it 
by Congress. So, the FTC has the flexibility to update the 
definitions of ``personal information'' and ``Internet,'' and I 
encourage it to do so.
    My caution, however, was that we ought to be very, very 
careful about having Congress reopen the door to the one thing 
that the FTC cannot, on its own, change, which is the age 
scope. And I mentioned the financial reform legislation only 
because that could, indeed, give a future FTC the ability to 
change things like the age scope, which, again, presents an 
important tradeoff, in terms of free speech.
    My final point is, there is a rich mosaic of parental 
control tools and software and methods available today. My 
colleague, Adam Thierer, at the Progress & Freedom Foundation, 
has published a comprehensive compendium of those tools. And 
again and again, in the context of filth, as Senator 
Rockefeller referred to, wanting to prevent or censor kids from 
accessing, the courts have repeatedly said that those tools 
need not be perfect, but the government regulation must yield 
to the tools, where they exist. And so, our point has been to 
highlight that these tools exist, and that we should be 
encouraging innovation, not just in the sharing of information, 
but also innovation in the controls that are available to 
parents, as well as all users, to take, really, control over 
their own information and how it's shared.
    And so, our answer, in a nutshell, is that the solution to 
all these concerns should, first and foremost, be enforcement 
of the existing law, which applies to, again, children under 
13, and then also education and empowerment. And government has 
a role to play, a very important one--and the FTC does this 
extremely well--in highlighting those tools, methods, and 
education. And I encourage it to do so, but, again, caution 
against changing the statute, itself.
    Senator Wicker. Thank you.
    Senator Pryor. Thank you, Senator Wicker. Thank you for 
being here. And I know you have to slip out to another meeting, 
but thank you for your leadership. And we will leave the record 
open for a few days for Senators to submit their questions, if 
they want to.
    Let me, again, thank all of our witnesses, but I want to 
thank Facebook and Microsoft for being here, because I know not 
everyone in the industry chose to come today. But, let me 
start, if I can, with a question for Facebook.
    In your written testimony, you talk about ``Facebook's 
culture of authentic identity.'' Could you elaborate on that a 
little bit?
    Mr. Sparapani. Yes, Senator, and I'm glad that you asked.
    One of the really interesting things that happened when 
Facebook was first launched is, we defied conventional wisdom 
at the time about privacy and security. We decided that, at the 
beginning, we were going to ask people to put their real names 
and build their entire profile around that. And I have to tell 
you, it has been the--really, the wellspring of a number of 
advantageous security and privacy benefits for users of all 
ages of our site.
    Again, it was unconventional at the time, but what is meant 
is that we're able to really deter bad behavior; we're able to 
identify fake accounts quickly; we're able to target corrective 
action at an explicit account; and, more importantly, there's 
this community effect that takes place, where individuals feel 
some sort of reprobation when they take an action which is tied 
to their name. It tends to discourage bad speech, bullying, bad 
behavior, et cetera. And so, we've really been the beneficiary 
of this decision of, what we refer to as, a real-name culture.
    Senator Pryor. That's good.
    And you also mentioned in your testimony that you didn't 
want to see any changes to COPPA.
    Mr. Sparapani. We're not really needing changes at this 
point, because we feel we've done, really, a very good job of 
implementing the statute----
    Senator Pryor. Let me interrupt, right there.
    Mr. Sparapani. Please.
    Senator Pryor. You're saying that's true for your company.
    Mr. Sparapani. It is.
    Senator Pryor. Are you saying that's true industrywide? I 
mean, is everybody a good actor out there?
    Mr. Sparapani. No, of course not. And, you know, there 
certainly are companies which are outliers, there always will 
be. And that's, frankly, why we need stepped-up FTC 
enforcement, to find those bad actors and take action.
    Senator Pryor. So, your view is, leave the statute as is, 
but beef up the enforcement?
    Mr. Sparapani. Yes, I think that's the right approach, 
Senator. I think the FTC folks do a generally good job, and 
they would do better if they had more resources.
    It's really easy to focus on the Microsofts and the 
Facebooks, the Googles, and the Apples, because we're here, and 
we can show up and testify. It's the companies that don't have 
people here in Washington, that don't have lawyers on staff, 
that probably deserve the lion's share of attention; they don't 
get it, because the press can't focus on them, and they can't 
be found.
    Senator Pryor. Tell me why you like the age 13, and why you 
think that shouldn't change.
    Mr. Sparapani. Well----
    Senator Pryor. My, just general inclination would be, 
``Hey, this is a children's issue, you should make it, 18 and 
under,'' or, something like that, move it up a few years. But, 
tell me why you like 13.
    Mr. Sparapani. Well, first of all, Senator, my expertise is 
in privacy, and it's not really in child psychology or social 
development. So, I can only speak from this perspective. We 
have found that teenaged users have really had a, really, very 
successful experience on Facebook. They're socialized well, 
they learn good rules of behavior, they are able to actually 
advance themselves and learn about the world around them.
    So, what--I would not want to see us deny teenagers the 
opportunities of living in a digital society. I think it would 
hamper kids around our country, and set them back, vis-a-vis 
children of the same age in other countries, if we were able--
if we were to prevent them from having access to these sites or 
services.
    Senator Pryor. OK.
    I think--Dr. Montgomery, did you have a comment on that?
    Dr. Montgomery. Yes. And I would agree that social 
networks, and the Internet in general, are terrific tools for 
young people. I'm also the mother of a teenager, and I can see 
what a great role these new digital technologies are playing in 
her life, and they really do tap into the key developmental 
tasks of adolescence, when adolescents are exploring their 
identities and they're trying to reach out to their peers and 
really separate from their parents, which is something that 
they need to do, and be more autonomous. So, I can really see 
that. And a number of my colleagues have done terrific research 
that documents all of that; I think that's great.
    And I--but, I think the problem is that teens are out there 
in very public and very transparent--in many ways that 
sometimes alarms parents, on these social networks. But, the 
business practices of data collection and surveillance that's 
taking place on Facebook and other social networks is not 
transparent. It is really a black box, in many ways.
    And I would not be talking about restricting teens from 
having access to these platforms. I think we need to give them 
that access; they're very important. But, I--what I would be 
calling for, and what I do call for, is for the government to 
play a role in ensuring that all of these social networks, and 
all of the platforms, mobile and otherwise, that young people 
are engaged in, are operating by a set of rules. These rules 
can be crafted in a way that will balance free speech, that 
will balance business and innovation.
    When we started talking about COPPA, a lot of people said, 
``Well, we'll never be able to do this, this is impossible.'' 
We were able to work it out. And again, not the model that we 
have for COPPA, not the model of parental verification and 
restricting access, but a separate set of principles that I 
think we could work out together that would apply to teenagers.
    Senator Pryor. Let me ask you, Dr. Montgomery, are there a 
set of principles that exist right now? Is there a model rule 
out there that we could apply here? Or do we have to start this 
from scratch?
    Dr. Montgomery. Well, I think at the very least, the--some 
of the international principles--OECD principles, for example, 
that Marc can talk to about data minimization and transparency 
and other things that we would expect--you know, I don't see a 
model out there, as yet. I think we're inventing some of these 
things, as we did with COPPA, but I think this is the right 
moment to do so.
    Senator Pryor. And while I'm on you, Dr. Montgomery, should 
we leave age 13 as is, or should we change it?
    Dr. Montgomery. I think COPPA operates well as it is. I'm 
not necessarily talking about revisiting the actual 
legislation, but I do think we ought to think about what 
protections we could provide for teens. And again, I think we 
need to be careful about the model that we create, that I don't 
want to see teens totally ignored.
    Senator Pryor. OK, Mr. Sparapani, let me ask you, you all 
apparently have a ``report'' button. And how often is that 
used? I mean, do you track that? What are the numbers on that?
    Mr. Sparapani. Well, Senator, I don't have the numbers, 
here, immediately in front of me. But, I have to tell you, it's 
enough to keep a huge team of employees busy, all day, day and 
night, from around the world. When you have 400 million users, 
which we do, and they're trained, because they've become 
comfortable with self-reporting, what they consider to be 
inappropriate behavior by others on the site, it does produce a 
large quantum of reports.
    And, of course, we triage those. We take the ones that 
might have a law enforcement component, we put those at the top 
of the list, in terms of responding. We put the ones that 
concern potential threats to life and limb--and it only happens 
rarely--but, we put those, and we prioritize those. And so, 
these other reports about other malicious behavior or 
inappropriate speech drop down a certain notch.
    Senator Pryor. And does your company have policies that go 
beyond COPPA? I mean, it sounds like you all have a set of 
policies that really go beyond the law.
    Mr. Sparapani. Well, I guess the one place where I would 
suggest this is in--with respect to our marketing practices. I 
want to distinguish Facebook from virtually all other companies 
I know, and from some of the generalized discussion that has 
been happening about marketing to teenagers.
    With respect to marketing to teenagers, Facebook never, 
ever shares information with the advertiser about individual 
users; doesn't matter the age of the user. What we do is, when 
we get a request to advertise on our site by a company, we 
offer the ad, but we never share the actual personal 
identifiable information with that advertising company. And I 
think it's important that people recognize----
    Senator Pryor. You give them aggregate information about 
your users, but not specific information?
    Mr. Sparapani. That's exactly right. I think it's an 
important protection. And I think it has really helped our 
company succeed. And I hope other companies will follow our 
lead on that.
    Senator Pryor. Mr. Hintze, let me ask you, I know that 
Microsoft, through, you know, your various software products, 
offers a lot of parental controls. Do you know what percentage 
of your users actually utilize the parental controls? Do you 
have a sense of--even a kind of rough percentage of what that 
might be?
    Mr. Hintze. Yes, I don't have the actual numbers with me, 
and I think it probably depends on the service itself.
    Things like Xbox Live, for example, the parental controls 
are really built in as part of the account creation process. 
So, when a parent buys an Xbox and signs up for an Xbox Live 
subscription, part of that transaction of creating secondary 
accounts for their children put those parental-controls choices 
in front of the user. So, it's quite a high percentage of users 
who are children, where their parents are utilizing those 
controls to some level. And there are all kinds of different 
knobs and dials in there; and how deep the parents go probably 
depends on the parent. But, a large percentage of users are 
using that.
    Other services, you know, we've got this Windows Live 
Family Safety, which is a free download for people to use to 
help control how kids are surfing the Net and using search 
services.
    You know, there's a challenge of educating parents and 
making them aware of these tools, and it's something that we 
try to do, but it's always hard to reach those parents. One of 
the reasons why we have implemented parental consent processes, 
even in cases where we think COPPA doesn't explicitly require 
it because it's a general audience site, for example, we think 
that's an opportunity to provide that kind of education to 
parents, to get some of these tools and information in front of 
them.
    So, it really depends across the service, I think.
    Senator Pryor. Let me ask about your--you call it Windows 
Live Family Safety?
    Mr. Hintze. Yes.
    Senator Pryor. Let me ask about that product. That's free?
    Mr. Hintze. Yes, it is.
    Senator Pryor. And how do parents find out about that?
    Mr. Hintze. We provide messaging in a variety of different 
ways. We have worked with a number of organizations--children's 
organizations--to provide information through those, the Boys 
and Girls Clubs and other organizations like that. We've 
provided information through our own sites; we've got dedicated 
Web pages around privacy and children's safety on our websites 
to provide information to parents. So, there are a variety of 
means about how we try to get, sort of, the word out on these 
different tools that are available to parents, get them 
educated about the risks of children online and the risks that 
those children face and the tools available to them, to help 
protect them.
    Senator Pryor. Yes, I think it would be helpful for 
parents--and you may already be doing this, I'm just not aware 
of it with this product--but, I think it would be helpful for 
parents if you guys could take the offensive and aggressively, 
periodically, from time to time, whatever's appropriate, offer 
almost like a parent's toolkit on how to stay safe online.
    And there are a lot of aspects of that. I mean, there's 
identity theft; there are a lot of fraud issues; there are just 
privacy issues with kids or with--I mean, you know, just really 
kind of runs of the gamut. And does Microsoft offer that, kind 
of in one place, these kind of, you know, semi-regular 
reminders that these tools are available, and, ``You need to 
update your settings,'' et cetera, et cetera? Do you all do 
that, or is that not----
    Mr. Hintze. We do have----
    Senator Pryor.--proper etiquette----
    Mr. Hintze. Yes.
    Senator Pryor.--you know, in your company?
    Mr. Hintze. We do have the equivalent of tool kits 
available. We've got a website that has a list of resources 
available to parents, and information available to them, to 
help educate themselves and their children about the risks 
online. Again, the challenge is making them aware of that. 
And----
    Senator Pryor. Yes.
    Mr. Hintze.--and there are certainly things that we have 
done in the past, sort of, quasi-marketing campaigns to 
parents, to try to get that information in front of them. And 
there's obviously more we can do in the future.
    Senator Pryor. Yes, I'm not a--personally, I'm not a huge 
Internet user. I mean, I use it probably every day, but not 
extensively every day, and usually not very extensively at all, 
but, you know, I wasn't aware of that. So, if I'm kind of like 
Average John Q. Parent, here, I didn't know that was out there. 
So, I would hope that Microsoft and other companies would think 
about ways to be a little more aggressive in letting people 
know.
    Let me go ahead and ask Mr. Szoka about the age 13. You 
want to keep 13 where it is?
    Mr. Szoka. Senator, yes, I think you've asked the most 
important question of the day. The point that I've tried to 
raise is--this is perhaps the least well understood aspect of 
COPPA. And the point, here, is not necessarily just to deal 
with child psychology, although 13 does happen to be the age at 
which Jewish kids are Bat Mitzvahed, the Confirmation is given 
in the Catholic Church. Romeo and Juliet were 13. There are 
reasons why 13, historically, has been an age of transition 
and, indeed, was chosen by Congress.
    But, the point that we've tried to stress in our work at 
PFF has been that the far more important reason for keeping it 
at 13 is that, when you raise that age above 13, the COPPA 
framework breaks down. Because, again, as I said, COPPA 
basically applies, in two ways: It applies to sites that are 
required to presume that all of their users might be a child, 
and then again where sites have actual knowledge. And so, if 
you were to set that at 18, for example, you would end up in a 
situation where sites that were--that might be considered 
directed at adolescents, or might be afraid that the FTC would 
find them to be so, are sites that differ profoundly from sites 
that are, today, like Club Penguin, really, truly directed only 
at kids under 13. And the difference is, adults use those sites 
that teens use, as well.
    And so, as a practical matter, if you extended the COPPA 
framework to a higher age, you would, for the first time, have 
the government be requiring age verification of large numbers 
of adult users. And we've already been down that road before. 
The courts have very clearly held, in the litigation about the 
Child Online Protection Act, or COPA, that to do so would be 
unconstitutional because it would infringe on the free speech 
rights of users to access content without having to identify 
themselves, such as through use of a credit card, but also the 
free speech rights of the sites themselves, to reach an 
audience, which is diminished by the roadblock of age 
verification.
    So, I want to be clear that, from my perspective, this is 
the most important issue that we've talked about here today, 
understanding why that age for COPPA must be kept at 13 for the 
framework of the--of what I think is a really great statute, 
otherwise, to function effectively.
    Senator Pryor. Thank you.
    Mr. Rotenberg, do you agree that COPPA breaks down if you 
change the 13-year-old threshold?
    Mr. Rotenberg. Yes, I've been sitting here, listening to 
Mr. Szoka's comments, and I'm just very confused. I actually 
helped litigate against the COPA, which was the Act that raised 
the First Amendment concerns. And on that side, he and I are 
actually on the same page.
    But, it is almost completely unrelated to the discussion 
we're having about age verification and COPPA. As Mr. Sparapani 
explained, every person of any age who wants a Facebook account 
has to, in the first instance, provide information about their 
actual date of birth; that's how they make the determination 
whether someone's above 13 or below 13. And presumably, they 
could do the exact same line drawing exercise at age 18. So, 
this argument actually doesn't make any sense to me.
    But, what I--what Mr. Sparapani said, which I think is 
something that needs to be considered more carefully--and I 
understand where he's coming from--he said, basically, Facebook 
made a decision, for children under 13, ``We just don't want to 
have them as users.'' In other words, ``It's too complicated; 
and because of the COPPA obligations, we're just going to say, 
you know, `Wait a few years,' basically.'' And he suggested, in 
his answer, that if Congress were to extend the line to 18, 
perhaps they would make the same decision now for kids between 
the ages of 13 and 18, which is obviously not what we're 
suggesting. We're not saying that teenagers shouldn't be on 
social network services. We're saying that companies that 
provide social network services to teenagers should have some 
legal restrictions on the collection and use of data about 
those children. And I think that can be done without too much 
difficulty. It would probably be based on COPPA; you probably 
want to make some changes.
    But, that's the main legislative recommendation I would 
make: create some legal protections for teenagers. Don't 
discourage them; I agree with others, it's a good service. But, 
as it is right now, it's not providing adequate protection.
    Senator Pryor. Let me ask about age verification. I know 
some companies may differ with me on this, but my impression is 
that there's really not a way that exists, yet, to truly get 
rock-solid age verification. And filling in your birthday--
obviously, kids can just put in a different date and, you know, 
they may be off to the races. So, am I wrong on that? Is--that 
there's not a really good, solid way to do age verification 
yet? Or, tell me--tell me what--the state-of-the-art right now.
    Mr. Rotenberg. Well, it has always been a challenge. And I 
think you're exactly right to say that there is no, you know, 
rock-solid way to do it. There are a number of different 
techniques. Facebook itself, I think, has developed some pretty 
good systems to do age verification. I think they probably get 
it right at a very high level, which is to say, I would be very 
surprised if there were a large number of accounts for kids 
under 13. There may be some out there; I suspect that's true. 
But, I don't think it's a very large number.
    And I think a similar, you know, effort to move the age 
line to 18, there will probably be some people who get, you 
know, in under. But, I don't think that's a reason not to do 
it. And I think it would be a mistake, actually, to say, 
``Well, because we can't get it, you know, 100 percent, we 
should just give up.''
    Senator Pryor. Right.
    Mr. Szoka.
    Mr. Szoka. Senator, if I may respond, you are exactly right 
that there is no perfect method of age verification. But, there 
is another important distinction we have to understand, here. 
And it's as simple as the fact that when you sign up for a 
site, like Facebook, today you are indeed, as Marc has 
mentioned, required to provide your age. But, you can, indeed, 
Senator, as you have mentioned, simply lie. And the critical 
difference here is, that as it--as these sites function today, 
sites like Facebook and the many other sites--because this is 
not just about Facebook, but indeed about every site that 
potentially allows sharing and posting of comments, such as the 
blog that I run, for example--that when you sign up for those 
sites, you are not required to verify your age through the use 
of a credit card. This is the key issue.
    My point here is that, if we were to move to a world where 
COPPA applied to children under 18, you would have large 
numbers of sites that enable the sharing of--by users, of 
information about themselves--so-called user-generated 
content--to have to actually age-verify. And that's a 
fundamental difference from the current regime in which sites 
simply ask for age, and if you admit that you're under a 
certain age, they block you, as they're required to do. And 
it's at that point that you start to run into precisely the 
same constitutional issues as were raised in COPA. Because 
COPA, in a nutshell, required certain sites to assume, again, 
that all their users might be children, and therefore require 
all users to verify themselves with a credit card, or similar 
tool.
    Senator Pryor. Dr. Montgomery, let me ask you about the 
state of academia on this. And that is, Are there studies out 
there, where people have really analyzed, maybe the child 
psychology or, how the industry really operates? I mean, is 
there a body of academic work on this that the Subcommittee can 
look at to, you know, get some insights on how things really 
work out there?
    Dr. Montgomery. Well, there's a growing body of research 
about how young people are interacting with online social 
networks and other digital media; the MacArthur Foundation has 
funded a good deal of work in that area. None of it, I have to 
say, has really taken into account, or looked at, the 
commercial dimensions of the digital media.
    Senator Pryor. And privacy doesn't----
    Dr. Montgomery. Or the privacy.
    Senator Pryor. Yes.
    Dr. Montgomery. Now, there are some studies emerging on 
privacy, but they're not looking at the whole picture of 
digital marketing.
    I will say, also, that the experts in the food marketing 
area--and I'm working very closely with a number of them--
because of the concerns about childhood obesity and the role of 
food marketing in that crisis, have begun to pay more attention 
to the digital marketplace. And I've been doing a lot of 
research in that area and am working with experts who are 
looking at adolescent development and the role of adolescents 
in the digital marketplace, because they're very much at risk 
for childhood obesity, and they're not necessarily in a 
position to be asking their parents about their decisions about 
food.
    And we know that many of those food marketers are using 
behavioral targeting and behavioral profiling to target, in 
interactive games and in other kinds of online settings, 
precisely those kids who may be most vulnerable to that kind of 
marketing.
    So, we are working with a number of people to conduct more 
research in that area. I'd be happy to supply the Committee 
with some of that research.
    Senator Pryor. Yes, I'd like to see that.
    And so, when you're talking about, say, fast-food 
marketing, give me a scenario where that works. It sounds like, 
to me, that some kid may be walking down the street, and 
there's a fast-food restaurant, and he may get a message on his 
or her phone that they should go in there, they get a coupon or 
something. I mean, tell me how that works.
    Dr. Montgomery. That is where location marketing is going. 
And that is--you know, first of all, you know who the 
individual consumer is. And as we're finding, you know, it 
isn't always necessary to even know the name. You simply know--
need to know who that person is who is using that particular 
mobile phone, and, you know, what the age is, and the other 
demographic characteristics, as well as the behavioral 
characteristics--what kinds of sites they go to, and masses of 
amount of data that are being pulled together by various 
tracking technologies.
    And, yes, the idea--and we've seen some trials with this, 
with some of the fast-food companies--would be, you know, that 
you're--when you're near that restaurant, you would get a 
coupon that could say, you know, ``You can get a discount for 
this particular kind of product.''
    We're also looking at interactive games and the kinds of 
behavioral profiling and targeting that's going on there. So, 
let's say you're a pizza lover, you're also addicted to 
interactive games, and interactive games online can then target 
you when you're most, you know, aroused by the game and offer 
you pizza, and even provide you with direct access to an online 
site to order that pizza. And we know of--also, that we're 
looking--a lot of apps on phones--I have an iPhone--that enable 
you to order things right away. So, it's this kind of impulse 
buying. All of that is tied into behavioral targeting.
    Senator Pryor. And so, let me ask a follow-up there. You 
mentioned the iPhone, which is an Apple product; so you have 
the manufacturer of the phone, but you also--what about the 
wireless companies? The cell phone companies themselves, the 
AT&Ts and Verizons of the world? Are they providing this type 
of information to marketers? I mean, are they giving age and 
things like that? Do we know that?
    Dr. Montgomery. It's my----
    Senator Pryor. Has anybody looked at that, that we know of?
    Dr. Montgomery. Yes, I mean, Marc, you may be able to 
answer that better, but they fall under a certain set of 
policies----
    Senator Pryor. Right.
    Dr. Montgomery.--you know, that are--that apply to those 
companies, that are----
    Senator Pryor. Right.
    Dr. Montgomery.--separate from what some of the online 
companies would.
    Do you want to answer that one?
    Senator Pryor. Do you know?
    Mr. Rotenberg. We're not specifically aware of how the 
telephone companies collect the data on customers. But, there 
was a very interesting proposal to do a so-called ``deep packet 
inspection'' by Internet service providers which would actually 
reach much more deeply into the personal activity of people 
online, literally looking at all the e-mail traffic they were 
sending, and trying to take, you know, pointers to commercial 
activity out of that.
    I do want to make, just on this point, one further comment. 
I think Mr. Sparapani was correct when he said, earlier, that 
Facebook doesn't disclose user data to advertisers. That's 
right. But, Facebook does disclose user data to application 
developers so that when a Facebook user installs a Facebook 
app--you know, favorite cities or snowball fight, or whatever 
it is--Facebook, at that point, is making a decision to send a 
lot of the user's social graph over to that company. And what 
they announced, just recently, is to do something very similar 
with third-party websites, like CNN and Pandora.
    So, it's not the whole story, I think, at least in this 
situation, to say, in terms of Facebook, that the data doesn't 
go to advertisers. There are other ways that the data is 
released.
    Senator Pryor. Thank you.
    And, Ms. Rich, I haven't forgotten about you.
    Ms. Rich. I'm listening, here.
    [Laughter.]
    Senator Pryor. Let me ask you a few questions. First, did 
you have any follow-ups on any of this that you heard that you 
wanted to clarify?
    Ms. Rich. Well, I do have one follow-up from something Marc 
Rotenberg said, in his first statement, which is, I agree 
whole-heartedly that enforcement by the FTC, both of COPPA and 
generally in privacy, is very important. And we are very proud 
of our enforcement record. Just in the last year, or even 6 
months, we brought four data-security cases, which puts us at 
close to 30 data-security cases that we've brought. We've 
issued an Online Behavioral Advertising Report, and done at 
least one case involving deceptive tracking. We've done eight 
cases designed to promote the integrity of self-regulation. And 
I could go on and provide the--provide you, Mr. Chairman, with 
more. But, I did want to comment on that.
    Senator Pryor. Yes.
    In your statement, you said--let me--I think I have this 
right--whether the rule's definitions of ``Internet'' 
adequately encompasses certain technologies, like mobile 
communications. I don't know if you remember that. And is the 
FTC looking at what we even mean by ``Internet'' today, and--
the definition of ``Internet'' and ``mobile technology''? I 
mean, are you reevaluating all of that, in light of the 
technological innovations?
    Ms. Rich. Yes, the--there was the standard definition that 
was very sci-fi-sounding, back--that they were using in all of 
the statutes when COPPA was passed, you know, ``the World Wide, 
you know, Infrastructure,'' and--you know, it's a strange 
definition. And it's not clear whether that encompasses just 
traditional online activities or whether it would extend to 
interactive activities that don't actually go through the 
Internet. So, we're very--looking at that very seriously.
    Senator Pryor. Knowing what you know now, in terms of the 
state of technology, but also what FTC has to deal with, with 
the statute, and looking at the statute, would you recommend 
that the Senate revisit some of those definitions in the 
underlying law right now?
    Ms. Rich. Well, we're taking a hard look at that, and in a 
few months we'll have the benefit of, hopefully, many, many 
comments on it. And at that point, we'll figure out what our 
next move is, whether it's something we can address, or not 
address, in the rule--meaning, we have the authority under the 
statute--or whether it's something we'd have to come back to 
Congress on.
    Senator Pryor. OK.
    You know, one of my staff guys, here, just gave me a little 
device that's a Nintendo DS, which is interesting. I don't know 
if it's his or his child's, but it has a Pokeman attached to 
it, so----
    [Laughter.]
    Senator Pryor. Anyway, but it has a phone on it, and I 
don't know if it plays music or exactly what. But, you know, 
obviously it's a little game; it has a little game cartridge in 
there. But, it also, very easily and very quickly, allows the 
child to connect to the Internet. And, you know, it has the 
camera, you can do shopping and that type of thing. So, you 
know, this is a device that obviously didn't exist, just a few 
years ago. And I guess I would encourage FTC, as you're looking 
at this, to think through all the applications and--maybe not, 
you know, the--I think it's probably hard to make a list of all 
of the devices, but just the functionality of it. If it's 
connecting to the Internet, and if it's mobile and things like 
that--because hopefully the electronics industry will continue 
to innovate, and will continue to do great things, and bring 
things on the market, and, you know, hopefully when the FTC 
goes through your process, you'll define things in such a way, 
and you'll work with us to define things in such a way, that 
when new products like this come onto the market, you know, the 
statute captures that and we don't get out of date.
    I----
    Ms. Rich. Can I just say----
    Senator Pryor. Yes, please.
    Ms. Rich.--that we have two of those in our house; one for 
my 12-year-old and one for my 9-year-old, and they----
    Senator Pryor. So, they're----
    Ms. Rich.--talk to each other. And when it does access the 
Internet, I think we would be safe to say that's covered, 
because it's accessing the Internet.
    Senator Pryor. Right.
    Ms. Rich. But the question is, if they're just speaking to 
each other, and not through the Internet--there's functionality 
that just can go, you know, machine to machine.
    Senator Pryor. Right.
    Ms. Rich. Is that covered?
    Senator Pryor. Right.
    Well, it is just an example of things that I know the 
Federal Trade Commission has to think through.
    I could, actually, spend a lot more time asking questions, 
because this is very interesting. And I know that we've had--
our members here had to move on to either speaking on the floor 
or other committee meetings they had to get to.
    So, let me just do this, at this point, let me just ask the 
panel if there's anything anyone would like to say before we 
close down the hearing, because we've had a little bit of back-
and-forth, and I just wanted to give everybody a chance to 
respond or to make one last final point.
    So, is there anybody that wants to add anything?
    Mr. Rotenberg. Very briefly, Mr. Chairman, I just wanted to 
thank you for holding this hearing. I mean, I think there are a 
lot of people who appreciate COPPA and believe it plays an 
important role in safeguarding online privacy, but also feel 
that, given new technologies and new business practices, 
something more probably needs to be done. So, this is a very 
good place to start that discussion.
    Senator Pryor. Thank you.
    Mr. Szoka. Sir, if I may say, just briefly, I wanted to 
stress in my testimony that COPPA is device-neutral. And that's 
one of the great things about the statute. The example you 
gave, I think, Ms. Rich, is exactly right, here. We may not 
need changes to the statute, the FTC will look at that, but I 
think that the FTC probably has the flexibility to apply ``the 
Internet'' very broadly to all of those services that touch 
upon, and are integrated into, the Internet.
    So, again, I want to stress, here, my concerns are not with 
the FTC updating the rules consistent with the statute, but 
simply about making broad changes to the statute that have 
greater consequences for speech.
    Senator Pryor. OK, thank you.
    Yes, ma'am.
    Dr. Montgomery. Yes, I again thank the Committee for 
holding this hearing. It's very heartening for me to hear, 
having struggled with many others in the 1990s to get this law 
passed, that it has been a success. And I'm very pleased about 
that, and I'm very pleased to be working with the FTC to ensure 
that COPPA is able to address the continuing rapid changes in 
the digital marketplace.
    But, again, I would just like to make a plea that we, as a 
society, and that the government and the industry, not ignore 
the needs of the Nation's teenagers.
    Senator Pryor. Right.
    Mr. Hintze. I'd, again, like to thank you for holding this 
hearing today, and the members of the Committee for 
participating.
    A lot of discussion today around kids, and a lot of 
discussion today around teens and the ages not covered, 
currently, by COPPA. I think our position, and a number of the 
other panelists, is that COPPA may not be the right vehicle to 
address the teen issues. The issues that teens face online are 
somewhat different from those that younger children face, the 
types of sites they use are quite different, in many cases. 
But, others have expressed the need for some legal protections 
of teens, and we agree. And so, we would encourage the 
Committee to continue to look at the privacy issue more 
generally, maybe not in the framework of COPPA, but looking at 
privacy legislation, at the Federal level, that would address 
privacy protections for not only teens, but adults, as well.
    Senator Pryor. Good.
    Yes, sir.
    Mr. Sparapani. What's new from our perspective, since the 
dawn of COPPA, is that we're entering a moment, I think, in the 
Information Age, for the first time, when we actually have the 
opportunity for technology to reinstill privacy into people's 
online lives through new tools. And there's this sort of user-
control model that Facebook and a number of our--companies like 
us are trying to put forward, is a really new thing, and it 
actually holds real promise for user privacy.
    What's more difficult is getting users to understand the 
new tools and use them in a wise manner, and to, frankly, find 
them and exercise them. And it's especially hard with 
teenagers. So, that's someplace there where I think we're going 
to spend some energy.
    But, again, thank you, Senator, for holding this hearing.
    Senator Pryor. Thank you.
    Ms. Rich. And I'll echo the thanks to you, Mr. Chairman, 
and to the other panelists, for engaging on these important 
issues.
    And also say that we should have a lot more to report after 
our comment period closes and after we have our workshop in 
June. So, I look forward to talking some more.
    Senator Pryor. Thank you, Ms. Rich.
    Let me ask the FTC one last question, and that is, As part 
of your evaluation are you also looking at your manpower, 
slash, resources there at the Commission? I mean, some of the 
witnesses have said that if you had more resources, you could 
do more enforcement and be more effective in enforcing COPPA. 
Are you all evaluating that, as well?
    Ms. Rich. Yes, we are.
    Senator Pryor. And will you come back to the Senate with a 
recommendation on that?
    Ms. Rich. Sure.
    Senator Pryor. OK. Thank you very much.
    [Laughter.]
    Senator Pryor. And I guess, in closing, I'd like to say, 
we're going to leave the record open for 2 weeks. So, don't be 
surprised if some of the Senators or the staff here want to 
submit some more questions, because there are some I didn't go 
into because I've taken too much of your time already. But, 
we'll probably submit some of these over the next couple of 
weeks. We would ask you to get those back as quickly as you 
can, and always work with our staff.
    But, in closing, I'd like to say, this may be one of those 
areas that I think that Senator Wicker kind of alluded to 
earlier. There's an old Abraham Lincoln quote that says, 
``Government should do for people what people can't do for 
themselves.'' And this is an area where we want people 
participating in the marketplace, and using this technology, 
and enhancing their lives, and doing all of these great things. 
But, we just have to make sure that that marketplace is secure, 
that the right privacy parameters are there, the right legal 
structure is there, we have the right enforcement. I mean, we 
just have to make sure that that marketplace is working, 
because the people can't do this for themselves. I think 
there's a level of government, and certainly private sector, 
the private industry has a lot of good actors in it, but there 
are some bad actors, as well. So, we're trying to find that 
balance.
    But, anyway, thank you all for your participation today. I 
know Chairman Rockefeller appreciates it, and I do, too, and 
all the Subcommittee.
    So, thank you very much.
    And, with that, we'll adjourn the meeting.
    Thank you.
    [Whereupon, at 11:52 a.m., the hearing was adjourned.]


