[Congressional Record Volume 170, Number 35 (Tuesday, February 27, 2024)]
[Senate]
[Pages S999-S1001]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]



           Children and Teen's Online Privacy Protection Act

  Mr. MARKEY. Mr. President, I rise today in support of the Children 
and Teens' Online Privacy Protection Act or, as it is known, COPPA 
2.0., the Child Online Privacy Protection Act.
  We stand at a truly consequential moment for protecting children 
online in our country. Our kids are suffering from an acute mental 
health crisis. The statistics are staggering: One in three high school 
girls in the United States seriously considered suicide in 2021--one in 
three teenage girls considered suicide. At least 1 in 10 high school 
girls attempted suicide in the United States in 2021--1 in 10 teenage 
girls in America attempted suicide in 2021. Amongst LGBTQ youth, the 
number is more like one in five LGBTQ youths attempted suicide in 2021.
  We know that Big Tech's tracking, targeting, and traumatizing of our 
young people is contributing in a significant way to that crisis. As 
the Senate Judiciary Committee hearing just a few weeks ago 
demonstrated, Big Tech CEOs still don't understand the damage they have 
caused and remain unwilling to make the necessary changes to fix their 
platforms and protect children, to protect teenagers, because, without 
a doubt, self-regulation by the CEOs of the tech companies has failed 
and failed miserably. Otherwise, we would not be in this mental health 
crisis.
  In the face of this defiance by the industry, policymakers at the 
Federal, State, and local levels have been introducing and passing new 
legislation to address the crisis. More notably, last week, the Florida 
Legislature felt compelled to pass a law to ban all kids under 16 from 
social media all together in the face of Big Tech inaction. Do you hear 
what I am saying? Florida is passing a law banning kids under 16 from 
being on at all.
  I am glad that bipartisan lawmakers and regulators have mobilized 
across the country to address this problem, but we also must be careful 
because social media is not inherently bad. Many young people have 
found their voices online and organize there on issues such as the 
climate crisis and gun violence. Online platforms allow young people to 
connect with loved ones, share their own experiences, and learn from 
others in ways that are just unavailable to them offline. They need, in 
many instances, the online communities. If we shut down those spaces in 
our efforts to keep children and teenagers safe online, we may just 
trade one youth mental health crisis for another one.
  For most of my career, I have worked to get this balance right--to 
protect kids from the dangers of new technologies without undermining 
the social, the political, and the economic benefits of those very same 
technologies. There is a Dickensian quality to these qualities. There 
are the best of technologies and the worst of technologies 
simultaneously. They can enable, they can ennoble, or they can degrade 
and debase.
  We want the benefits but also have to protect our society--especially 
young people--against the degradation that has now overcome so many 
parts of the internet. We just have to find a balance with social media 
as we have done in many other areas of our country.
  Fortunately, we are not writing on a blank slate. The Children's 
Online Privacy Protection Act, the original COPPA, laid the groundwork 
for protecting kids online by empowering parents and allowing corporate 
incentives with our policy goals. And unlike more draconian laws from 
that era, COPPA remains the law of the land. In fact, the only Federal 
privacy protection for kids online is my law, which passed 26 years 
ago, which protects kids under the age of 13.
  But we can now see that it has expanded beyond anything that people 
actually thought about in 1998. And in the 26 years since COPPA's 
passage, much has changed, but at the same time the core principles of 
that bill still hold the key for protecting young people today. That is 
why I am fighting so hard to pass COPPA 2.0