                            A P P E N D I X

     Response to Written Questions Submitted by Hon. Mark Pryor to 
                              Jessica Rich

    Question 1. Do you think the age limit in COPPA is appropriate? And 
if so, why?
    Answer. After looking closely at whether adolescents should be 
covered for purposes of the COPPA statute, Congress chose to define a 
``child'' as an individual under age 13. This choice was based in part 
on the sense that most young children do not possess the level of 
knowledge or judgment to determine whether to divulge personal 
information over the Internet. The FTC supported this assessment at the 
time the COPPA statute was introduced.* The staff 
anticipates it will receive comments on this issue during the FTC's 
COPPA Rule review.
---------------------------------------------------------------------------
    \*\ See September 23, 1998 Testimony of the Federal Trade 
Commission before the Subcommittee on Communications, Senate Committee 
on Commerce, Science, and Transportation, available at http://
www.ftc.gov/os/1998/09/priva998.htm.

    Question 2. Do you think COPPA should be strengthened?
    Answer. The FTC currently is reviewing the COPPA Rule in its 
entirety in light of significant changes in the online environment, 
including the rise of social networking and the proliferation of 
interactive technologies, and the increasing use of the mobile web and 
interactive gaming. Through the FTC's March 2010 request for written 
public comment, as well as its June 2 roundtable, the agency intends to 
explore what's working optimally, and where changes might be warranted. 
Once we have completed the public roundtable and the comment period has 
closed, the Commission will carefully evaluate whether any 
modifications to the Rule are warranted.

    Question 3. Should the FTC reexamine what constitutes ``personal 
information'' in its review of COPPA? Or do you believe that the online 
space and the definition of personal information should remain the same 
as it was when the law was created over 10 years ago?
    Answer. The FTC is reexamining whether the Rule's current 
definition of ``personal information'' needs to be revised, consistent 
with the COPPA statute (i.e., permitting the physical or online 
contacting of a specific individual), to include, for example, other 
types of information such as user or screen names and/or passwords, zip 
code, date of birth, gender, persistent IP addresses, mobile geo-
location information, or information collected in connection with 
online behavioral advertising. The FTC has asked for written comments 
on this issue and the FTC staff has dedicated a panel at the June 2 
COPPA roundtable to the question (see agenda, at http://www.ftc.gov/
bcp/workshops/coppa/Agenda_2010COPPARoundtable.pdf). At this time, it 
would be premature to conclude whether the FTC is likely to amend the 
Rule's current definition of personal information.

    Question 4. In your opinion, what is the biggest threat to 
children's privacy and safety in today's online world?
    Answer. For many young people, socializing and communicating online 
can be a rewarding experience, but those activities come with risks, 
including:

   Inappropriate conduct, including online harassment, 
        cyberbullying, and sexting. The online world can feel 
        anonymous. Young people sometime forget that they are still 
        accountable for their actions and do not realize that they may 
        lose the ability to control the dissemination of information 
        and photos once they are shared online.

   Inappropriate contact. Some people online have bad 
        intentions, including bullies, predators, hackers, and 
        scammers.

   Inappropriate content. Young people may find pornography, 
        violence, or hate speech online.

    It is difficult to determine what the ``biggest threat'' might be, 
because every child has unique circumstances that affect his or her 
personal risk profile. The FTC is closely following research conducted 
by the Pew Internet & American Life Project and the Crimes Against 
Children Research Center, among others, so that we may better 
understand the interplay between children's experiences and the risks 
they face online. Such research helps us craft useful advice for 
parents and children, such as the advice for parents in our recent 
publication, Net Cetera: Chatting with Kids About Being Online.

    Question 5. What do you think is the most urgent update to COPPA 
needed?
    Answer. As stated above, the FTC currently is reviewing the COPPA 
Rule in its entirety. Through the FTC's Rule review process, the agency 
intends to take a careful and comprehensive look at the Rule, with 
input from many sources. The agency is keeping an open mind, therefore, 
on what the most pressing modifications, if any, might be to the 
Commission's Rule or to the underlying statute.

    Question 6. In your opinion, what would constitute the most 
appropriate definition of ``sensitive data'' in the context of 
children's online privacy?
    Answer. The COPPA statute does not define or use the term 
``sensitive data.'' However, the statute does contain an enumeration of 
what type of individually identifiable information is considered to be 
``personal,'' the collection of which requires an operator to obtain 
prior verifiable parental consent. ``Personal information'' is defined 
as:

        individually identifiable information about an individual 
        collected online, including--(A) a first and last name; (B) a 
        home or other physical address including street name and name 
        of a city or town; (C) an e-mail address; (D) a telephone 
        number; (E) a Social Security number; (F) any other identifier 
        that the Commission determines permits the physical or online 
        contacting of a specific individual; or (G) information 
        concerning the child or the parents of that child that the 
        website collects online from the child and combines with an 
        identifier described in this paragraph.

    In promulgating the COPPA Rule in 1999, the FTC used the open-ended 
authority granted under subpart F of the definition of personal 
information to add ``other online contact information, including but 
not limited to an instant messaging user identifier, or a screen name 
that reveals an individual's e-mail address.'' The Commission also 
added to the definition ``a persistent identifier, such as a customer 
number held in a cookie or a processor serial number, where such 
identifier is associated with individually identifiable information; or 
a combination of a last name or photograph of the individual with other 
information such that the combination permits physical or online 
contacting.'' Since promulgating the COPPA Rule, the FTC has not 
further expanded upon the definition of personal information. However, 
as noted in our response to the previous question, the FTC is 
reexamining the definition of ``personal information'' as part of its 
overall Rule review.

    Question 7. You mentioned major tenets of children's privacy the 
FTC will consider in its reexamination of the effectiveness of COPPA. 
Specifically, you address ``whether the Rule's definition of `Internet' 
adequately encompasses [certain] technologies'' like mobile 
communications. Will the FTC consider in its review the impact of data 
and location tracking devices, such as GPS systems, on children's 
safety?
    Answer. Yes. The FTC's March 2010 request for public comment seeks 
input on whether the Rule's current definition of personal information 
needs to be revised, consistent with the COPPA statute (i.e., 
permitting the physical or online contacting of a specific individual), 
to include mobile geo-location information, among other things.

    Question 8. How does the Commission enforce whether operators have 
``actual knowledge'' that their sites are used by children under 13? Is 
this scienter requirement an issue that merits additional scrutiny in 
your opinion?
    Answer. As explained in the Statement of Basis and Purpose 
accompanying the COPPA Rule, actual knowledge will be present where the 
operator obtains direct information about a child's age or grade, for 
example, from a child's registration at a website or from a concerned 
parent who has learned that the child is participating at the site. In 
addition, the FTC has explained that it will examine closely websites 
that do not directly ask age or grade, but instead ask ``age 
identifying'' questions, such as ``what type of school do you go to: 
(a) elementary; (b) middle); (c) high school; (d) college'' and that 
through such questions, operators may acquire actual knowledge that 
they are dealing with a child under age 13.
    The FTC has stated that the COPPA statute's actual knowledge 
standard does not require operators of general audience sites to 
investigate the ages of their website's visitors or to monitor their 
chat rooms. However, an operator may be considered to have actual 
knowledge with respect to a specific child if someone from the 
operator's organization views a revealing post, or if someone alerts 
the operator to such a post (e.g., a concerned parent who learns that 
his child is participating on the site).
    Thus far, all of the FTC's COPPA cases involving ``actual 
knowledge'' center on an operator's direct receipt of information about 
a child's age input during the registration process.
    The FTC staff has dedicated a panel at its June 2 COPPA roundtable 
to exploring the COPPA statute's actual knowledge standard.

    Question 9. Are there any restrictions on state AGs enforcing 
compliance with the COPPA rule?
    Answer. The COPPA statute permits state attorneys general to file 
civil actions on behalf of their residents in U.S. District Court to 
enjoin an operator's practices, enforce compliance with the FTC's COPPA 
Rule, obtain damages, restitution, or other compensation on behalf of 
their residents, or to obtain such other relief as the court deems 
appropriate. The statute places several minor limitations on a state 
attorney general's right to enforce COPPA. First, unless it would be 
infeasible to do so, an attorney general intending to enforce COPPA 
must provide the FTC with written notice and a copy of the complaint 
prior to filing the state action. Upon receipt of notice of a state's 
intent to enforce COPPA, the FTC has the right to intervene, to be 
heard, and to file a petition for appeal in the action. The statute 
also provides that any person or organization that has been approved by 
the FTC as a COPPA safe harbor program and whose guidelines are relied 
upon by a defendant as a defense may file as amicus curiae in a state 
COPPA proceeding.
    To date, only one state--Texas--has provided notice to the FTC of 
its intention to enforce COPPA. In December 2007, Texas filed two COPPA 
actions, one against The Doll Palace Corp., and the other against 
Future US, Inc. (a/k/a gamesradar.com). Information about the Texas 
actions can be found at http://www.oag.state.tx.us/oagNews/
release.php?id=2288.

    Question 10. How is the Net Cetera distribution and education 
campaign working? Have the materials and the FTC's efforts to reach out 
to teachers and parents been effective?
    Answer. The FTC issued a report to Congress about the Net Cetera 
campaign in March 2010, available at http://www.ftc.gov/os/2010/03/
100331netcetera-rpt.pdf. This report discusses the creation of Net 
Cetera, how the FTC is getting the word out about the guide, and 
distribution highlights.
    The Net Cetera education campaign continues to be a success. Since 
October 2009, the FTC has received orders for the Net Cetera guide from 
every state in the nation, for a total of over 3 million copies ordered 
in English and Spanish. Other outreach highlights include:

   Prince George's County Public Schools--the 2nd largest 
        school district in Maryland and 18th largest in the Nation--
        distributed approximately 150,000 copies of Net Cetera.

   Public and school libraries across Massachusetts have 
        received copies of the guide and are now placing orders, and 
        every member of the Young Adult Library Services Association 
        (YALSA) has received a copy.

   The National Association of School Nurses will distribute 
        the guide to attendees at their upcoming annual conference.

   FTC staff are attending and speaking at conferences this 
        summer to promote Net Cetera, including the widely-attended 
        International Society for Technology in Education Annual 
        Conference and the National School Public Relations Association 
        National Seminar.

   Schools, police departments, and organizations in Arkansas 
        have ordered over 34,000 copies of the guide.

    Question 11. You mention 14 cases brought by the Commission over 
the past 10 years alleging COPPA violations. From your perspective, 
have those cases served to deter repeat violations or additional COPPA 
violations?
    Answer. The FTC has been strategic in bringing cases that 
illustrate different core requirements. We have garnered widespread 
interest and significant leverage from each COPPA enforcement action 
addressing a particular type of violation. The FTC's early COPPA 
enforcement actions focused on children's sites that collected 
extensive amounts of personal information without providing notice to 
parents and obtaining their consent. Most recently, the FTC has focused 
on operators of both general audience and child-directed social 
networking sites and sites with interactive features that permit 
children to publicly divulge their personal information online.
    Although law enforcement is a critical part of the Commission's 
COPPA program, the FTC's COPPA program is comprised of several 
effective integrated components--rulemaking, self-regulation, routine 
outreach to businesses and consumers, and law enforcement--that work in 
tandem to enhance overall COPPA compliance. The FTC believes that this 
integrated approach has served to deter repeat or additional 
violations.

    Question 12. What should the FTC or Congress do to strengthen 
children's safety and privacy online in conjunction with advanced 
technologies and mobile devices?
    Answer. The COPPA statute applies to operators of commercial 
``websites located on the Internet'' and ``online services'' that 
collect, maintain or disclose children's personal information on the 
Internet. Where children connect to websites or online services through 
mobile devices, the statute clearly applies. Where children are not 
connecting to or through websites or online services, COPPA may not 
apply. Thus, many, but not all, mobile communications may be covered by 
the statute. The FTC's Rule review will examine how the definitions of 
Internet, websites, and online services may affect COPPA's application 
to different mobile and other technological uses.

    Question 13. [Do you agree with the direction the FTC is taking as 
it reexamines the implementation and effectiveness of COPPA?]
    Answer. N/A

    Question 14. How do you propose to improve parental supervision and 
control of children's online activity to prevent the inappropriate or 
illegal collection and use of their information?
    Answer. The FTC will continue to focus on educating parents, 
through tools such as Net Cetera and the agency's online safety portal, 
OnGuardOnline.gov, about the rights and protections provided by COPPA, 
and about children's online privacy and safety more generally.

    Question 15. If you support a regime granting rules of the road for 
adolescents' privacy, how do you envision this sort of regime working? 
How would you propose it be structured? If you do not support a regime 
governing adolescents' privacy, please explain your reasoning.
    Answer. The FTC's current review is focused on the COPPA Rule, and 
on the online privacy of individuals defined as children under that 
statute. The FTC has not yet had the opportunity to formulate an 
opinion on a possible regime to protect adolescents' privacy. The 
agency looks forward, however, to reviewing any proposals that may be 
put forward. In addition, last year, the agency released a set of 
principles relating to online behavioral advertising. Moreover, the 
Commission currently is examining privacy more broadly and hopes to 
develop a general privacy framework in the coming months.
                                 ______
                                 
     Response to Written Questions Submitted by Hon. Mark Pryor to 
                           Timothy Sparapani

    Question 1. What steps is Facebook taking to promote the 
advancement of children's privacy?
    Answer. Facebook provides users with innovative privacy controls to 
give users control of their information online. We have recently 
provided users with additional steps for controlling sharing both on 
Facebook and with third parties such as other websites or applications.
    Facebook takes additional steps specifically targeted to minors. 
For example, we provide specialized privacy settings so that minors may 
further control their sharing through Facebook. In part, this 
eliminates the potential of minors sharing with everyone. Even minors 
who want to share with the maximum number of people may only share with 
users under 18 years of age. Additionally, Facebook provides special 
educational materials for minors. Furthermore, Facebook imposes rules 
requiring Facebook Pages and applications built by third parties on 
Facebook to impose age ``gates'' that work to prevent minors from 
accessing content that is inappropriate for their age or to be accessed 
through these Pages or Applications by non-minors.

    Question 2. Do you think the age limit in COPPA is appropriate? And 
if so, why?
    Answer. Facebook takes no position on the age limitations imposed 
by COPPA. We are not experts on the appropriate age to set for online 
activity, but our experience informs us that teenagers 13 years of age 
generally act in a responsible manner on Facebook.

    Question 3. Do you think COPPA should be strengthened?
    Answer. COPPA could be strengthened by providing incentives for 
companies to innovate without fear of liability to develop new 
technologies. The current legislative and regulatory structure should 
encourage, not discourage continuing technological innovation.

    Question 4. Should the FTC reexamine what constitutes ``personal 
information'' in its review of COPPA? Or do you believe that the online 
space and the definition of personal information should remain the same 
as it was when the law was created over 10 years ago?
    Answer. At this time, Facebook is not recommending an amendment to 
the definition of ``personal information.''

    Question 5. In your opinion, what is the biggest threat to 
children's privacy and safety in today's online world?
    Answer. The U.S. Congress has failed to appropriate sufficient 
funds to ensure that the KIDS Act of 2008 actually is fully 
implemented. In particular, the KIDS Act requires the creation of a 
Federal list of Registered Sex Offenders (RSOs) but that list has not 
been completed. Because of this, Facebook prepares its own list--at 
Facebook's own expense--to help us periodically review our list of 
users and terminate accounts that might have been established by RSOs. 
Smaller companies, particularly application developers, do not have 
such resources and are unlikely to expend scarce resources to obtain a 
list of RSOs from all 50 states. Congress should encourage the Federal 
Government to build and maintain an up-to-date list of RSOs and 
distribute it to any company that asks for the list.
    Furthermore, the U.S. Government should negotiate with foreign 
governments to obtain lists of those countries' RSOs to further support 
responsible companies' attempts to prevent access by RSOs to online 
services where minors may be present.

    Question 6. What do you think is the most urgent update to COPPA 
needed?
    Answer. Congress should explicitly create a safe harbor expressly 
permitting companies to explore technological and policy innovations to 
further limit the access of minors to sites that are inappropriate for 
their age, and to do so without fear of regulatory or legislative 
sanction. The current model discourages innovations that could advance 
the privacy, safety, and security of minors.

    Question 7. In your opinion, what would constitute the most 
appropriate definition of ``sensitive data'' in the context of 
children's online privacy?
    Answer. Facebook does not categorize data as sensitive. Rather, all 
information is treated as sensitive and subject to disclosure subject 
to a user's privacy settings and only at the user's direction. Because 
we recognize that minors are special, we explicitly prohibit minors 
from sharing with groups of individuals wider than the classification 
of Friends of Friends and Networks, where minors' Networks are 
typically their classmates at their schools.

    Question 8. Recent press reports have indicated that Facebook is 
making available to the Web user information that has been previously 
contained within closed networks. Which pieces of user information are 
or will be made publicly available without the user proactively making 
any changes to her privacy policy?
    Answer. Contrary to press reports, Facebook does not make available 
to third parties information that was previously contained within 
closed networks. In December of 2009, Facebook eliminated Regional 
Networks that were established when Facebook's user base was much 
smaller. These Regional Networks provided any members of a particular 
network the opportunity to view content of any other participants. By 
eliminating these Regional Networks, Facebook enhanced minors' privacy 
substantially.
    Further, in part to respond to this misinformation contained in 
press reports, Facebook recently provided our users with a single 
``global opt out'' option to eliminate even any voluntary sharing with 
third parties.

    Question 9. How does Facebook verify or authenticate its users' 
identities or ages?
    Answer. As explained at length in our written and oral testimony, 
no company can actually ``verify'' any users' age. Instead, Facebook 
uses a series of novel, proprietary technologies to draw assumptions 
about the likelihood that a user is of age. Moreover, our users are 
required to provide us with their ages at the moment they create an 
account.

    Question 10. Is Facebook tied or affiliated in any way with 
location-based advertising? Is it possible for a 14-year-old Facebook 
user to be tracked by other companies, devices or data gatherers 
without her knowledge or consent?
    Answer. Facebook provides ads targeted to users based on their 
hometown. We never provide this piece of information to advertisers. To 
our knowledge, it is not possible for other companies, devices or data 
gatherers to track Facebook users using the users' Facebook information 
wither any users knowledge or consent.

    Question 11. Could you describe your company's efforts to educate 
parents and teachers about online safety?
    Answer. Since our inception, Facebook has worked assiduously to 
educate parents and teachers about online safety. Just last week, we 
were awarded an award from Wired Kids that we received, in part, due to 
our ongoing efforts to educate our users. Our staff speaks at an 
extraordinary number of events per year that are intended to perform 
this function. Our Safety and Privacy pages provide full explanations 
of how our users may fully utilize our innovative privacy settings and 
has been recently revised to offer specific sections with content 
tailored to different audiences, including parents, educators and 
teens.

    Question 12. How do you work with law enforcement to combat 
Internet crime?
    Answer. Our Chief Security Officer and the team he supervises work 
closely with governments throughout the U.S. and around the world to 
comply with lawful requests for assistance. Recently, Facebook provided 
the key information that helped secure the two largest CAN-SPAM Act 
judgments in history, leading to a substantial reduction in the amount 
of spam messaging our users are subjected to. On the rare occasion that 
Facebook identifies illegal material being circulated through our site 
we prevent the disbursement of that information and then report the 
content and the user account attempting to distribute that material to 
the National Center on Missing and Exploited Children and appropriate 
law enforcement. We would be happy to brief the Subcommittee at length 
about other assistance provided, within the scope of the law, to law 
enforcement.

    Question 13. What should the FTC or Congress do to strengthen 
children's safety and privacy online in conjunction with advanced 
technologies and mobile devices?
    Answer. In addition to fully implementing the KIDS Act, the FTC 
should negotiate with foreign governments to encourage the sharing of 
foreign governments' RSOs with the U.S. Government and U.S. companies.

    Question 14. Do you agree with the direction the FTC is taking as 
it reexamines the implementation and effectiveness of COPPA?
    Answer. Facebook supports the second five-year review of COPPA.

    Question 15. How do you propose to improve parental supervision and 
control of children's online activity to prevent the inappropriate or 
illegal collection and use of their information?
    Answer. We recommend that parents insist on being made friends on 
Facebook of their children, or, alternatively, that another adult 
friend or family member be made a friend of teenage users. Further, as 
mentioned previously, we have recently created additional educational 
materials targeted to parents to help them become more conversant with 
Facebook and tools to help safeguard minors' information.

    Question 16. If you support a regime granting rules of the road for 
adolescents' privacy, how do you envision this sort of regime working? 
How would you propose it be structured? If you do not support a regime 
governing adolescents' privacy, please explain your reasoning.
    Answer. Facebook prohibits users less than 13 years of age from 
using our service. We limit minors' sharing to reduce the scope of that 
sharing. Further, we give our users privacy controls to control 
virtually all of their information online. Any modification to COPPA or 
the regulations implementing it should recognize effective regimes such 
as that created by Facebook.
                                 ______
                                 
     Response to Written Questions Submitted by Hon. Mark Pryor to 
                           Michael D. Hintze

    Question 1. What percentage of your parental users take advantage 
of the parental controls offered by your software and services?
    Answer. Although we know for the sites and services where we ask 
for age whether a user is under 13, we are unable to determine how many 
of our total users are parents. While reliable data specific to 
Microsoft's products and services is not available, research by the 
Henry J. Kaiser Family Foundation found that 41 percent of parents 
report using parental controls to block their children's access to some 
websites.\1\
---------------------------------------------------------------------------
    \1\ Henry J. Kaiser Family Foundation, Parents, Children & Media, 
at 11 (June 2007), http://www.kff.org/entmedia/upload/7638.pdf.

    Question 2. You said in your written statement that ``Microsoft 
proactively requests age information and seeks parental consent for 
children's use of many of its services even when those services are not 
specifically targeted to children.'' What formula do you use to 
determine whether to seek parental consent for children's use of 
services that are not specifically targeted to children? (How do you 
make that determination and could you give the Committee some examples 
of those services?)
    Answer. Our approach goes beyond COPPA in that we screen for age 
and obtain parental consent for under-13 users not only on our sites 
and services that are ``targeted'' to children, but also on our general 
audience sites that are ``attractive'' to children.\2\ We do not have 
an exact formula for determining which sites or services may be 
attractive to children, but some examples of general audience services 
where we have decided to screen for age and seek parental consent for 
users under 13 include Hotmail, Messenger, Windows Live Spaces and Xbox 
Live.
---------------------------------------------------------------------------
    \2\ See Microsoft Corp., Privacy Guidelines for Developing Software 
Products and Services, Section 1.11 and Scenario 8, available at http:/
/download.microsoft.com/download/0/8/2/082448
D8-2AED-45BC-A9A0-094840E9E3A2/
Microsoft_and%20Privacy_guidelines_for_developers
.doc.

    Question 3. Do you think the age limit in COPPA is appropriate? And 
if so, why?
    Answer. Yes, we believe the age limit in COPPA is appropriate. It 
is certainly true that COPPA's stated goals of increasing parental 
involvement and protecting privacy are important with respect to 
teenagers. But COPPA's existing structure and parental consent 
processes are not well suited to deal with this age group. For example, 
teens are too sophisticated to be deterred by age gates, and existing 
parental consent mechanisms--such as the toll-free number and print and 
send methods--may not be reliable in ensuring it is the parent rather 
than the teen who is giving consent.
    In addition, teens' use of the Internet raises somewhat different 
privacy and safety issues than for children under thirteen. For 
example, while older teens may be more likely to understand the 
implications of online advertising than young children, teenagers may 
be more likely to be faced with instances of cyberbullying online.\3\
---------------------------------------------------------------------------
    \3\ See Amanda Lenhart, Pew Internet & American Life Project, 
``Cyberbullying 2010: What the Research Tells Us'' (May 6, 2010), 
http://www.pewinternet.org//media//Files/Presentations/
NCMEC_Cyberbullying%20talk%20050610release.ppt.
---------------------------------------------------------------------------
    We believe there are alternative ways to protect the privacy of 
teens online that are better than simply expanding COPPA's age limit. 
For instance, Microsoft provides parents with a number of educational 
resources and technology tools so that they can talk to their teens 
about the importance of privacy and safety online and be more involved 
in their online activities. Additionally, Microsoft has long supported 
comprehensive Federal privacy legislation that would establish baseline 
protections and enhance the privacy of all individuals--including 
teens.\4\ We are committed to working with Congress to advance these 
important efforts.
---------------------------------------------------------------------------
    \4\ See, e.g., http://www.microsoft.com/presspass/features/2005/
nov05/11-03Privacy.mspx.

    Question 4. Do you think COPPA should be strengthened?
    Answer. We do not believe that amending the statute is necessary at 
this time. The statute provides the FTC with sufficient authority and 
flexibility to address children's privacy issues in light of evolving 
technologies and business models. We commend the Commission for 
launching its review of the COPPA Rule, which had been planned for 
2015, 5 years early in order to account for new technologies. At the 
very least, we believe it would be prudent to allow the FTC to complete 
its Rule review before determining whether legislative action is 
necessary.

    Question 5. Should the FTC reexamine what constitutes ``personal 
information'' in its review of COPPA? Or do you believe that the online 
space and the definition of personal information should remain the same 
as it was when the law was created over 10 years ago?
    Answer. Yes, the FTC should reexamine the definition of ``personal 
information,'' and we are pleased that they have indicated an intent to 
do so. With its flexible definition of personal information, the COPPA 
statute is sufficiently forward-looking and gives the FTC the 
rulemaking authority to address evolving circumstances and needs. 
Therefore, we believe that the FTC, within the parameters of the 
existing statute, can update the definition of ``personal information'' 
included in the COPPA Rule to address the wide range of factors that 
have changed over the last decade.

    Question 6. In your opinion, what is the biggest threat to 
children's privacy and safety in today's online world?
    Answer. Criminals who prey on children and families are the biggest 
threat to children's privacy and safety. To help thwart these 
criminals, Microsoft works with lawmakers in many countries to promote 
stronger online safety and privacy legislation and Internet safety 
education in schools. We help train law enforcement personnel in using 
technology to help combat online child pornography, child predators, 
and child exploitation. We use a filtering tool to review images 
uploaded to Windows Live Spaces and other Microsoft online properties 
to detect potential instances of child exploitation. And we are working 
with law enforcement officials in several countries to deploy the Child 
Exploitation Tracking System (``CETS''), a software tool to help 
investigators share and analyze information for tracking child 
exploitation on the Internet. We are committed to working with 
Congress, Federal and state agencies, nonprofit organizations, and 
other industry leaders to help protect children's privacy and safety in 
today's online world.

    Question 7. What do you think is the most urgent update to COPPA 
needed?
    Answer. We do not believe that the COPPA statute needs to be 
updated at this time. As explained in my testimony, we believe that the 
best course is for the FTC to update the COPPA Rule by providing clear 
guidance on how companies can better meet both the letter and the 
spirit of the law in light of changing technologies and by addressing 
the weaknesses of the currently approved approaches to obtaining 
verifiable parental consent.

    Question 8. In your opinion, what would constitute the most 
appropriate definition of ``sensitive data'' in the context of 
children's online privacy?
    Answer. Under COPPA, any personal information collected from 
children under the age of 13 triggers the obligations of the Act, 
including the requirements for verifiable parental consent. We believe 
this broad approach is appropriate given the unique sensitivities 
involved with the collection and disclosure of data from young 
children.

    Question 9. How does Microsoft handle location information? And 
what is the company's relationship with location tracking applications?
    Answer. Microsoft is a leader in developing privacy standards to 
protect users of location-based services. In 2004, Microsoft partnered 
with TRUSTe and AT&T Wireless to form the Wireless Advisory Committee, 
which works with companies providing wireless data and wireless web 
services to ensure that specific standards regarding consumer notice 
and consumer consent are achieved.\5\
---------------------------------------------------------------------------
    \5\ TRUSTe, ``TRUSTe Announces First Wireless Privacy Standards to 
Protect Mobile Users'' (Feb. 18, 2004), http://www.truste.com/
about_TRUSTe/press-room/news_truste_announces
_first_wireless_privacy_standards.html.
---------------------------------------------------------------------------
    We expect to offer some location-based services on our platforms in 
the upcoming months. These location-based services may include local 
search, camera, mapping, and phone finder applications and services 
that utilize a user's current location.
    Microsoft is committed to providing users control over their 
location-based data. On our platforms, users must first agree to allow 
Microsoft to access or use their current location, and users can always 
disable the sending of location information if they change their minds. 
Microsoft does not currently offer any services that disclose a user's 
location to others or that allow users to be tracked by third parties.

    Question 10. You mention a ``digital identity card'' as one 
technology that could enhance authentication and streamline parental 
consent processes? Could you elaborate upon your idea?
    Answer. Over time robust digital identity cards may become 
analogous to tangible cards in a person's wallet. In much the same way 
that a person might use a student ID card to get free admission to a 
museum, one or more digital identity cards may be used to verify the 
card owner's identity or an identity attribute, such as age or parental 
status.
    To accomplish these types of verification, one way that digital 
identity cards could be issued is through offline processes where 
approved verification of a parent-child relationship already occurs. 
Website operators and online service providers could verify age and 
obtain parental consent by requesting that parents and children provide 
their digital identity cards before a child may access interactive 
services and features. These types of technologies still require that 
robust proofing and authentication processes occur, but can facilitate 
the online use and reuse of the proofing. Like with other solutions, 
they are not foolproof and should be used in conjunction with education 
and other online safety tools, including technologies that help balance 
against the disclosure of information that is not needed to verify the 
identity of the child or the parent.

    Question 11. Does Microsoft have any other ideas for new parental 
control methods that would not cause additional privacy concerns or be 
tied to an IP address?
    Answer. Microsoft recommends that the FTC expand its list of 
approved parental consent methods to include other reliable approaches 
that minimize burdens on parents, leverage existing technologies, and 
scale for millions of users. Because children are increasingly using 
mobile phones and other mobile devices, we also urge the FTC to 
consider the types of parental consent mechanisms that are appropriate 
for online services that are accessed through these devices.
    Microsoft is working on technology that enables parents and 
children to better manage their identities online in a privacy 
enhancing way. When combined with the use of digital identity cards, 
these technologies could allow parents and children to disclose only 
that information that is necessary (such as parental status or age, but 
not name or other personal information) to enable children's access to 
and use of websites and online services.

    Question 12. In your ``Family Safety at Microsoft'' attachment 
submitted to the Committee, you state, ``In the United States, 71 
percent of teens with online access have a social networking profile.'' 
What are the implications of this statistic for our discussion? Are 
children using common sense when using the Internet? Do trends indicate 
that young children are disclosing information they shouldn't and what 
are companies doing with that information?
    Answer. Given the percentage of teens that are using social 
networks, it is important that teens with online access be taught how 
to use such services wisely and safely. To this end, Microsoft is a 
member of the Ad Council's Internet Safety Coalition, which is working 
to help kids understand that the Internet is a public place and to 
explain the risks of ill-considered Internet posting. Microsoft also 
provides parents with a number of educational resources and technology 
tools so that they can talk to their teens about the importance of 
privacy and safety online and be more involved in their online 
activities.\6\ We are committed to working with Congress to make sure 
parents, educators, and children are aware of these resources and take 
advantage of them. Microsoft has no special insight into the types of 
information that children are disclosing online in general or into the 
privacy practices of other companies.
---------------------------------------------------------------------------
    \6\ See http://www.microsoft.com/protect/family.

    Question 13. Could you describe your company's efforts to educate 
parents and teachers about online safety?
    Answer. While Microsoft has created a number of tools and 
technologies to help promote child privacy and safety on the Internet, 
we believe that educating parents, teachers, and children is one of the 
most effective ways to respond to online risks. To this end, we offer a 
number of educational resources for parents, teachers, and children 
regarding the importance of online privacy and safety.\7\ We also 
support numerous family safety educational organizations and outreach 
efforts. For example, Microsoft is a sponsor of i-SAFE America's i-
LEARN program, which provides free online curriculum for educators, 
parents, and teens.\8\ We helped to create, along with other technology 
companies, the National CyberSecurity Alliance, whose mission is to 
educate all users, including parents and children, about how to stay 
safe online.\9\ Microsoft also supports GetNetWise, a public education 
organization that offers Internet users resources for making informed 
decisions about safer Internet use.\10\ A representative list of 
Microsoft's educational efforts is provided in the attachment to my 
written testimony.\11\
---------------------------------------------------------------------------
    \7\ See http://www.microsoft.com/protect/family.
    \8\ See http://www.ilearn.isafe.org.
    \9\ See http://www.staysafeonline.org/.
    \10\ See http://www.getnetwise.org.
    \11\ See pp. 7-8, available at http://download.microsoft.com/
documents/uk/education/home
accessprogramme/FamilySafety-US.pdf.

    Question 14. How do you work with law enforcement to combat 
Internet crime?
    Answer. Microsoft is committed to helping make the Internet safer 
for all users--including children and families--but we can't do it 
alone. Therefore, Microsoft partners with law enforcement agencies to 
combat Internet crime.\12\ For example, Microsoft has partnered with 
the National Center for Missing and Exploited Children (``NCMEC'') to 
develop and deploy technology solutions that disrupt the ability of 
online predators to exploit children or traffic in child pornography. 
We also have worked with Interpol and the International Centre for 
Missing and Exploited Children (``ICMEC'') to sponsor worldwide 
training sessions for law enforcement personnel on computer-facilitated 
crimes against children. In addition, Microsoft works extensively with 
the Department of Justice's Internet Crimes Against Children Task Force 
and has worked with a number of state Attorneys General to provide 
comprehensive training for law enforcement on computer-facilitated 
crimes.
---------------------------------------------------------------------------
    \12\ See id. at 9-10.

    Question 15. What should the FTC or Congress do to strengthen 
children's safety and privacy online in conjunction with advanced 
technologies and mobile devices?
    Answer. One of the advantages of the COPPA statute is that it 
provides a flexible framework by which the FTC can quickly adapt its 
rules to accommodate advanced technologies, including mobile devices. 
The FTC recently launched a proceeding to look into this issue, and 
Microsoft will be participating in that process. We believe that the 
FTC can strengthen children's safety and privacy online by providing 
clear guidance on how companies can better meet not only the letter, 
but also the spirit, of the law in light of advanced technologies and 
by addressing the weaknesses of the currently approved approaches to 
obtaining verifiable parental consent. We do not believe that amending 
the statute is necessary at this time. At the very least, we believe it 
would be prudent to allow the FTC to complete its Rule review before 
determining whether legislative action is necessary.

    Question 16. Do you agree with the direction the FTC is taking as 
it reexamines the implementation and effectiveness of COPPA?
    Answer. Yes, we agree with the direction the FTC is taking for its 
COPPA Rule review. We commend the FTC for taking the initiative to 
launch its review 5 years early in light of children's increasing use 
of new technologies to access the Internet. We expect that the FTC's 
comprehensive review process will produce a strong public record that 
will help inform the FTC as it considers whether modifications of the 
COPPA Rule are needed.

    Question 17. How do you propose to improve parental supervision and 
control of children's online activity to prevent the inappropriate or 
illegal collection and use of their information?
    Answer. We recommend that the FTC update two key aspects of the 
COPPA Rule in order to improve parental supervision and control of 
children's online activity. First, we hope that the FTC will use its 
review process to encourage companies that provide sites and services 
that are attractive to children to be more proactive about creating 
opportunities for parental engagement in their children's online 
activities. Second, we urge the FTC to work with technology companies 
and consumer advocates to develop more consumer-friendly, effective, 
and scalable methods for obtaining parental consent, especially in the 
context of mobile devices.
    We also believe in empowering parents through parental controls. To 
this end, we make available tools for a number of our services, such as 
Windows Live and Xbox Live, that help parents make granular choices 
about how their children may share personal information online. For 
example, Microsoft's parental controls enable parents to limit their 
children's searches, block (or allow) websites based on the type of 
content, restrict with whom their children can communicate, and access 
detailed activity reports that show the websites their children visited 
and the games and applications they used.

    Question 18. If you support a regime granting rules of the road for 
adolescents' privacy, how do you envision this sort of regime working? 
How would you propose it be structured? If you do not support a regime 
governing adolescents' privacy, please explain your reasoning.
    Answer. Microsoft has long supported comprehensive Federal privacy 
legislation that would establish baseline protections and enhance the 
privacy of all individuals--including adolescents.\13\ In addition, we 
believe that a key element of protecting privacy for adolescents is to 
find ways to effectively encourage parental involvement in their online 
activity. Microsoft provides parents with a number of educational 
resources and technology tools so that they can talk to their teens 
about the importance of privacy and safety online and be more involved 
in their online activities. We are committed to working with Congress 
to advance these important efforts.
---------------------------------------------------------------------------
    \13\ See, e.g., http://www.microsoft.com/presspass/features/2005/
nov05/11-03Privacy.mspx.
---------------------------------------------------------------------------
                                 ______
                                 
     Response to Written Questions Submitted by Hon. Mark Pryor to 
                         Kathryn C. Montgomery

    Question 1. Do you think the age limit in COPPA is appropriate? And 
if so, why?
    Answer. The regulations that were put in place for COPPA are 
appropriate for children under the age of 13, and were designed to 
provide protections specifically for this age group. They are part of a 
long tradition of advertising policy safeguards that are based on 
social science research dating back to the 1970s. However, because 
COPPA only covers young children, online marketers have developed a 
spectrum of techniques for data collection and targeting focused on 
adolescents, with virtually no government oversight. Recent research in 
neuroscience and adolescent development has identified a number of ways 
in which adolescents are vulnerable to new forms of marketing, 
particularly in the digital context (See articles by Professors Frances 
Leslie and Constance Pechmann at the University of California, Irvine 
at digitalads.org. See also Kathryn C. Montgomery and Jeff Chester, 
``Interactive Food and Beverage Marketing: Targeting Adolescents in the 
Digital Age,'' Special supplement to Journal of Adolescent Health. 
September, 2009: 1-12.) New legislation is needed to provide 
adolescents with substantive protections from unfair data collection 
and marketing practices.

    Question 2. Do you think COPPA should be strengthened?
    Answer. Under its current review of COPPA, the FTC needs to ensure 
that the rules are updated to apply to evolving data collection and 
targeting practices. These include: behavioral profiling, ad networks, 
social networking platforms, location targeting and other mobile 
practices, etc. COPPA legislation was drafted with sufficient 
flexibility to accommodate these new practices, but they need to be 
articulated clearly in the updated FTC rules to ensure that the law is 
implemented effectively.

    Question 3. Should the FTC reexamine what constitutes ``personal 
information'' in its review of COPPA? Or do you believe that the online 
space and the definition of personal information should remain the same 
as it was when the law was created over 10 years ago?
    Answer. The FTC should reexamine the definition of Personal 
Information in COPPA. Its current definition only covers a few examples 
of what constitutes personally identifiable information. However, the 
law includes a clause (SEC. 1302 8, F) that was designed to ensure that 
evolving practices are included in the definition of personal 
information: ``any other identifier that the Commission determines 
permits the physical or online contacting of a specific individual.'' 
With the growth in behavioral profiling practices, digital marketers 
can now use a variety of new identifiers, including IP address, 
cookies, and other ``passive'' forms of data collection, to easily 
identify and target an individual child. As the work of Professor Paul 
Ohm at the University of Colorado shows, the ability of data bases to 
re-identify individuals is growing. Narrow definitions of PII do not 
capture how industry treats data about individuals.
    The FTC has already recognized the need to expand the definition of 
personally identifiable information in some of its other documents, 
including the FTC Staff Report on Self Regulatory Principles for Online 
Behavioral Profiling (Feb, 2009), which recognizes that Personal 
Information can include the tracking of given devices, computers or 
browsers. The European Commission's Article 29 Working Party has also 
articulated the need to redefine personal information.

    Question 4. In your opinion, what is the biggest threat to 
children's privacy and safety in today's online world?
    Answer. The biggest threat is the creation of a vast infrastructure 
for data collection in a variety of networked technologies and 
platforms used by children and adolescents. Current and emerging 
industry practices are designed to maximize data collection while 
minimizing transparency. Each new technology available to the public 
brings with it a new way for data collection to occur, and little if 
any discussion about the impact or planned uses of this data.

    Question 5. What do you think is the most urgent update to COPPA 
needed?
    Answer. As outlined above, the most urgent need is to ensure that 
current regulatory and self-regulatory safeguards are applied to new 
platforms and practices for data collection and targeted marketing.

    Question 6. In your opinion, what would constitute the most 
appropriate definition of ``sensitive data'' in the context of 
children's online privacy?
    Answer. Any data about children and teens should be considered 
sensitive. In many ways, both children and adolescents are ``sensitive 
users,'' who should be afforded special protections. Teens and children 
have limited developmental capacities for understanding fully the 
trade-offs involved in today's data collection and marketing 
environment.

    Question 7. Do you think any incentives exist for children to 
refrain from revealing information about themselves or do you think 
there is momentum encouraging young people to surrender their privacy?
    Answer. Revealing information is necessary for even the most basic 
of social and developmental interactions online. The most insidious 
data collection that occurs is the through surveillance by marketers of 
interactions that teens have with their friends, family, schools etc. 
(particularly on social networks). Policy should focus on protecting 
data, involving parents, and regulating data collectors, rather than 
discouraging children from interacting.

    Question 8. You helped negotiate COPPA when it was created and so 
you are familiar with its bipartisan nature and flexibility. Do you 
believe the statute is sufficiently responsive to the challenges facing 
young people as much of their information appears to be mined and 
collected?
    Answer. Those of us who negotiated COPPA understood that we were 
dealing with a new system of online marketing and data collection that 
would be undergoing dramatic growth and change during the ensuing 
years. One of the law's purposes, from my vantage point, was to ensure 
that a system of safeguards was put in place during the earliest stage 
of ecommerce in order to guide the development of future practices and 
to establish a clear set of principles that young people needed 
protections from unfair marketing and data collection. The language in 
the original statute provides a mechanism for ongoing review by the FTC 
to ensure that these safeguards are adapted to take into account the 
evolving practices and platforms of the growing digital media and 
marketing environment. However, these FTC reviews must be thorough, 
accurate, and timely enough to ensure that this original intent is 
carried out.

    Question 9. Researchers have suggested that marketers today can 
identify in real time where kids are, who their friends are, and what 
they are doing--representing some real privacy issues. Could you 
elaborate upon how this tracking works and what it could mean for young 
people's security and privacy?
    Answer. Advances in what is called ``computational advertising'' 
now permit real-time tracking and targeting of online consumers 
(including youth) across a variety of platforms, employing a range of 
data collection and analysis techniques through cookies, tracking 
pixels, location and social networking data. ``Social media marketing'' 
applications, for example, can tap into social networks to identify a 
particular individual and his or her networks of friends (through what 
is called the ``social graph.'') Sophisticated data mining tools enable 
stealth analysis of the content and communications people post to their 
social networking profiles, including videos, photos, music, etc. These 
practices not only subject young people to increasing numbers of third 
party marketers, but also make them vulnerable to others who may be 
able to learn their location, interests and relationships. Social media 
marketing is growing very rapidly, raising a number of serious 
questions about the need for additional safeguards to protect children 
and adolescents.

    Question 10. Your testimony includes the following remark: ``Ads on 
mobile phones will be able to reach young consumers when they are near 
a particular business and offer electronic pitches and discount 
coupons.'' Does this mean that a 13-year old with a mobile device could 
receive undesired targeted ads based on her geographic location and 
proximity to a specific business? Do you believe that is problematic?
    Answer. Location targeting permits tracking and targeting of 
consumers (including youth) via their mobile devices. Increasingly as 
individuals' locations are made available to third parties, mobile 
users will be marketed to in ``real-time'' via mobile coupons and other 
offers based on where they may be at a particular time (or based on 
analysis of their moves from and to various locations over time). 
Federal policies are needed to regulate mobile marketing to both 
children adolescents, and to ensure that real-time location and other 
behavioral information is kept private. Rules are also required to 
ensure meaningful opt-in policies that clearly and prominently explain 
how the data are collected and used, as well as limits on the duration 
of location targeting consent.

    Question 11. The extent to which children understand how their 
information is being used is worth discussing. You state in your 
testimony, ``When COPPA was created, one of our concerns was to ensure 
that the ability to identify, track, and target a child--whether online 
or off--was mediated through Congressional safeguards mandating parent 
involvement. And while young people--and adults--today are being 
continually urged to make more of their personal information available 
in real-time, including their location, research indicates [that] few 
people understand how that information is being collected and used.'' 
How is young people's information being used and to what extent are 
they aware of its use and collection?
    Answer. Research at UC Berkeley and the Annenberg School for 
Communication at the University of Pennsylvania has documented that the 
majority of the public, including youth, care very much about 
protecting their privacy in the online environment. However, all online 
consumers confront a non-transparent, pervasive, and largely 
unaccountable data collection system. Many youth oriented commercial 
sites encourage youth to give up large amounts of information about 
themselves and their friends without fully explaining how that 
information will be used. A growing number of specialized data mining 
and behavioral targeting companies are tracking the behaviors of 
individuals as they conduct their daily activities on the Internet, 
including searching for health or other information, and interacting 
with friends on social networks, with very little disclosure of how the 
marketing apparatus functions.

    Question 12. You wrote in your written statement: ``Social networks 
have created privacy settings that create a false sense of security for 
teens.'' What did you mean by that remark?
    Answer. Social network privacy settings often are aimed at limiting 
how data is shared or made available to other social network users. 
They do not address how the social network, its advertisers, or third 
party applications retain and use the data. Nor may the settings be 
that effective, allowing someone who may be a casual acquaintance, but 
listed as a ``friend,'' gain access to your information. Companies such 
as Facebook and MySpace may enable users to restrict who has access to 
their profiles and activities, but these companies do not adequately 
inform users about the nature and extent of commercial practices on 
these networks, involving data collection, surveillance, and behavioral 
profiling.

    Question 13. You advocated for a regime to protect adolescents' 
privacy. How do you envision this sort of regime working? How would you 
propose it be structured?
    Answer. Adolescents should receive protections in line with the 
Fair Information Practices principles created by the OECD, as well as a 
set of more granular safeguards developed specifically for this age 
group. (See below for additional information in response to this 
question.)

    Question 14. What should the FTC or Congress do to strengthen 
children's safety and privacy online in conjunction with advanced 
technologies and mobile devices?
    Answer. The recent oversight hearing by the subcommittee chaired by 
Sen. Pryor (along with the participation of Commerce Committee 
Chairman, Sen. Rockefeller) has already helped underscore why ensuring 
protecting the privacy of young people is a key public policy concern. 
I urge the Committee to oversee the work of the FTC in this area, and 
to conduct additional hearings, including a review of the final 
recommendations made by the FTC on new COPPA implementation rules. I 
also urge the Subcommittee to conduct hearings and introduce new 
legislation designed to protect adolescent privacy online.

    Question 15. Do you agree with the direction the FTC is taking as 
it reexamines the implementation and effectiveness of COPPA?
    Answer. Through its 2010 evaluation of COPPA, the FTC is working to 
address how the implementation of the law can better protect children 
under 13. I believe the FTC should also conduct independent research to 
document how young people's data is being collected from new practices, 
including behavioral targeting and mobile marketing. Because so many of 
these practices are not transparent, the Commission should be 
encouraged and, if need be, specifically authorized, to conduct 
investigations of contemporary advertising and data collection in the 
children's digital marketplace, and should use its subpoena power to 
solicit data from industry about how it interacts with children.

    Question 16. How do you propose to improve parental supervision and 
control of children's online activity to prevent the inappropriate or 
illegal collection and use of their information?
    Answer. The FTC should include in its current review an analysis of 
how well parents are able to rely on the current parental verification 
mechanisms and whether any of these mechanism have created loopholes 
that enable marketers to target individual children inappropriately. 
This should include reviewing currently approved safe harbor regimes to 
determine whether outside parties may have access to young people's 
data.

    Question 17. If you support a regime granting rules of the road for 
adolescents' privacy, how do you envision this sort of regime working? 
How would you propose it be structured? If you do not support a regime 
governing adolescents' privacy, please explain your reasoning.
    Answer. I would support broad legislation to protect all consumers, 
based on a framework of fair information principles. Within that 
framework, additional safeguards should be established to address 
specifically the needs of youth age 13-17, who are not covered by 
COPPA. A Fair Marketing Digital Bill of Rights for Teens would balance 
the ability of young people to participate fully in the digital media 
culture--as producers, consumers, and citizens--with the governmental 
and industry obligation to ensure adolescents are not subjected to 
unfair and deceptive surveillance, data collection, and behavioral 
profiling by marketers. The onus of responsibility should not only be 
placed on youth to protect themselves, but also on the companies that 
market to them. Fair marketing and data collection rules are needed to 
help ensure that young people are socialized to be responsible 
consumers in the growing digital marketplace, and to understand their 
rights to privacy.
    While some elements of COPPA could serve as a useful model for 
adolescent online privacy policy, I do not believe the mechanism for 
parental approval is appropriate or advisable in the case of teens. The 
legislation should include:

   The principle of maximizing user control over their 
        information while minimizing data collection.

   Congressional authorization that directs the FTC to conduct 
        research, hold workshops, and develop rules to ensure consumer 
        protections for teens in digital marketing, with a special 
        focus on data collection and behavioral profiling.

   Effective, full disclosure of marketing and data collection 
        practices with meaningful opt-in:

    User-friendly, granular information that is prominently 
            displayed at times and in places where teens will read and 
            understand it.

    Opt-in mechanisms that are tailored to a variety of 
            digital platforms, including mobile, social networks, etc.

   Limitations on the amount of data, types of data, and 
        retention of data collected from adolescents for digital 
        marketing purposes.

   Limitations on behavioral profiling and targeting of 
        adolescents, as well as restrictions on other practices that 
        may take advantage of under age youth, such as sharing with 
        third parties, retargeting, location targeting, and 
        computational advertising.

   Special privacy rules for social networks, mobile, and 
        interactive games.

   Like COPPA, a government regulatory framework, along with 
        self-regulatory regimes that create a level playing field for 
        both consumers and businesses by implementing ``rules of the 
        road'' for marketing to teens.

   Mechanisms for accountability and independent assessment, 
        and fines for failure to comply with rules.

   Built in flexibility of rules to ensure continued 
        effectiveness as digital marketing practices evolve and expand.
                                 ______
                                 
     Response to Written Questions Submitted by Hon. Mark Pryor to 
                              Berin Szoka

    Thank you, Chairman Pryor, for the opportunity to supplement my 
written testimony from this hearing by responding to your questions.\1\ 
In my responses, I have incorporated some of the material found in the 
comprehensive survey of the perils of expanding COPPA's scope beyond 
its original, limited purposes (what we have called ``COPPA 2.0'') that 
my colleague Adam Thierer and I published in May 2009: COPPA 2.0: The 
New Battle over Privacy, Age Verification, Online Safety & Free 
Speech.\2\ Further detail on many of the points below can be found in 
that paper.
---------------------------------------------------------------------------
    \1\ Written Testimony of Berin Szoka, Hearing on ``An Examination 
of Children's Privacy: New Technologies & the Children's Online Privacy 
Protection Act'' before the Subcommittee on Consumer Protection, 
Committee on Commerce, Science, and Transportation, U.S. Senate, April 
29, 2010, www.pff.org/issues-pubs/testimony/2010/2010-04-29-
Szoka_Written_COPPA_Testimo
ny.pdf.
    \2\ Berin Szoka & Adam Thierer, COPPA 2.0: The New Battle over 
Privacy, Age Verification, Online Safety & Free Speech, Progress on 
Point 16.11, May 2009, http://pff.org/issues-pubs/pops/2009/pop16.11-
COPPA-and-ageverification.pdf (``COPPA 2.0'').
---------------------------------------------------------------------------
I. A Reexamination of COPPA
    It bears repeating at the outset that the Federal Trade 
Commission's (FTC) current proceeding is not examining the Children's 
Online Privacy Protection Act (``COPPA'') itself (the statute ),\3\ but 
rather the ``COPPA Rule'' (the regulations mandated by the agency 
pursuant to COPPA).\4\ The agency is well aware of this distinction--
and, indeed, far more precise about it than probably any interested 
party. For example, the agency's recent inquiry is titled ``Request for 
Public Comment on the Federal Trade Commission's Implementation of the 
Children's Online Privacy Protection Rule.'' \5\ But it is a 
distinction that is far too often lost on many advocates who are 
lobbying for change.
---------------------------------------------------------------------------
    \3\ 15 U.S.C.  6501-6506.
    \4\ 16 C.F.R. Part 312.
    \5\ Federal Trade Commission, Children's Online Privacy Protection 
Rule: Request For Public Comment on the Federal Trade Commission's 
Implementation of the Rule, 75 Fed. Reg. 17,089, April 5, 2010, http://
www.ftc.gov/os/2010/03/100324coppa.pdf (COPPA Implementation Review).
---------------------------------------------------------------------------
    Congress, of course, retains the authority to change the COPPA 
statue at any time, and it is well within the jurisdiction of this 
committee to consider doing so. But in re-examining COPPA, lawmakers 
should tread carefully. Any attempts to reopen COPPA to expand the 
statute beyond its original, limited purposes could raise serious 
constitutional questions about the First Amendment rights of adults as 
well as older teens and site and service operators, and also have 
unintended consequences for the health of online content and services 
without necessarily significantly increasing the online privacy and 
safety of children.

A. Do you think the age limit in COPPA is appropriate? And if so, why?
    Yes, and understanding why is the key to understanding the delicate 
balance of COPPA in general. The COPPA Rule's requirements are 
relatively easy for site and service operators to implement, and for 
the government to enforce, because they apply only to the collection of 
information about children under 13 by commercial operators (or the 
public sharing of information by children themselves) only when: (i) 
the operator's site or service is ``directed to children'' or (ii) the 
operator has actual knowledge that they are collecting personal 
information from a child. But the key practical difficulty in 
implementing a COPPA 2.0 system for adolescents 13 and above is in the 
anonymity inherent in the technical architecture of the Internet. To 
quote a memorable cartoon from The New Yorker: ``On the Internet, 
nobody knows you're a dog.'' \6\ Because website operators generally do 
not know who is accessing their site, requiring any special treatment 
of minors is tantamount to requiring age-verification of all users.\7\ 
Again, COPPA's ingenious solution to this problem is that the law 
applies only to the limited ``Internet Jr.'' of sites ``directed at 
children,'' or in cases where an operator has ``actual knowledge'' that 
it is dealing with a child.
---------------------------------------------------------------------------
    \6\ Peter Steiner, On the Internet, Nobody Knows You're a Dog, The 
New Yorker, July 5, 1993, at 61, available at www.unc.edu/depts/jomc/
academics/dri/idog.html (cartoon of a dog, sitting at a computer 
terminal, talking to another dog).
    \7\ Of course, the COPPA's second prong of age-verification 
requirement applies only when the website operator has ``actual 
knowledge'' that the user is a minor. 16 C.F.R.  312.3.
---------------------------------------------------------------------------
    Because ``child-oriented'' websites are generally easy to define 
and are very rarely used by adults, COPPA's age verification mandate 
has not significantly impacted the free speech rights of adults because 
few adults other than parents ever want to use these sites, and parents 
essentially are already age verifying themselves in the process of 
providing ``verifiable trial consent'' for their children (those under 
13). But it is far more difficult to define a class of ``adolescent-
oriented'' websites (i.e., ``directed at'' kids age 13-17, as proposed 
in New Jersey in 2008 \8\) that are not also used by significant 
numbers of adults. The practical result of such COPPA expansion efforts 
would be the same as simply specifying that a certain category of 
websites (such as those with a public ``wall,'' as proposed in Illinois 
in 2008 \9\) must age-verify of a large number of adults to distinguish 
adults (who do not require verifiable parental consent) from children 
(who do require verifiable parental consent). This raises profound 
First Amendment concerns--particularly about the right of Americans to 
speak and receive information anonymously online.\10\
---------------------------------------------------------------------------
    \8\ A.B. 108, Gen. Assem., 213th Leg. Sess. (N.J. 2008), 
www.njleg.state.nj.us/2008/Bills/A0500/108_I1.HTM.
    \9\ H.B. 1312, 96th Gen. Assem., Synopsis as Introduced (Il. 2007) 
[hereinafter SNWARA], available at www.ilga.gov/legislation/
billstatus.asp?DocNum=1312&GAID=10&GA=96&DocTypeID=
HB&LegID=43038&SessionID=76.
    \10\ See infra at 3-9.; see generally, COPPA 2.0, supra note 2; 
Adam Thierer, The Progress & Freedom Foundation, USA Today, Age 
Verification, and the Death of Online Anonymity, PFF Blog, Jan. 23, 
2008, http://blog.pff.org/archives/2008/01/usa_today_doesn.html. 4
---------------------------------------------------------------------------
    It was at least in part in recognition of the difficult First 
Amendment questions discussed below that Congress removed the 
requirement in the initial legislative draft of COPPA that would have 
required operators to ``use reasonable efforts to provide the parents 
with notice and an opportunity to prevent or curtail the collection or 
use of personal information collected from children over the age of 12 
and under the age of 17.'' \11\
---------------------------------------------------------------------------
    \11\ This requirement was contained in the original bill, 
Children's Online Privacy Protection Act, S. 2326, 105th Cong.  
3(a)(2)(A)(iii), (1998), but was removed when that bill was 
reintroduced in its final form. In the interim, Congress held a hearing 
at which testimony was offered by, among others, Deirdre Mulligan, on 
behalf of the Center for Democracy and Technology, which generally 
supported COPPA but argued for the very revisions that were ultimately 
made. In particular, Mulligan argued that:

    under the bill each time a 15 year old signs-up to receive 
information through e-mail his or her parent would be notified. For 
example if a 15 year old visits a site, whether a bookstore or a 
women's health clinic where material is made available for sale and 
requests information about purchasing a particular book or merely 
inquires about books on a particular subject (abuse, religion) using 
their e-mail address the teenager's parent would be notified. This may 
chill older minors in pursuit of information.

    Testimony of Deirdre Mulligan, Staff Counsel, Center for Democracy 
and Technology, before the Senate Committee on Commerce, Science, and 
Transportation Subcommittee on Communications, Sept. 23, 1998, http://
web.archive.org/web/20080327000913/http://www.cdt.org/testimony/
980923mulligan.shtml.
---------------------------------------------------------------------------
    These First Amendment concerns are not conjectural: The courts have 
already struck down precisely this kind of broad age verification 
mandates--specifically, as found in the Children's Online Protection 
Act (COPA),\12\ another 1998 law sometimes confused with COPPA. In 
essence, COPPA is focused on certain kinds of potentially harmful 
contacts while COPA is focused on potentially harmful content.\13\ COPA 
attempted to prevent children from accessing material deemed ``harmful 
to minors'' by requiring all users attempting to access such content to 
provide a credit card, on the theory that only adults have credit 
cards. But the courts concluded that, ``payment cards cannot be used to 
verify age because minors under 17 have access to credit cards, debit 
cards, and reloadable prepaid cards'' and, although ``payment card 
issuers usually will not issue credit and debit cards directly to 
minors without their parent's consent because of the financial risks 
associated with minors . . . there are many other ways in which a minor 
may obtain and use payment cards.'' \14\
---------------------------------------------------------------------------
    \12\ 47 U.S.C.  231.
    \13\ COPA makes it illegal to ``knowingly . . . make[ ] any 
communication for commercial purposes that is available to any minor 
and that includes any material that is harmful to minors.'' 47 U.S.C. 
231.
    \14\ ACLU v. Gonzales, 478 F. Supp. 2d 775, 801 (E.D. Pa. 2007) 
[hereinafter Gonzales]. COPA would have prohibited the online 
dissemination of material deemed harmful to minors under 17 for 
commercial purposes, 47 U.S.C.  231(a)(1), subject to a safe harbor 
for sites that made a ``good faith'' effort to restrict access by 
minors: ``(A) by requiring use of a credit card, debit account, adult 
access code, or adult personal identification number; (B) by accepting 
a digital certificate that verifies age; or (C) by any other reasonable 
measures that are feasible under available technology,'' 47 U.S.C.  
231(c)(1).
---------------------------------------------------------------------------
1. COPPA's Current Age Range Respects the First Amendment Rights of 
        Adults
    Besides the fact that credit cards were simply inadequate for 
proving that someone was not a child (a very different problem from 
obtaining verifiable parental consent, as discussed below), the court 
held that requiring adults to prove that they were not children by 
providing credit card information violated the First Amendment in a 
number of ways.
    First, COPA burdened the speech rights of adults to access 
information subject to age verification requirements, both by making 
speech more difficult and by stigmatizing it. In 2003, the Third 
Circuit noted that age verification requirements ``will likely deter 
many adults from accessing restricted content, because many Web users 
are simply unwilling to provide identification information in order to 
gain access to content, especially where the information they wish to 
access is sensitive or controversial .'' \15\ In 2008, in striking down 
COPA for the third and final time, the Third Circuit approvingly quoted 
the district court, which had noted that part of the reason age 
verification requirements deterred users from accessing restricted 
content was ``because Internet users are concerned about security on 
the Internet and because Internet users are afraid of fraud and 
identity theft on the Internet.'' \16\ The Supreme Court has recognized 
the vital importance of anonymous speech in the context of traditional 
publication.\17\ By imposing broad age verification requirements, COPPA 
2.0 would restrict the rights of adults to send and receive information 
anonymously just as COPA did. If anything, the speech burdened by COPPA 
2.0 deserves more protection, not less, than the speech burdened by 
COPA: Where COPA merely burdened access to content deemed ``harmful to 
minors'' (viz., pornography), COPPA 2.0 would burden access to material 
by adults as well as minors, not because that material is harmful or 
obscene, but merely because it is ``directed at'' minors! Thus, the 
content covered by COPPA 2.0 proposals could include not merely 
pornography, but communications of a political nature, which deserve 
the highest degree of First Amendment protection.
---------------------------------------------------------------------------
    \15\ ACLU v. Ashcroft, 322 F.3d 240, 259 (3d Cir. 2003) (ACLU II).
    \16\ ACLU v. Ashcroft, 534 F.3d 181, 196 (3d Cir. 2008) (ACLU III) 
(citing Gonzales, 478 F. Supp. 2d 775 at 806).
    \17\ McIntyre v. Ohio Elections Comm'n, 514 U.S. 334, 342 (1995) 
(striking down law that prohibited distribution of anonymous campaign 
literature); see also Talley v. California, 362 U.S. 60 (1960) 
(striking down a state law that forbade all anonymous leafletting).
---------------------------------------------------------------------------
    Second, COPA burdened the speech rights of operators because the 
necessary corollary of blocking adults from accessing certain content 
anonymously--and thereby deterring some users from accessing that 
content--is reducing the audience of those sites. Similarly, if COPPA's 
age ceiling were raised to cover adolescents, some websites would self-
censor themselves to avoid offering content they fear could be 
considered ``directed at'' adolescents because doing so might subject 
them to an age verification mandate for all users--or to legal 
liability if they failed to implement age verification. The substantial 
cost of age verification could significantly impact, if not make 
impossible, the razor-thin business models of many sites, which 
generally do not charge for content and rely instead on advertising 
revenues. The Third Circuit cited all of these burdens on the free 
speech rights of website operators in striking down COPA.\18\
---------------------------------------------------------------------------
    \18\ See ACLU III, 534 F.3d at 196-97 (citing Gonzales, 478 F. 
Supp. 2d 775 at 804). The Court held that websites ``face significant 
costs to implement *COPA's age verification mandates+ and will suffer 
the loss of legitimate visitors once they do so.'' Id. at 197.
---------------------------------------------------------------------------
    Third, courts held that ``[b]locking and filtering software is an 
alternative that is less restrictive than COPA, and, in addition, 
likely more effective as a means of restricting children's access to 
materials harmful to them.'' \19\ Similarly, parental control software 
already empowers parents to restrict their kids' access to websites and 
similar software is evolving for mobile services and smartphone 
software (i.e., applications or ``apps'') that would offer parents 
control over what services kids use that allow them to share their 
personal information, either with operators or with other users.
---------------------------------------------------------------------------
    \19\ Id. at 198 (quoting ACLU v. Mukasey, 534 F.3d 181, 198 
(2008)).
---------------------------------------------------------------------------
    Finally, it's worth noting that COPPA 2.0 would restrict the 
ability of adolescents to access content (in interactive contexts where 
they might also share personal information), not because it could be 
harmful to them or because it is obscene, but merely because it is 
``directed to'' them. While the First Amendment rights of minors may 
not be on par with those of adults, adolescents do have the right to 
access certain types of information and express themselves in certain 
ways.\20\ The Supreme Court has held that ``constitutional rights do 
not mature and come into being magically only when one attains the 
state-defined age of majority.'' \21\ It remains unclear how an 
expanded COPPA model might interfere with the First Amendment rights of 
adolescents, but it is clear that privacy and speech rights would come 
into conflict under COPPA 2.0, as they do in other contexts.\22\
---------------------------------------------------------------------------
    \20\ See Theresa Chmara & Daniel Mach, Minors' Rights to Receive 
Information Under the First Amendment, Memorandum from Jenner & Block 
to the Freedom To Read Foundation, Feb. 2, 2004, www.ala.org/ala/
aboutala/offices/oif/ifissues/issuesrelatedlinks/minorsrights.cfm 
(summarizing case law regarding minors' first amendment rights, 
especially in schools and in the context of mandates that public 
libraries filter Internet content); United States v. Am. Library Ass'n, 
123 S. Ct. 2297 (2003), available at laws.findlaw.com/us/000/02-
361.html (upholding the constitutionality of a filtering software 
system applicable to minors); see generally, Tinker v. Des Moines Ind. 
Comm. School Dist., 393 U.S. 503 (1969) (upholding students' rights to 
wear protest armbands and affirming that minors have speech rights), 
available at www.oyez.org/cases/1960-1969/1968/1968_21; cf. Morse v. 
Frederick, 551 U.S. 393 (2007), available at www.oyez.org/cases/2000-
2009/2006/2006_06_278/ (holding that the First Amendment rights of 
students in school and at school-supervised events are not as broad as 
those of adults in other settings).
    \21\ Planned Parenthood of Cent. Mo. v. Danforth, 428 U.S. 52, 74 
(1976) (minors' right to abortion). See also Bellotti v. Baird, 443 
U.S. 622, 635 n.13 (minors possess close to the ``full capacity for 
individual choice which is the presupposition of First Amendment 
guarantees''); Catherine Ross, An Emerging Right for Mature Minors to 
Receive Information, 2 U. Pa. J. Const. L. 223 (1999); Lee Tien & Seth 
Schoen, Reply Comments of the Electronic Frontier Foundation filed in 
Implementation of the Child Safe Viewing Act; Examination of Parental 
Control Technologies for Video or Audio Programming, MB Docket No. 
0926, Federal Communications Commission, May 18, 2009, http://
fjallfoss.fcc.gov/prod/ecfs/retrieve.cgi?native_or_pdf=pdf&id_document
=6520216901.
    \22\ See generally Solveig Singleton, Privacy Versus the First 
Amendment: A Skeptical Approach, 11 Fordham Intell. Prop. Media & Ent. 
L.J. 97 (2000), available at http://law.fordham.edu/publications/
articles/200flspub6588.pdf; Eugene Volokh, Freedom of Speech and 
Information Privacy: The Troubling Implications of a Right to Stop 
People from Speaking About You, 52 Stan. L. Rev. 1175 (2000), available 
at www.law.ucla.edu/volokh/privacy.htm.
---------------------------------------------------------------------------
    For example, how might the parental-consent based model limit the 
ability of adolescents to obtain information about ``safer sex'' or how 
to deal with trauma, depression, family abuse, or addiction? Would an 
abusive father authorize a teen to visit a website about how to report 
child abuse? Would parents of adolescents struggling with their sexual 
identity let their children participate in a self-help social 
networking page for gay and lesbian youth? \23\ The rights are at play 
here are critically important and must be balanced carefully.
---------------------------------------------------------------------------
    \23\ ``There are parents who, for a variety of reasons (political, 
cultural, or religious beliefs, ignorance of the facts, fear of being 
exposed as abusers, etc.), would deliberately prevent their teens from 
accessing social-network sites (SNS).'' Internet Safety Technical Task 
Force, Enhancing Child Safety & Online Technologies: Final Report of 
the Internet Safety Technical Task Force to the Multi-State Working 
Group on Social Networking of State Attorneys General of the United 
States, Dec. 31, 2008, Appendix F, Statement of Connect Safely, at 262, 
http://cyber.law.harvard.edu/pubrelease/isttf (listing examples of 
unintended consequences of age verification mandates) [hereinafter 
ISTTF Final Report]. Full disclosure: Adam Thierer was a member of this 
task force.
---------------------------------------------------------------------------
    Preserving the ability of adolescents to participate in online 
interactions goes beyond content that most people would recognize as 
``serious''--from the perspective of both First Amendment values and 
the education of children. As a recent MacArthur Foundation study of 
the youth Internet use concluded:

        Contrary to adult perceptions, while hanging out online, youth 
        are picking up basic social and technological skills they need 
        to fully participate in contemporary society. Erecting barriers 
        to participation deprives teens of access to these forms of 
        learning. Participation in the digital age means more than 
        being able to access ``serious'' online information and 
        culture.\24\
---------------------------------------------------------------------------
    \24\ John D. and Catherine T. MacArthur Foundation, Living and 
Learning with New Media: Summary of Findings from the Digital Youth 
Project, at 2 [hereinafter MacArthur Study] http://
digitalyouth.ischool.berkeley.edu/files/report/digitalyouth-
WhitePaper.pdf.

    Even if parents have an absolute right to block their adolescents' 
access to such data, they can better exercise that right by applying 
strict controls on the computers in their home. As discussed below, 
there are ways to encourage innovation in such parental empowerment 
tools without changing COPPA itself. But COPPA 2.0 proposals go well 
beyond recognizing parents' rights by making parental consent a 
``default'' requirement for adolescents to access a wide range of 
content--meaning that parents must ``opt-in'' on behalf of their 
children before their children can participate in sites and services 
covered by COPPA. This, in turn, burdens the ability of adolescents to 
communicate, because their parents might censor (rightly or wrongly) 
certain information, or simply fail to understand the technologies 
involved or be responsive to the opt-in requests when their kids want 
to access a new interactive site or service. But whatever the free 
speech rights of adolescents, if anyone should be interfering with 
those rights, it should be their parents--not the government.

2. COPPA's Current Age Range Allows Beneficial Communication between 
        Adolescents and Adults
    Finally, COPPA 2.0 could infringe on the free speech rights of 
adults to communicate with adolescents online by driving operators to 
segregate users by age or to attempt to block access by adolescents. As 
explained below, for the sake of marginal (if any) gains in child 
protection, we would be excluding beneficial interaction between adults 
and minors.
    The vast majority of online interactions between adults and minors 
are not of a harassing, predatory or otherwise harmful nature--indeed, 
they generally involve adults looking to help or assist minors in 
various ways. As the MacArthur Foundation study cited above concluded:

        In contexts of peer-based learning, adults . . . have an 
        important role to play, though it is not the conventionally 
        authoritative one. In friendship-driven practices, direct adult 
        participation is often unwelcome, but in interest-driven groups 
        we found a much stronger role for more experienced participants 
        to play. Unlike instructors in formal educational settings, 
        however, these adults are passionate hobbyists and creators, 
        and youth see them as experienced peers, not as people who have 
        authority over them. These adults exert tremendous influence in 
        setting communal norms and what educators might call ``learning 
        goals,'' though they do not have direct authority over 
        newcomers.\25\
---------------------------------------------------------------------------
    \25\ MacArthur Study, supra note 24, at 2.

    A substantial portion of those interactions involve parents talking 
to their own kids, older and younger siblings communicating with one 
another, teachers and mentors talking to their students, or even co-
workers of different ages communicating. Even when adult-minor 
communications involve complete strangers, there is typically a 
socially-beneficial purpose. Examples include debating politics on a 
discussion board, or collaboratively editing a Wikipedia entry, or 
communicating and collaborating on a common purpose on a Presidential 
campaign website involving millions of volunteers of all ages. There 
are countless other examples. Such interactions could be severely 
curtailed by COPPA 2.0 proposals. Restricting such interactions would 
raise profound First Amendment concerns about freedom of speech as well 
as of association.
    In any First Amendment analysis, a court must consider not only the 
free speech rights at stake and the availability of less restrictive 
alternatives to regulation, but the governmental interest being 
advanced. Again, neither COPPA nor the COPPA 2.0 proposals recently 
contemplated at the state level require exclusion of older users from a 
website, nor directly govern the sharing of personal information among 
users (where that sharing does not also constitute collection by the 
site itself). But separation of adolescents from adults is likely to be 
an indirect effect of COPPA 2.0 requirements--as COPPA 2.0 advocates 
probably realize--because, once operators are required to age-verify 
users, they will face reputational, political and potentially legal 
pressure to make interactions between adolescents and children more 
difficult in the name of ``child safety.'' More subtly, if site 
operators have an incentive to avoid having their sites be considered 
``directed at'' adolescents, they will also have an incentive to 
discourage adolescent participation on their sites--which achieves a 
similar result.
    Given the lack of strong identity records for minors, it's much 
easier for an adult to pretend to be a minor than vice versa. Thus, one 
must further ask if attempting to quarantine children from adults 
(however indirectly) actually advances, on net, a strong governmental 
interest in child protection. Such a quarantine is unlikely to stop 
adults with truly nefarious intentions from communicating with minors, 
as systems designed to exclude participation by adults in a ``kids-
only'' or ``adolescents-only'' area can be easily circumvented. The 
effect of age stratification on truly bad actors is likely to be 
marginal at best--or harmful at worst: Building walls around 
adolescents through age-verification might actually make it easier for 
predators to target teens, since a predator who gains access to a 
supposedly teen-only site will be less likely to be exposed as a 
predator than by targeting an adult the predator thinks is a teen.
    To hear some of the advocates of COPPA expansion talk about how 
teens currently behave online, one might think that online environments 
in which adolescents were left to their own devices--imagine a ``Teen 
MySpace'' for the 13-17 crowd, walled off from the rest of MySpace--
would be far worse, perhaps an online version of Lord of the Flies. 
These concerns are clearly exaggerated: The critics frequently complain 
about ``the way kids talk to each other these days'' while looking at 
their own past adolescent banter with rose-tinted glasses. What is 
clear is that adolescents (and young adults) behave better in online 
environments where adults are present, too. Perhaps the best 
demonstration of this fact has been the uproar from adolescents and 
young adults that has accompanied Facebook's explosive growth in 
popularity among older users.\26\ Many kids hate the idea of adults 
joining Facebook precisely because the presence of adults encourages 
kids to ``self-regulate'' by exercising better judgment and following 
better netiquette.\27\
---------------------------------------------------------------------------
    \26\ Justin Smith, Number of U.S. Facebook Users Over 35 Nearly 
Doubles in Last 60 Days, Inside Facebook Blog Mar. 25, 2009, 
www.insidefacebook.com/2009/03/25/number-of-us-facebook-users-over-35-
nearly-doubles-inlast-60-days/.
    \27\ See e.g., Lori Aratani, When Mom or Dad Asks To Be a Facebook 
``Friend,'' The Washington Post, Mar. 9, 2008, www.washingtonpost.com/
wp-dyn/content/article/2008/03/08/AR2008030801034.html. `` `I do not 
know if this has happened to anybody, but this morning I log on to 
Facebook and I have a new friend request!' wrote 19-year-old Mike 
Yeamans, a sophomore at James Madison University, on one of several `No 
Parents on Facebook' groups that have popped up on the site. `I am 
excited to make a new friend so I click on the link. I could not 
believe what I saw. My father! This is an outrage!' '' Id.
---------------------------------------------------------------------------
    Anne Collier, founder and executive director of the child safety 
advocacy organization Net Family News, Inc. and editor of 
NetFamilyNews.org and ConnectSafely.org, suggests that the push for 
``segregation'' by age (e.g., creating a teen-only version of Second 
Life) for safety's sake is ``losing steam'' because:

        It's a response to the predator panic teens and parents have 
        been subjected to in U.S. society, not to the realities of 
        youth on the social Web. What nearly a decade of peer-reviewed 
        academic research shows is that peer-to-peer behavior is the 
        online risk that affects many more youth, the vast majority of 
        online kids who are not already at-risk youth offline. 
        Segregating teens from adults online doesn't address 
        harassment, defamation, imposter profiles, cyberbullying, etc. 
        It may help keep online predators away from kids (even though 
        online predation, or abuse resulting from online communication, 
        constitutes only 1 percent of overall child sexual exploitation 
        . . .), which is a great outcome, but it's not enough unless 
        all that parents are worried about is predators.\28\
---------------------------------------------------------------------------
    \28\ Anne Collier, Where Will OnlineTeens Go Next?, May 1, 2009, 
www.netfamilynews.org/2009/05/where-will-online-teens-go-next.html 
(internal citations omitted). For evidence of at-risk youth, Collier 
sites the ISTTF Final Report, supra note 47. Regarding the percentage 
of all child sexual exploitation that results from online 
communication, she cites Janis Wolak, David Finkelhor & Kimberly 
Mitchell, Crimes Against Children Research Center, Trends in Arrests of 
Online Predators, 2009) www.unh.edu/ccrc/pdf/CV194.pdf; see also, Anne 
Collier, Major Update on Net predators: CACRC study, March 31, 2009, 
www.netfamilynews.org/2009/03/majorupdate-on-net-predators-mostly.html 
(summarizing study).

    Of course, adults play a critical role in disciplining interaction 
among the 0-12 age bracket, but not as direct participants in on-site 
interaction. Again, how many adults actually want to use Club Penguin, 
a site clearly geared toward the Net's youngest users? Instead, parents 
can supervise what their kids do online through parental control 
software. Parents could, of course, use that same software to monitor 
what their adolescent kids do, too. But as kids get older, most parents 
realize that the training wheels have to come off at some point. Few 
parents will want to spy on their 17-year-old until the day before the 
kid starts college (or enlists in the military or gets married). But 
most parents probably would prefer that, if their kids are interacting 
in an online environment, they think twice about what they do and say 
online. It is by no means clear that restricting online interaction 
between teens and adults will serve that end.

B. Do you think COPPA should be strengthened?
    I have seen no evidence of a need for Congress to reopen COPPA, and 
to the extent that some changes may be necessary in the implementation 
of COPPA, I believe the statute affords the FTC great flexibility in 
its definition of ``Internet,'' as discussed below, as well as in 
allowing the agency to update the definition of ``personal 
information.'' Thus, while there may be ways to improve implementation 
of the statute, I do not see a need for changing COPPA itself today.
    Moreover, Congress must be cognizant of the downsides of reopening 
COPPA and--to the extent it is expanded along the lines some of have 
advocated--raising the prospect of the entire law being struck down as 
unconstitutional because it essentially converges with COPA, as Adam 
Thierer and I have explained in our work.\29\ Again, COPPA is one of 
the few Internet laws Congress has passed over the last 15 years that 
was not challenged, blocked from taking effect, or overturned.
---------------------------------------------------------------------------
    \29\ See generally supra note 2.
---------------------------------------------------------------------------
C. Should the FTC reexamine what constitutes ``personal information'' 
        in its review of COPPA? Or do you believe that the online space 
        and the definition of personal information should remain the 
        same as it was when the law was created over 10 years ago?
    As I noted in my testimony, COPPA already gives the FTC the 
flexibility to update the definition of ``personal information'' to 
include ``any other identifier that the Commission determines permits 
the physical or online contacting of a specific individual.'' \30\ 
Because the definition of personal information also includes 
``information concerning the child or the parents of that child that 
the website collects online from the child and combines with [any of 
these identifiers],'' the statute already covers essentially all 
information tied to a particular user where it is possible to contact 
that user. This dynamic definition is broad enough to keep pace with 
technological change because it is not simply a static listing of the 
``personal information'' that was at issue in the late 1990s. For 
example, if the lodestar of ``personal information'' is the ability to 
contact a child, instant messaging screen names or social networking 
pseudonyms might qualify as ``personal information.'' In your opinion, 
what is the biggest threat to children's privacy and safety in today's 
online world?
---------------------------------------------------------------------------
    \30\ 15 U.S.C.  6501(8)(F).
---------------------------------------------------------------------------
    The biggest threat to children's online privacy and safety has 
always been, and will likely remain, the ignorance and naivete that 
necessarily comes with youth. Though children may be quite 
technologically adept, far more so than many parents, they still lack 
the real-world experience necessary to appreciate the potential privacy 
and safety implications of heedlessly giving personal information away 
to site operators or, especially, making personal information publicly 
available to other Internet users. No amount of Federal legislation or 
regulation is going to keep children from divulging personal 
information if they aren't aware of its dangers. So, as discussed 
below, if a lack of knowledge or sophistication is the problem, the 
primary answer must be education, education and more education, not 
regulation, regulation, and more regulation.\31\
---------------------------------------------------------------------------
    \31\ See infra at III.A.4.
---------------------------------------------------------------------------
D. What do you think is the most urgent update to COPPA needed?
    Again, the FTC should remove any doubt about the fundamental 
technological agnosticism of COPPA's potential coverage (actual 
coverage depending on whether, in any particular context, 
``collection'' occurs and whether the site is directed at children or 
the operator has actual knowledge that it is ``collecting'' personal 
information from a child). The FTC should also encourage the 
development of mechanisms for verifying parental consent appropriate to 
these technologies, either by recognizing additional mechanisms or 
through certifying innovative safe harbor operators. Congress could 
direct, and fund, the FTC to conduct more education about COPPA, online 
privacy and online safety.

E. In your opinion, what would constitute the most appropriate 
        definition of 
        ``sensitive data'' in the context of children's online privacy?
    COPPA already includes an excellent list of personal information:

        (A) a first and last name;

        (B) a home or other physical address including street name and 
        name of a city or town;

        (C) an e-mail address;

        (D) a telephone number;

        (E) a Social Security number; \32\
---------------------------------------------------------------------------
    \32\ 15 U.S.C.  6501(8)(A-E).

    As I noted in my testimony, COPPA already gives the FTC the 
flexibility to update the definition of ``personal information'' to 
include ``any other identifier that the Commission determines permits 
the physical or online contacting of a specific individual.'' \33\ 
Because the definition of personal information also includes 
``information concerning the child or the parents of that child that 
the website collects online from the child and combines with [any of 
these identifiers],'' the statute already covers essentially all 
information tied to a particular user such that it is possible to 
contact that user. Thus, there should be no need to specify additional 
categories of sensitive data to achieve COPPA's purposes.
---------------------------------------------------------------------------
    \33\ 15 U.S.C.  6501(8)(F).
---------------------------------------------------------------------------
F. You said in your written testimony that a ``COPPA expansion would 
        undermine privacy.'' Would you mind explaining to the Committee 
        your meaning?
    Sites that implement age verification technologies (even through 
COPPA's ``verifiable parental consent'' loose form of age verification) 
require users to share personal information about themselves. 
Specifically, adults attempting to access sites behind an age 
verification wall would have to provide information adequate to 
establish that they are not, in fact, younger than whatever the higher 
age threshold of COPPA 2.0 might be. Similarly, children attempting to 
access such sites would have to provide information about themselves 
and their parents sufficient to establish the parent-child relationship 
so that a site can reasonably evaluate documentation purporting to 
establish ``verifiable parental consent.'' Both forms of age 
verification (by adults, and by children/parents) could be accomplished 
by a number of means, but seem to be most commonly done today through 
use of a credit card.
    Today, because COPPA requires age verification only for sites 
``directed at'' children under 13 (or, in cases where an operator has 
``actual knowledge'' that a particular user is under 13), the law in 
practice requires only the second sort of age verification. But if 
COPPA were expanded to cover, say, all sites ``directed at'' 
adolescents (however defined), the law would very likely require 
certain website operators to presume that all their users might be 
``children'' whose parents' ``verifiable parental consent'' must be 
obtained prior to collection. This, in turn, would mean that large 
numbers of adults would, for the first time since COPA, be required by 
law (or at least, the website operator's interpretation of the law, 
which might tend to err on the side of caution) to age verify 
significant numbers of adults. As discussed below, this creates a 
significant burden on the First Amendment rights of adults to anonymous 
communication through interactive services that could allow public 
sharing of personal information. This would also significantly burdens 
website operators whose audience might be reduced by the apprehension 
caused by age verification mandates among users worried about having to 
provide information for certification purposes or simply by the hassle 
of having to do so. In both respects, COPPA 2.0 would raise precisely 
the same constitutional problem that caused the courts to strike down 
COPA (but that are not raised by COPPA 1.0).\34\
---------------------------------------------------------------------------
    \34\ See supra at 3-9.
---------------------------------------------------------------------------
    But such an expansion of COPPA's age scope would also undermine 
privacy by requiring the sharing of more personal information in order 
to age-verify newly covered users. The same would be true of any 
attempts to expand COPPA by specifying that it applies to certain 
categories of websites (effectively disposing of the law's ``directed 
at'' analysis). Thus, the irony of COPPA expansion is that lawmakers 
would be applying a law that was meant to protect the privacy and 
personal information of children to gather a great deal more 
information about kids, their parents, and many other adults.
    As the district court that struck down COPA noted:

        Requiring users to go through an age verification process would 
        lead to a distinct loss of personal privacy. Many people wish 
        to browse and access material privately and anonymously, 
        especially if it is sexually explicit. Web users are especially 
        unlikely to provide a credit card or personal information to 
        gain access to sensitive, personal, controversial, or 
        stigmatized content on the Web. As a result of this desire to 
        remain anonymous, many users who are not willing to access 
        information non-anonymously will be deterred from accessing the 
        desired information.\35\
---------------------------------------------------------------------------
    \35\ Gonzales, 478 F. Supp. 775, 805 (E.D. Pa. 2007).

    The same is true even for non-explicit material, such as would be 
covered by COPPA if the law's age range were expanded.

G. Do you support the FTC's review of COPPA? Do you believe it is 
        necessary?
    Yes, the FTC was well within its general operating procedures to 
accelerate its review of the COPPA Rules from 2015, the originally set 
date, to this year,\36\ and it made sense for the agency to do so, 
given the pace of change in this area. In particular, it appears from 
comments made by many in industry that the FTC needs to do more to make 
clear that COPPA is, by original Congressional design, platform-
agnostic, applying to any ``collection'' (including publication or 
sharing by users themselves) of ``personal information'' through a 
website or online service--regardless of the device used to access that 
site or service.
---------------------------------------------------------------------------
    \36\ See Federal Trade Commission, Staff Report, Beyond Voice: 
Mapping the Mobile Marketplace, April 2009, at 3, www.ftc.gov/reports/
mobilemarketplace/mobilemktgfinal.pdf; see also FTC Operating Manual,  
7.5, at 33, http://www.ftc.gov/foia/ch07rulemaking.pdf (The FTC ``has 
adopted a policy of reviewing each of its legislative rules (i.e., 
trade regulation rules and rules promulgated under special statutes) at 
least once every 10 years.'').
---------------------------------------------------------------------------
H. If you oppose expanding COPPA, do you believe it is working 
        properly? Do you believe it is sufficient to protect children's 
        privacy?
    The original goals of COPPA, as expressed by its Congressional 
sponsors, were to:

        (1) to enhance parental involvement in a child's online 
        activities in order to protect the privacy of children in the 
        online environment; (2) to enhance parental involvement to help 
        protect the safety of children in online fora such as 
        chatrooms, home pages, and pen-pal services in which children 
        may make public postings of identifying information; (3) to 
        maintain the security of personally identifiable information of 
        children collected online; and (4) to protect children's 
        privacy by limiting the collection of personal information from 
        children without parental consent.\37\
---------------------------------------------------------------------------
    \37\ 144 Cong. Rec. S11657 (daily ed. Oct. 7, 1998) (statement of 
Rep. Bryan).

    Thus, as its name implies, COPPA is generally concerned with 
protecting the privacy of children. But COPPA's primary means for 
achieving this goal is enhancing parental involvement or, as the FTC 
has put it, ``provid[ing] parents with a set of effective tools . . . 
for becoming involved in and overseeing their children's interactions 
online.'' \38\ However admirable, ``protect[ing] the safety of 
children'' is merely an indirect goal of COPPA--something to be 
achieved through the means of enhancing parental involvement (COPPA's 
direct goal).
---------------------------------------------------------------------------
    \38\ Federal Trade Commission, Implementing the Children's Online 
Privacy Protection Act: A Report to Congress at 28, Feb. 2007, 
www.ftc.gov/reports/coppa/07COPPA_Report_to_Con
gress.pdf (2007 COPPA Implementation Report).
---------------------------------------------------------------------------
    Viewed in this light, COPPA has probably been about as successful 
as could be expected given the fundamental technical reality of the 
Internet: In general, users and operators cannot, across the 
essentially infinite expanse of the digital chasm, definitively know 
how old other users are or even who they are.
    The FTC asserts COPPA ``has provided a workable system to help 
protect the online safety and privacy of the Internet's youngest 
visitors.'' \39\ Yet many of those advocating expansion of COPPA do so 
on the grounds that COPPA makes children safer from sexual predators. 
What these advocates fail to acknowledge is that, to the extent COPPA 
has enhanced child safety--indeed, to the extent that COPPA can be 
effectively administered at all--it is because of the unique 
circumstances of the under-13 age bracket and the operators that have 
evolved to serve that community. In particular:
---------------------------------------------------------------------------
    \39\ Id. at 28.

        1. The functionality of child-oriented sites is usually tightly 
---------------------------------------------------------------------------
        limited: They are walled gardens;

        2. Many smaller websites catering to children charge a fee for 
        admission--even as fee-based models have withered away on the 
        rest of the Internet; and

        3. There are relatively few sites that cater exclusively to the 
        under-13 crowd, which may be an unintended consequence of COPPA 
        itself.

I. Would you support any changes to the rule or to the statute?
    I would support changes to the statute if:

        1. It were shown that those changes were necessary to prevent a 
        demonstrable and substantial harm (not just a fear of potential 
        harm), were narrowly tailored to that harm, and were the least 
        restrictive means available for addressing that harm;

        2. Those changes could reduce the difficulty and expense of 
        complying with COPPA, thus promoting competition in the 
        marketplace for children's content and services; or

        3. Those changes could further empower parents to make 
        decisions about their children's participation in online sites 
        and services, without unduly burdening those sites and 
        services.

    But as explained throughout, I believe the FTC already has the 
tools it needs under COPPA in its current form. If the FTC needs 
anything more from Congress, it might be additional funding for 
educational efforts, encouraging new safe harbor programs, and targeted 
enforcement.

II. Privacy Implications of New Technologies

A. You said in your written statement, ``the reality is that the 
        technology for reliable age verification simply doesn't 
        exist.'' Could it exist in the future? If your claim is valid, 
        does that mean the business community, the FTC or Congress 
        should not strive to find enhanced age verification methods?
    In a February 2007 report to Congress about the status of COPPA and 
its implementation, the FTC said that no changes to COPPA were then 
necessary because the law had ``been effective in helping to protect 
the privacy and safety of young children online.'' \40\ In discussing 
the effectiveness of the parental consent verification methods 
authorized in the FTC's sliding scale approach, however, the agency 
acknowledged that ``none of these mechanisms is foolproof.'' \41\ The 
FTC attempted to distinguish these parental consent verification 
methods from other kinds of age verification tools in noting that ``age 
verification technologies have not kept pace with other developments, 
and are not currently available as a substitute for other screening 
mechanisms.'' \42\ This makes it clear that the FTC does not regard the 
methods the agency has prescribed for obtaining parental consent under 
COPPA as equivalent to strict age verification.
---------------------------------------------------------------------------
    \40\ Id., at 1.
    \41\ Id. at 13.
    \42\ Id. at 12.
---------------------------------------------------------------------------
    After years of searching for a technological ``silver bullet,'' 
especially by state attorneys general, the practical limitations and 
dangers of age verification mandates are now widely recognized. Few 
continue to argue for directly mandating verification of the age of 
minors online--or that such verification, in its strictest sense, is 
even technically feasible. Federal courts have found that there is ``no 
evidence of age verification services or products available on the 
market to owners of websites that actually reliably establish or verify 
the age of Internet users. Nor is there evidence of such services or 
products that can effectively prevent access to Web pages by a minor.'' 
\43\ Few public data bases exist that could be referenced to conduct 
such verifications for minors, and most parents do not want the few 
records that do exist about their children (e.g., birth certificates, 
Social Security numbers, school records) to become more easily 
accessible.\44\ Indeed, concerns about those records being compromised 
or falling into the wrong hands have led to legal restrictions on their 
accessibility.\45\
---------------------------------------------------------------------------
    \43\ Gonzales, 478 F. Supp. 2d 775, 806 (E.D. Pa. 2007).
    \44\ See Adam Thierer, The Progress & Freedom Foundation, Age 
Verification Debate Continues; Schools Now at Center of Discussion, PFF 
Blog, Sept. 25, 2008, http://blog.pff.org/archives/2008/09/
age_verificatio_1.html.
    \45\ Various laws and regulations have been implemented that shield 
such records from public use, including various state statutes and the 
Family Educational Rights and Privacy Act of 1974, 20 U.S.C.  1232g, 
www.ed.gov/policy/gen/guid/fpco/ferpa/index.html.
---------------------------------------------------------------------------
    There are a host of other concerns about age verification 
mandates.\46\ Some of these concerns were summarized in a recent report 
produced by the Internet Safety Technical Task Force, a blue ribbon 
task force assembled in 2008 by state attorneys general to study this 
issue:
---------------------------------------------------------------------------
    \46\ For a fuller exploration of these issues, see Adam Thierer, 
The Progress & Freedom Foundation, Social Networking and Age 
Verification: Many Hard Questions; No Easy Solutions, Progress on Point 
No. 14.5, Mar. 2007; Adam Thierer, The Progress & Freedom Foundation, 
Statement Regarding the Internet Safety Technical Task Force's Final 
Report to the Attorneys General, Jan. 14, 2008, www.pff.org/issues-
pubs/other/090114ISTTFthiererclosingstatement.pdf; Nancy Willard, Why 
Age and Identity Verification Will Not Work--And is a Really Bad Idea, 
Jan. 26, 2009, www.csriu.org/PDFs/digitalidnot.pdf; Jeff Schmidt, 
Online Child Safety: A Security Professional's Take, The Gardian, 
Spring 2007, www.jschmidt.org/AgeVerification/Gardian_JSchmidt.pdf.

        Age verification and identity authentication technologies are 
        appealing in concept but challenged in terms of effectiveness. 
        Any system that relies on remote verification of information 
        has potential for inaccuracies. For example, on the user side, 
        it is never certain that the person attempting to verify an 
        identity is using their own actual identity or someone else's. 
        Any system that relies on public records has a better 
        likelihood of accurately verifying an adult than a minor due to 
        extant records. Any system that focuses on third-party in-
        person verification would require significant political backing 
        and social acceptance. Additionally, any central repository of 
        this type of personal information would raise significant 
        privacy concerns and security issues.\47\
---------------------------------------------------------------------------
    \47\ ISTTF Final Report, supra note 23, at 10.

    But even if far more robust age verification solutions could be 
developed, they would not solve the central constitutional problem 
faced by efforts to expand COPPA's age range or scope of sites 
otherwise covered by COPPA regardless of age. This is because, in 
essence, the practical challenge under COPPA is not that children have 
to prove that they are in fact under a certain age, but two far more 
complicated problems.
    First, once the verifiable parental consent requirement is 
triggered, either because a site is ``directed at'' children or because 
the operator knows that a particular user is a child (for example, 
because they have volunteered the fact that they are under 13 years 
old), the operator must make a ``reasonable effort (taking into 
consideration available technology)'' to verify parent-child 
relationship to ensure that adequate notice is given to, and 
authorization is obtained from, someone who is in fact the parent of 
that child.\48\ This is more complicated than simply verifying the age 
of any particular user, and the statute's flexibility in exactly how 
operators are to fulfill this requirement is indicative of the 
difficulty involved.
---------------------------------------------------------------------------
    \48\ See 16 C.F.R.  312.1 (definition of ``Obtaining verifiable 
consent'').
---------------------------------------------------------------------------
    Second is the very different problem of trying to ensure that a 
particular user is not a child. This is essentially the problem faced 
by COPA, where the solution was simply to require certain kinds of 
websites to age verify all users. Again, that solution is clearly 
unconstitutional, even though the material at issue was that deemed 
``harmful to minors'' (increasing the government's interest in 
regulating communications). COPPA's ingenious way of sidestepping this 
problem is to limit broad verification mandates to sites that are 
``directed at'' children or to situations where the operator has 
``actual knowledge'' that a user is a child. (Furthermore, the 
verification required by COPPA is fundamentally different, being 
verification of ``verifiable parental consent'' rather than of the 
actual identity or age of a user.) This difference is profound, because 
it means that COPPA, in its present form, does not subject significant 
numbers of adults to age verification mandates. But, again, if the 
COPPA framework were expanded to cover older children or certain 
websites based on their functionality, COPPA would essentially converge 
with COPA by requiring large numbers of users to prove a negative: that 
they are not children.
    It is difficult to see how that problem can ever be solved because 
even if there were a reasonably reliable solution for authenticating a 
user's identity, the constitutional analysis does not hinge on the 
accuracy of age or identity verification mechanisms, but on the 
chilling effects caused by government mandates that users provide more 
information about themselves than they otherwise would have to do in 
order to access certain interactive sites or services (that could 
potentially allow sharing of personal information). Simply put, this 
does not appear to be a problem that can be solved by any amount of 
technological innovation.

III. Policy Recommendations

A. What should the FTC or Congress do to strengthen children's safety 
        and privacy online in conjunction with advanced technologies 
        and mobile devices?

1. The FTC Should Clarify COPPA's Technological Breadth
    As noted above, the FTC should remove any lingering doubt that 
COPPA is platform-agnostic. While new technologies may indeed present 
unique challenges and opportunities for ``enhancing parental 
involvement'' in the online activities of children, it should be 
uncontroversial and clear to everyone that COPPA applies to any 
technology that facilitates the ``collection'' of personal information 
over the Internet (which, again, means not only collection by operators 
for advertising or other purposes but also simply enabling users to 
make personal information publicly available). This is simply the plain 
reading of the statute. COPPA defines the key term ``Internet'' broadly 
to mean:

        collectively the myriad of computer and telecommunications 
        facilities, including equipment and operating software, which 
        comprise the interconnected world-wide network of networks that 
        employ the Transmission Control Protocol/Internet Protocol, or 
        any predecessor or successor protocols to such protocol, to 
        communicate information of all kinds by wire or radio.\49\
---------------------------------------------------------------------------
    \49\ 15 U.S.C.  6501(6).

---------------------------------------------------------------------------
    In its 1999 COPPA rulemaking, the Commission declared that:

        The proposed Rule's definition of ``Internet'' made clear that 
        it applied to the Internet in its current form and to any 
        conceivable successor. Given that the technology used to 
        provide access to the Internet will evolve over time, it is 
        imperative that the Rule not limit itself to current access 
        mechanisms.\50\
---------------------------------------------------------------------------
    \50\ Children's Online Privacy Protection Rule, 64 Fed. Reg. 
59,888, 59,891 (Nov. 3, 1999), available at www.ftc.gov/os/1999/10/
64fr59888.pdf.

    The Commission rejected a commenter's suggestion that the agency 
``clarify that the definition `clearly includes networks parallel to or 
supplementary to the Internet such as those maintained by the broadband 
providers . . . [and] intranets maintained by online services which are 
either accessible via the Internet or have gateways to the Internet.''' 
The Commission concluded that its ``definition of `Internet' was 
[already] sufficiently broad to encompass such services and adopts that 
definition in the final Rule.\51\ The Commission has subsequently 
incorporated this language into its FAQ, which serves as its primary 
interpretive guide for those interested in understanding application of 
the rule (especially small site operators):
---------------------------------------------------------------------------
    \51\ Id.

        The Rule's Statement of Basis and Purpose makes clear that the 
        term Internet is intended to apply to broadband networks, as 
        well as to intranets maintained by online services that either 
        are accessible via the Internet, or that have gateways to the 
        Internet.\52\
---------------------------------------------------------------------------
    \52\ Federal Trade Commission, Frequently Asked Questions about the 
Children's Online Privacy Protection Rule, Question 6 (``What types of 
online transmissions does COPPA apply to?''), www.ftc.gov/privacy/
coppafaqs.shtm.

    As a matter of statutory construction, this interpretation is 
probably correct and would probably receive deference from a court 
under the Chevron doctrine if challenged.\53\ This interpretation would 
allow the FTC to apply COPPA's requirements to services like text 
messaging and Massively Multiplayer Online (MMO) games like World of 
Warcraft and Second Life that are ``accessible via the Internet,'' 
regardless of the device used to access them.
---------------------------------------------------------------------------
    \53\ Chevron U.S.A., Inc. v. Natural Res. Defense Council, Inc., 
467 U.S. 837 (1984) (required Federal courts to defer to an agency's 
interpretation of a statute, so long as the interpretation was 
``reasonable'').
---------------------------------------------------------------------------
2. The FTC Should Promote Flexibility in COPPA Compliance
    The FTC should take into consideration the unique challenges and 
opportunities raised by new devices and services in deciding how to 
implement COPPA. Alternative means of establishing verifiable parental 
consent may work much better for the technologies, devices, and 
services of tomorrow, and the FTC will probably hear in great detail 
about this issue at its roundtable and in comments filed in response to 
its Implementation Review. In deciding how to respond to those 
suggestions, the FTC should aim to maximize the flexibility available 
to online operators to comply with COPPA, and to simplify the process 
wherever possible for parents and children. Where parents have already 
given effective consent for their children to use a particular 
service--for example, by paying for a text message plan as part of the 
monthly service for a cell phone--there may be no need to impose 
additional requirements because COPPA's goal of ``enhancing parental 
involvement'' through parental consent has already been achieved. More 
granular controls (say, blocking texting to a particular number) may be 
quite valuable to parents but they are probably beyond the purview of 
COPPA and, in any event, are already being offered by many service 
providers in response to parental demand.\54\ This suggests the 
marketplace is already working to empower parents, which is, after all, 
COPPA's primary purpose.
---------------------------------------------------------------------------
    \54\ See, e.g., Verizon Wireless, Usage Controls, https://
wbillpay.verizonwireless.com/vzw/nos/uc/uc_home.jsp (describing 
parental control tools available to parents including blocking numbers, 
time restrictions and usage filters); https://
wbillpay.verizonwireless.com/vzw/nos/uc/uc_content_filter.jsp (content 
filters); see generally http://parentalcontrolcenter.com/#_self; http:/
/www.wireless.att.com/learn/articles-resources/parentalcontrols/
index.jsp; http://shop.
sprint.com/en/services/safety_security/parental_control.shtml.
---------------------------------------------------------------------------
    In particular, the FTC could use the discretion afforded to it by 
the statute to certify more ``safe harbor'' operators, whose self-
regulatory guidelines would be deemed to be sufficient to establish 
compliance with COPPA. For example, as children under 13 increasingly 
have their own ever more sophisticated mobile phones,\55\ wireless 
carriers and mobile operating system developers might collaborate on a 
standardized system that requires verifiable parental consent upon the 
initial purchase of a mobile phone service plan or addition of certain 
options, like text messaging or data service but that also provides 
parents control over which applications their children install on their 
phones. Such a system might work by, for instance, giving parents a 
password-protected account upon the initial verification of their 
consent for the service plan, and then allowing them to easily grant 
consent for their children to install applications in the future, keep 
track of those applications for which they have already granted 
consent, access information collected by those applications, review the 
privacy policies of those applications, or revoke their consent as they 
see fit. Such a system is, at least in theory, exactly what 
policymakers should aim to enable, but it may should be required by 
COPPA. The ultimate goal should be to encourage companies to empower 
parents to manage, as easily as possible, their children's 
participation in online activities that could entail the sharing of 
personal information--which is what parents are already demanding in 
the marketplace. But such a highly complex system should be designed 
and managed by the private sector, not the government, and this is 
precisely what the safe harbor program provided for by COPPA would 
allow the FTC to do to the extent consistent with COPPA's scope.
---------------------------------------------------------------------------
    \55\ Amanda Lenhart, Rich Ling, Scott Campbell, Kristen Purcell, 
Teens and Mobile Phones, April 20, 2010, http://www.pewinternet.org/
Reports/2010/Teens-and-Mobile-Phones.aspx.
---------------------------------------------------------------------------
    Concretely, lawmakers might encourage the FTC to issue a call to 
industry for new safe harbor proposals, to work with industry to 
support the development of these proposals, and then perhaps issue a 
consolidated notice about these proposals in order to expedite the 
notice and comment process required by the statute before the agency 
may grant approval to any new safe harbor program. More such 
suggestions will, no doubt, come out of the COPPA Roundtable and 
comments, and Congress should encourage the FTC to heed such 
suggestions.
    Or, the FTC could, as the Implementation Review contemplates, allow 
operators, at least in some circumstances, to use ``an automated system 
of review and/or posting'' to satisfy the existing ``deletion exception 
to the definition of collection.'' \56\ In other words, sites could 
potentially allow children to communicate with each other through chat 
rooms, message boards, and other social networking tools without having 
to obtain verifiable parental consent if they had in place algorithmic 
filters that would automatically detect personal information such as a 
string of seven or ten digits that seems to correspond to a phone 
number, a string of eight digits that might correspond to a Social 
Security number, a street address, a name, or even a personal photo--
and prevent children from sharing that information in ways that make 
the information ``publicly available.'' Such a technology would, of 
course, not be foolproof, and might be circumvented by children smart 
enough to find other ways to share information that the algorithm will 
prevent them from sharing. Yet despite these limitations, the FTC 
should encourage the development of such technologies because they 
could allow sites to meet COPPA's central goal of limiting the sharing 
of information that could allow the contacting or identification of a 
child without going through COPPA's intentionally (or at least, 
necessarily) cumbersome parental consent verification procedures. This 
would benefit kids and operators alike by facilitating communication 
with less risk to children's online privacy or safety.
---------------------------------------------------------------------------
    \56\ COPPA Implementation Review, supra note 5, Question 9a.
---------------------------------------------------------------------------
3. Enhanced Enforcement Is Generally Preferable to Expanded Regulation
    Besides promoting empowerment solutions, the FTC should of course 
be vigilant about a second ``E-word'': enforcement. As a general 
matter, before rushing to change an existing regulatory regime or give 
an agency new powers, Congress should always ask whether the laws on 
the books are being given a chance to succeed. Specifically, Congress 
should consider whether the FTC has the staffing, technological and 
financial resources it needs to enforce COPPA's requirements 
effectively.

4. Education is Vitally Important
    Finally, the FTC should be encouraged--and funded--to make maximum 
use of the final ``E-word'': education. We can and should provide 
parents with more and better tools to make informed decisions about 
media and communications tools in their lives and the lives of their 
children. But technical tools can only supplement--they can never 
supplant--education, parental guidance, and better mentoring. Education 
and mentoring are the most essential part of the solution to concerns 
about online child privacy and safety. We can, and must, do more as 
parents and as a society to guide our children's behavior and choices 
online. The FTC has a track record of great success in this area, 
including:

   OnGuard Online, the website intended to educate all Internet 
        users about online safety

   NetCetera, the FTC's excellent child safety effort

   The ``You Are Here'' virtual mall launched by the FTC last 
        year to educate kids in 5th-8th grade (ages 10-14) about 
        marketing both online and offline.

   AdMongo, a game-tutorial website intended to teach kids 
        about advertising and marketing, both online and offline, to 
        help them become smarter consumers. The service includes a 
        discussion of how information is used for advertising purposes 
        online.

    In addition, Congress could fund a number of grants for educational 
efforts intended to educate kids and parents about online privacy and 
safety. This approach is exemplified by Rep. Wasserman Schultz's 
currently pending ``Adolescent Web Awareness Requires Education Act 
(AWARE Act)'' (H.R. 3630), which would create a education grant program 
to address issues of cybercrime affecting children, including cyber 
bullying, in schools and communities.\57\ Indeed, The ``Protecting 
Children in the 21st Century Act,'' which was signed into law by 
President Bush in 2008 as part of the ``Broadband Data Services 
Improvement Act,'' \63\ required that the Federal Trade Commission 
(FTC) ``carry out a nationwide program to increase public awareness and 
provide education'' to promote safer Internet use and:
---------------------------------------------------------------------------
    \57\ Adolescent Web Awareness Requires Education Act, H.R. 3630, 
111th Cong. (2009), available at www.opencongress.org/bill/111-h3630/
show.

        utilize existing resources and efforts of the Federal 
        Government, State and local governments, nonprofit 
        organizations, private technology and financial companies, 
        Internet service providers, World Wide Web-based resources, and 
        other appropriate entities, that includes: (1) identifying, 
        promoting, and encouraging best practices for Internet safety; 
        (2) establishing and carrying out a national outreach and 
        education campaign regarding Internet safety utilizing various 
        media and Internet-based resources; (3) facilitating access to, 
        and the exchange of, information regarding Internet safety to 
        promote up to-date knowledge regarding current issues; and, (4) 
        facilitating access to Internet safety education and public 
        awareness efforts the Commission considers appropriate by 
        States, units of local government, schools, police departments, 
---------------------------------------------------------------------------
        nonprofit organizations, and other appropriate entities.

    Education-based approaches are vital because they can help teach 
kids how to behave in--or respond to--a wide variety of situations. 
Education teaches lessons and builds resiliency, providing skills and 
strength that can last a lifetime. That was the central finding of a 
blue-ribbon panel of experts convened in 2002 by the National Research 
Council of the National Academy of Sciences to study how best to 
protect children in the new, interactive, ``always-on'' multimedia 
world. Under the leadership of former U.S. Attorney General Richard 
Thornburgh, the group produced a massive report that outlined a 
sweeping array of methods and technological controls for dealing with 
potentially objectionable content and online dangers. Ultimately, 
however, the experts used a compelling metaphor to explain why 
education was the most important strategy on which parents and 
policymakers should rely:

        Technology--in the form of fences around pools, pool alarms, 
        and locks--can help protect children from drowning in swimming 
        pools. However, teaching a child to swim--and when to avoid 
        pools--is a far safer approach than relying on locks, fences, 
        and alarms to prevent him or her from drowning. Does this mean 
        that parents should not buy fences, alarms, or locks? Of course 
        not--because they do provide some benefit. But parents cannot 
        rely exclusively on those devices to keep their children safe 
        from drowning, and most parents recognize that a child who 
        knows how to swim is less likely to be harmed than one who does 
        not. Furthermore, teaching a child to swim and to exercise good 
        judgment about bodies of water to avoid has applicability and 
        relevance far beyond swimming pools--as any parent who takes a 
        child to the beach can testify.\58\
---------------------------------------------------------------------------
    \58\ Computer Science and Telecommunications Board, National 
Research Council, Youth, Pornography, and the Internet (National 
Academy Press, 2002) at 224, www.nap.edu/
openbook.php?isbn=0309082749&page=224.

    Regrettably, we often fail to teach our children how to swim in the 
``new media'' waters. Indeed, to extend the metaphor, it is as if we 
are generally adopting an approach that is more akin to just throwing 
kids in the deep end and waiting to see what happens. Educational 
initiatives are essential to rectifying this situation.

B. Do you agree with the direction the FTC is taking as it reexamines 
        the implementation and effectiveness of COPPA?
    It's still probably too early to say with any certainty what that 
direction is--especially on the eve of the FTC's COPPA Roundtable. In 
general, I am encouraged by the tone of the FTC's official statements 
in this proceeding, and also by the oral statements of FTC staff at 
recent events. They appear to have a healthy understanding of the 
limitations as well as the advantages of COPPA, as well as a healthy 
sensitivity to the potential effects on the competitiveness of the 
landscape for children's content and services.
    I'm particularly encouraged to see that the implementation review 
begins by asking about the ongoing need for the rule, its costs and 
benefits, and its unintended effects. This is precisely the right way 
to begin any inquiry into the implementation of regulations. COPPA has 
undoubtedly succeeded in its primary goal of enhancing parental 
involvement in their child's online activities in order to protect the 
privacy and safety of children online.\59\ Yet these benefits have come 
at a price, since the costs of obtaining verifiable parental consent 
and otherwise complying with COPPA have, on the one hand, discouraged 
site and service operators from allowing children on their sites or 
offering child-oriented content, and, on the other hand, raised costs 
for child-oriented sites. The average cost of compliance may well have 
fallen from the estimate provided to the FTC in 2005 ($45/child),\60\ 
but even substantially lower costs on the order of $5-10 per child 
could represent a significant barrier to entry by sites that must rely, 
as most online sites and services do, on advertising revenues of 
scarcely more than that--and profit margins far less than that--per 
user per year. We must be realistic about these costs and the trade-
offs involved in regulation. At some point, raising the cost of age 
verification for sites is simply no longer worth the marginal benefit 
to enhanced parental involvement and, indirectly, online child privacy 
and safety, because these values must compete with other values of 
parents and children, such as the competitiveness, creativity, 
innovation and diversity in media and tools available to children 
online. COPPA in its current form probably strikes a reasonable 
balance, but as noted above, there may indeed be things that the FTC 
can do to lower the costs of compliance for operators, thus allowing us 
to achieve COPPA's goals at a lower cost to kids and parents in 
foregone content and services. I am also pleased that the 
Implementation Review asks about the need to update the ``sliding 
scale'' of parental consent verification methods and to offer greater 
flexibility to site operators, as noted above.
---------------------------------------------------------------------------
    \59\ See COPPA 2.0, supra note 2 at 11.
    \60\ See Comments of Parry Aftab, Request for Public Comment on the 
Implementation of COPPA and COPPA Rule's Sliding Scale Mechanism for 
Obtaining Verifiable Parental Consent Before Collecting Personal 
Information from Children at 2, June 27, 2005, www.ftc.gov/os/comments/
COPPArulereview/516296-00021.pdf.
---------------------------------------------------------------------------
    But I do worry that the Commission has explicitly invited proposals 
for legislative changes to the statute itself. Two questions from the 
Review are particularly troubling:

        6. Do the definitions set forth in Part 312.2 of the Rule 
        accomplish COPPA's goal of protecting children's online privacy 
        and safety? . . .

        28. Does the commenter propose any modifications to the Rule 
        that may conflict with the statutory provisions of the COPPA 
        Act? For any such proposed modification, does the commenter 
        propose seeking legislative changes to the Act?

    Note that question #6 does not include the critical limitation 
``consistent with the Act's requirements,'' which appears no less than 
17 times in subsequent questions about specific aspects of the current 
rules. Whatever the FTC intended by this omission, when combined with 
question #28, it will be taken as an open invitation by many commenters 
to propose not just changes in how the COPPA rules are implemented, but 
wholesale revisions to the COPPA statute itself.
    Ultimately, it is the responsibility of Congress, not the FTC, to 
make decisions about modifying the statute. If Congress wants an agency 
to spend taxpayer resources evaluating whether a substantial change to 
the agency's statutory authority is warranted, Congress is perfectly 
capable of authorizing, and appropriating funds for, such an inquiry. 
This is precisely what Congress recently did in the Child Safe Viewing 
Act, when it specifically asked the Federal Communications Commission 
(FCC) to prepare a report on online child safety issues.\61\ Similarly, 
the Recovery Act of 2009 charged the FCC with preparing a national 
broadband plan.\62\ Or, where less substantial statutory changes are at 
issue, the Congressional Committee with jurisdiction could request that 
an agency prepare a report to advise that committee. But as a general 
matter, regulatory agencies should not be in the business of 
reassessing the adequacy of their own powers, since the natural impulse 
of all bureaucracy is to grow, and it is through our elected 
representatives in Congress, not regulatory agencies--even those with 
the best of intentions--that ``We People'' are ultimately represented 
in deciding how to regulate the online (and offline) world.\63\
---------------------------------------------------------------------------
    \61\ Child Safe Viewing Act, S. 602, 110th Cong. (2007).
    \62\ American Recovery and Reinvestment Act of 2009, Pub. L. No. 
111-5, 123 Stat. 115 (2009) (codified at 47 U.S.C. 1305) (``2009 
Recovery Act''); see also, A National Broadband Plan for Our Future, GN 
Docket No. 09-51, Notice of Inquiry, 24 FCC Rcd. 4342 (2009) (``NOI'').
    \63\ See, e.g., Super-Sizing the FTC & What It Means for the 
Internet, Media & Advertising, PFF Briefing, at 22-23, April 16, 
www.pff.org/issues-pubs/pops/2010/pop17.6-transcript.pdf.
---------------------------------------------------------------------------
    Finally I was surprised not to find a single mention of the word 
``education'' in the FTC's Implementation Review Request for Comments. 
As explained above, just about everyone involved in debates about 
online child safety and privacy would agree that the solution begins 
with education--even if it doesn't end there. One might have thought 
the FTC would ask about whether effective implementation of COPPA's 
goals required more education efforts rather than (or perhaps in 
combination with) ``stronger'' regulations. Again, a layered approach 
of education, empowerment and enforcement is the best way to enhance 
the privacy and safety of children online, but education is truly the 
key.

Related PFF Publications
    Written Testimony to the Senate Committee on Commerce, Science, and 
Transportation's Subcommittee on Consumer Protection on ``An 
Examination of Children's Privacy: New Technologies & the Children's 
Online Privacy Protection Act'', April 29, 2010.
    COPPA 2.0: The New Battle over Privacy, Age Verification, Online 
Safety & Free Speech, Berin Szoka & Adam Thierer, Progress on Point 
16.11, May 2009.
    Written to Maine Legislature on Act to Protect Minors from 
Pharmaceutical Marketing Practices, LD 1677, Berin Szoka, March 4, 
2010.
    Parental Controls & Online Child Protection: A Survey of Tools & 
Methods, Adam Thierer, Special Report, Version 4.0, Fall 2008.
    Five Online Safety Task Forces Agree: Education, Empowerment & 
Self-Regulation Are the Answer, Adam Thierer, Progress on Point 16.13, 
July 8, 2009.
    The Perils of Mandatory Parental Controls and Restrictive Defaults, 
Adam Thierer, Progress on Point 15.4, April 11, 2008.
    Written Testimony to House Committee on the Judiciary on Cyber 
Bullying and other Online Safety Issues for Children, Berin Szoka & 
Adam Thierer, Sept. 30, 2009.
    Privacy Trade-Offs: How Further Regulation Could Diminish Consumer 
Choice, Raise Prices, Quash Digital Innovation & Curtail Free Speech, 
Comments of Berin Szoka to FTC Exploring Privacy Roundtable, Nov. 2009.
    Privacy Polls v. Real-World Trade-Offs, Berin Szoka, Progress 
Snapshot 5.10, Oct. 2009.
    Online Advertising & User Privacy: Principles to Guide the Debate, 
Berin Szoka & Adam Thierer, Progress Snapshot 4.19, Sept. 2008.
    Targeted Online Advertising: What's the Harm & Where Are We 
Heading?, Berin Szoka & Adam Thierer, Progress on Point 16.2, April 
2009.
    How Financial Overhaul Could Put the FTC on Steroids & Transform 
Internet Regulation Overnight, Berin Szoka, Progress Snapshot 6.7, 
March 2010.

                                 ______
                                 
                               Attachment
                     Do Smart Phones = Smart Kids?

  The Impact of the Mobile Explosion on America's Kids, Families, and 
                                Schools

                    A Common Sense Media White Paper

                     April 2010/Common Sense Media

    Mobile technology is dramatically changing life for all of us, but 
especially for the earliest adopters of all things digital--our kids. 
Mobile phones and devices give kids many new opportunities for 
entertainment, engagement, and creativity, and make it easier to stay 
connected--including with mom and dad. Unfortunately, the 24/7 access-
anywhere world of mobile also makes parenting even more complicated, 
and many adults worry about the growing challenge of managing the 
content, applications, and connections kids now have at their 
fingertips.
    In 1983, the first cell phones weighed 28 ounces, measured 10 
inches high, and sold for thousands of dollars. Today's mobile phones 
are often smaller than a deck of cards, weigh less than four ounces, 
and are often free as part of a one- or two-year contract. 
Increasingly, they offer touchscreens, GPS navigation, music, video, 
cameras, e-mail, and Internet browsing, not to mention the ability to 
download hundreds of thousands of applications and games.
    In 1985, there were about 200,000 cell phone subscribers in the 
United States. Today, there are more than 286 million subscribers,\1\ 
and nearly nine in 10 (87 percent) Americans own a cell phone.\2\ More 
than 50 million of them own smartphones and wireless enabled PDAs.\3\ 
In addition, purchases of WiFi-enabled devices such as cameras, game 
players, and media players, are expected to increase from 108 million 
in 2009 to 177 million in 2013.\4\
---------------------------------------------------------------------------
    \1\ http://www.ctia.org/media/press/body.cfm/prid/1936.
    \2\ http://www.marketingcharts.com/interactive/employment-age-top-
factors-in-cell-phone-pda-use-9678/.
    \3\ http://www.ctia.org/media/press/body.cfm/prid/1936.
    \4\ http://www.instat.com/press.asp?ID=2694&sku=IN0904521WBB.
---------------------------------------------------------------------------
    Increasingly, these handheld devices are becoming miniature 
computers, enabling users to access information and resources from 
anywhere. One sign of this change is the growth of mobile 
applications--2.3 billion apps were downloaded in the past year alone, 
and more than five billion will be downloaded per year by 2014.\5\
---------------------------------------------------------------------------
    \5\ http://news.softpedia.com/news/Five-Billion-Mobile-Apps-
Downloaded-by-2014-130189.shtml.
---------------------------------------------------------------------------
Mobile Kids
    In 2004, 45 percent of teens had a cell phone; by 2009, it was 75 
percent.\6\ The fastest growth has been among younger teens:
---------------------------------------------------------------------------
    \6\ http://www.pewinternet.org/Reports/2009/14_Teens-and-Mobile-
Phones-Data-Memo.aspx.

   In 2004, just 18 percent of 12 year olds had a cell phone, 
---------------------------------------------------------------------------
        compared to 64 percent of 17 year olds.

   In 2009, 58 percent of 12 year olds had a cell phone, 
        compared to 83 percent of 17 year olds.\7\
---------------------------------------------------------------------------
    \7\ http://www.pewinternet.org/Reports/2010/Social-Media-and-Young-
Adults.aspx.

    Mobile phone usage is also growing rapidly among younger children. 
Twenty percent of U.S. children ages 6-11 currently own a cell phone, 
up from 11.9 percent of children in 2005.\8\
---------------------------------------------------------------------------
    \8\ http://www.npd.com/press/releases/press_080625.html.

   U.S. teens (ages 13 to 17) send or receive an average of 
        3,146 text messages a month, and kids 12 and under send 1,146 
        texts per month.\9\
---------------------------------------------------------------------------
    \9\ http://blog.nielsen.com/nielsenwire/online_mobile/under-aged-
texting-usage-and-actual-cost/.

   More than a third of teens download ringtones, IM, or use 
---------------------------------------------------------------------------
        the mobile web.

   About a quarter download games and applications.

   16 percent use location-based services on their phones.\10\
---------------------------------------------------------------------------
    \10\ http://blog.nielsen.com/nielsenwire/online_mobile/breaking-
teen-myths/.




Other Digital Devices
    Most teens use computers to go online, but increasingly, they're 
also going online with their mobile devices.

   27 percent of teen cell phone users use their phone to go 
        online.

   24 percent of teens with a game console (like a PS3, Xbox or 
        Wii) use it to go online.

   19 percent of teens with a portable gaming device use it to 
        go online.\11\
---------------------------------------------------------------------------
    \11\  http://www.pewinternet.org/Reports/2010/Social-Media-and-
Young-Adults.aspx.

    Just over half of teens (51 percent) own a portable gaming device 
like a PSP or a Gameboy. Younger teens are more likely to have them (66 
percent of 12-13 year olds, compared to 44 percent of 14-17 year 
olds).\12\ Kids can use these devices to download TV shows and movies, 
surf the web, listen to music, and send instant messages.\13\ 
Similarly, while the iPod Touch is not a smartphone, it enables users 
to text, access the web, and download apps. Sixty-five percent of iPod 
Touch users are 17 or younger.\14\
---------------------------------------------------------------------------
    \12\ http://www.pewinternet.org/Reports/2010/Social-Media-and-
Young-Adults.aspx.
    \13\ http://us.playstation.com/psp/fullfeatured/index.htm.
    \14\ AdMob--January 2010 Mobile Metrics Report. http://
metrics.admob.com/.
---------------------------------------------------------------------------
How Kids Are Using Mobile Tech
The Good News
    A variety of recent studies have shown that integrating technology 
into schools can boost achievement in mathematics, literacy, and 
reading.\15\
---------------------------------------------------------------------------
    \15\ http://www.iste.org/Content/NavigationMenu/Advocacy/Policy/
59.08-PolicyBrief-F-web.pdf.

   In four North Carolina schools in low-income neighborhoods, 
        9th- and 10th-grade students were given smartphones and special 
        software to help with their algebra studies. They used the 
        phones for a variety of tasks, including recording themselves 
        solving problems and posting the videos to a private social 
        networking site for their classmates. Students with the phones 
        performed 25 percent better on the end-of-the-year algebra exam 
        than students without the devices in similar classes.\16\
---------------------------------------------------------------------------
    \16\ http://www.nytimes.com/2009/02/16/technology/
16phone.html?_r=1.

   A new study in the U.K. found that text messaging helped 
        children develop ``phonological awareness'' which is key to 
        learning how to spell. The kids who text more often (especially 
        those who use abbreviations such as ``plz'' or ``4ever'') 
        showed higher scores on spelling exams. Researchers also found 
        that kids who received mobile phones at younger ages were 
        better at reading words and identifying patterns of sound in 
        speech.\17\
---------------------------------------------------------------------------
    \17\ http://www.britac.ac.uk/news/news.cfm/newsid/14.

   Teachers in Escondido Union School District in California 
        are exploring the use of iPods to improve student reading. 
        Students can record and then hear themselves reading, which 
        helps them work on fluency and comprehension. Teachers can 
        import student recordings and create time-stamped digital 
        portfolios to track progress. Data from a group of fourth-
        graders has found that using iPods to practice reading resulted 
        in more rapid improvement rates compared with a control 
        classroom.\18\
---------------------------------------------------------------------------
    \18\ See Appendix A_http://www.joanganzcooneycenter.org/pdf/
pockets_of_potential.pdf.

    More generally, there are a number of ways that mobile devices can 
---------------------------------------------------------------------------
improve education:

   Mobile devices allow students to gather, access, and process 
        information outside the classroom, and can help bridge school, 
        afterschool, and home environments.

   Because of their relatively low cost, handheld devices can 
        help level the digital playing field, reaching and inspiring 
        children from economically disadvantaged communities.

   Mobile devices can support personalized learning 
        experiences, and adapt to the individual needs of learners.\19\
---------------------------------------------------------------------------
    \19\ http://www.joanganzcooneycenter.org/pdf/
pockets__of_potential.pdf.
---------------------------------------------------------------------------
The Bad News
Cyberbullying
    43 percent of kids admit to being cyberbullied, but only 10 percent 
tell someone about it.
    Cyberbullying is when someone repeatedly harasses, mistreats, or 
makes fun of another person online or while using cell phones or other 
electronic devices.

   Cyberbully 411 reports that 40 percent of kids say they were 
        cyberbullied through instant messenger services; 30 percent 
        said it happened on social networking sites; 29 percent said it 
        happened while playing online games.

   Cyberbullying is especially prevalent in middle school-aged 
        kids (9-14).\20\
---------------------------------------------------------------------------
    \20\ http://www.commonsensemedia.org/protecting-kids-cyberbullying.
---------------------------------------------------------------------------
Sexting
    22 percent of teen girls (ages 13-19) say they have sent nude or 
semi-nude photos or video of themselves, either online or via text 
messages.

   Messages are even more prevalent than images. Thirty-nine 
        percent of teen boys and girls say they have sent sexually 
        suggestive messages (text, e-mail, IM), and 48 percent of teens 
        say they've received them.

   Kids who sext may face criminal charges for child 
        pornography or other violations, and could be required to 
        register as sex offenders.\21\
---------------------------------------------------------------------------
    \21\ http://www.thenationalcampaign.org/sextech/PDF/
SexTech_Summary.pdf.
---------------------------------------------------------------------------
Distracted Driving
    In 2007, AAA reported that 21 percent of fatal car crashes 
involving teens between the ages of 16 and 19 were the result of cell 
phone usage.
    According to the National Highway Traffic Safety Administration, in 
2008 there were 5,870 fatalities and an estimated 515,000 injuries in 
police-reported crashes involving driver distraction, and the highest 
incidence of distracted driving occurs in the under-20 age group.\22\
---------------------------------------------------------------------------
    \22\ http://www.nhtsa.dot.gov/staticfiles/DOT/NHTSA/NRD/Multimedia/
PDFs/Human%20Factors/Reducing%20Unsafe%20behaviors/811216.pdf.

   34 percent of texting teens ages 16-17 say they have texted 
---------------------------------------------------------------------------
        while driving.

   52 percent of cell-owning teens ages 16-17 say they have 
        talked on a phone while driving.\23\
---------------------------------------------------------------------------
    \23\ http://pewinternet.org/Reports/2009/Teens-and-Distracted-
Driving.aspx.
---------------------------------------------------------------------------
Cheating
    More than 35 percent of teens with cell phones admit to using their 
cell phones to cheat.
    Kids have always found ways to cheat in school, but now they have 
more powerful tools.

   45 percent of teens say texting friends about answers during 
        tests is a serious cheating offense, but 20 percent say it's 
        not cheating at all.

   69 percent of schools have policies that don't permit cell 
        use, but more than half of all kids ignore them.\24\
---------------------------------------------------------------------------
    \24\ http://www.commonsensemedia.org/cheating-goes-hi-tech.
---------------------------------------------------------------------------
Location-Based Technology
Mobile phones with GPS capabilities can expose a kid's exact location. 
        Many new programs and apps have been developed that allow kids 
        to announce their physical whereabouts. This creates physical 
        safety concerns.
    If a kid shares location info to ``friends,'' that information can 
be passed along to unintended audiences. Privacy concerns are also a 
huge issue. Marketers use geolocation technology to target kids with 
promotions. A child's purchasing habits will be registered and personal 
data collected. Location-based technology raises several critical 
questions and concerns:

   Should mobile geolocation data, persistent IP addresses, and 
        other identifying information be protected for children under 
        age 13--in the same way that name, age, gender, and address 
        information are protected today?

   Do teens understand how their personally identifying 
        information will be used, and do they need additional 
        protections?

   Will this identifying information be used to target kids and 
        teens with new behavioral advertising and marketing campaigns?
Balancing the Good and Bad
    Mobile phones and devices can bring new educational and creative 
opportunities for children. They can also bring increased distractions, 
and decreased privacy. But whether their impact is positive or 
negative, mobile phones and portable digital devices are not going 
away. As parents, teachers, industry leaders, and policymakers we must 
take steps to ensure that kids can access the benefits of mobile 
technology and digital media, while protecting them from potential 
negative consequences.

What Parents Can Do

   Think carefully about whether--and when--your kids need 
        mobile phones and devices, and what phone capabilities, like 
        cameras and texting, are appropriate for their age. Make sure 
        your kids know your rules about when, how, and how often to use 
        them.

   Know the new ways that kids use mobile phones, including 
        creating, accessing, and distributing video, and downloading 
        apps and games. If you don't know what they're doing, you won't 
        be able to set the rules.

   Talk with your kids about privacy and the ways that mobile 
        phones and location-based services can give out their personal 
        information.
What Educators Can Do

   Teach Digital Literacy and Citizenship in K-12 schools, so 
        that all kids learn how to use digital--and mobile--devices in 
        smart, effective, and responsible ways.\25\
---------------------------------------------------------------------------
    \25\ For more information, see the Common Sense Media Digital 
Literacy and Citizenship Whitepaper at http://www.commonsensemedia.org/
about-us/public-leadership.

   Establish clear rules about when, where, and how students 
        can--and cannot--use mobile phones and devices at school, and 
        encourage dialogue about why mobile use needs to be limited and 
---------------------------------------------------------------------------
        responsible.

   Encourage innovative approaches to using mobile devices to 
        expand positive opportunities for learning, creativity, and 
        communication.

What Industry Can Do

   Take increased responsibility for the programs and apps they 
        distribute.

   Use the same tech innovations that let kids access programs 
        and platforms to enable parents to access tools that help them 
        manage their kids' use of mobile devices.

   Develop better parent controls for mobile devices, and make 
        them easier for parents to understand and use.

   Enable parents to access independent ratings and parent 
        advice through mobile devices--for mobile apps and all the 
        other services that kids can now access.

What Policymakers Can Do

   Build digital literacy and citizenship programs in schools 
        and communities, including professional development for 
        educators, and a new Digital Literacy Corps.

   Update the Children's Internet Protection Act (CIPA) and 
        other legislation to reduce barriers to students using personal 
        mobile devices on school networks, so that schools can decide 
        how to set rules that encourage learning in school, at home, 
        and in between.

   Outlaw texting while driving by all drivers and any use of 
        cell phones by teen drivers.

   Update the Children's Online Privacy and Protection Act 
        (COPPA) to address mobile technology and ensure that children's 
        privacy is protected on all media platforms.

    Mobile phones and devices are becoming mini-computers that enable 
kids to access every portal and platform of the digital world--from 
home, school, or any place in between. Mobile devices and digital media 
are changing the ways that kids live and learn--and the changes can 
create opportunities and pose potential dangers.
    Kids today are growing up in a mobile, digital world, and we need 
to give them the digital literacy skills and judgment to access the 
benefits--and avoid the dangers--of this world. smart phones will 
change kids' lives. we all share a responsibility for making sure the 
changes are positive.

Who We Are
    Common Sense Media is dedicated to improving the lives of kids and 
families by providing the trustworthy information, education, and 
independent voice they need to thrive in a world of media and 
technology.
    More than 1.3 million people visit the Common Sense website every 
month for age-appropriate media reviews and parenting advice. Tens of 
millions more access our advice and information through our 
distribution partnerships with leading companies like Comcast, DirecTV, 
Time Warner Cable, Cox Communications, Facebook, Yahoo, Google, Apple, 
Disney, Netflix, Barnes & Noble, Best Buy, and others.
Common Sense Media Board of Directors
    Rich Barton, Chairman and CEO, Zillow.com
    Marcy Carsey, Founding Partner, Carsey-Werner Productions
    Chelsea Clinton, Columbia University
    James Coulter, Founding Partner, TPG
    Geoffrey Cowan, University Professor, The Annenberg School for 
      Communication at USC
    April Delaney, President, Delaney Family Fund
    John H.N. Fisher, Managing Director, Draper Fisher Jurvetson
    Lycia Carmody Fried, Community Volunteer
    Thomas J. Holland, Partner, Bain & Company, Inc.
    Gary E. Knell, President and CEO, Sesame Workshop
    Robert L. Miller, President and CEO, Miller Publishing Group
    William S. Price, III (Chair), President, Classic Wines, LLC
    Jesse Rogers, Managing Director, Golden Gate Capital
    Susan F. Sachs, Partner, Establishment Capital Partners
    James P. Steyer, Founder and CEO, Common Sense Media
    Gene Sykes, Managing Director, Goldman, Sachs & Co.
    Todor Tashev, Director, Omidyar Network
    Deborah Taylor Tate, Former FCC Commissioner
    Michael Tollin, Founding Partner, Tollin Productions
    Eugene Washington, MD, Dean, UCLA Medical School
    Lawrence Wilkinson (Vice Chair), Co-Founder, Oxygen Media and 

Global Business Network
Board of Advisors
    Aileen Adams, Chair, The Women's Foundation of California
    Larry Baer, Chief Operating Officer, San Francisco Giants
    Richard Beattie, Chairman, Simpson Thacher & Bartlett LLP
    Angela Glover Blackwell, Founder and CEO, PolicyLink
    Geoffrey Canada, Founder and President, Harlem Children's Zone
    Ramon Cortines, Superintendent, Los Angeles Unified School District
    Yogen Dalal, Managing Director, The Mayfield Fund
    Steve Denning, Founding Partner, General Atlantic Partners
    Susan Ford Dorsey, President, Sand Hill Foundation
    Millard Drexler, Chairman and CEO, J. Crew
    Ezekiel Emanuel, MD, PhD; Chair, Department of Clinical Bioethics, 
       The National Institutes of Health
    Robert Fisher, Director, GAP Inc.
    Arjun Gupta, Founder & Managing Partner of TeleSoft Partners
    F. Warren Hellman, Founding Partner, Hellman & Friedman
    James Herbert II, President and CEO, First Republic Bank
    David Hornik, Partner, August Capital
    Omar Khan, President, Insight Strategy & Logic (ISL), Web Site 
       Design
    David Lawrence Jr., President, The Early Childhood Initiative 
       Foundation
    Nion McEvoy, Chairman and CEO, Chronicle Books
    Nell Minow, Founder, The Corporate Library and Movie Mom
    Newton Minow, Counsel, Sidley, Austin and Brown; Former FCC 
       Chairman
    James Montoya, Senior Vice President, The College Board
    Becky Morgan, President, Morgan Family Foundation
    Nancy Peretsman, Managing Director, Allen & Company Inc.
    Philip Pizzo, MD, Dean, Stanford University School of Medicine
    George Roberts, Founding Partner, Kohlberg Kravis Roberts & Co.
    Carrie Schwab Pomerantz, President, Charles Schwab Foundation
    Alan Schwartz, CEO, Guggenheim Partners
    Marshall Smith, Senior Adviser, Department of Education
    Thomas Steyer, Founding Partner, Farallon Capital
    Robert S. Townsend, Partner, Morrison & Foerster LLP
    Laura Walker, President, WNYC Radio
    Alice Waters, Founder, Chez Panisse and Chez Panisse Foundation
    Robert Wehling, Founder, Family Friendly Programming Forum; Former 
       CMO, Procter & Gamble
    Tim Zagat, Co-Founder and Co-Chair, Zagat Survey

Board of Policy Advisors
    Angela Glover Blackwell, Founder and CEO, PolicyLink
    Dr. Milton Chen, Executive Director, The George Lucas Educational 
       Foundation
    Michael Cohen, CEO, The Michael Cohen Group
    Dr. Jeffrey Cole, Director, Center For The Digital Future
    Ramon Cortines, Superintendent, Los Angeles Unified School District
    Ezekiel Emanuel, MD, PhD; Chair, Department of Clinical Bioethics, 
The National Institutes of Health
    Ellen Galinsky, Co-Founder and President, Families and Work 
Institute
    Andrew Greenberg, President, Greenberg Qualitative Research, Inc.
    Denis Hayes, President, The Bullitt Foundation
    Dr. Donald Kennedy, President Emeritus, Stanford University; 
Editor-in-Chief, Science Magazine
    David Lawrence Jr., President, The Early Childhood Initiative 
Foundation
    Wendy Lazarus, Co-Founder and Co-Director, The Children's 
Partnership
    Christopher Lehane, Political Communications Expert
    Laurie Lipper, Co-Founder and Co-Director, The Children's 
Partnership
    Philip Pizzo, MD, Dean, Stanford University School of Medicine
    Dr. Alvin Poussaint, Prof. of Psychiatry, Harvard Medical School; 
Dir. of Media, Judge Baker Children's Center
    Thomas Robinson, MD, Associate Professor of Pediatrics and 
Medicine, Stanford University
    Theodore Shaw, Professor, Columbia University
    Marshall Smith, Senior Adviser, Department of Education

                                  
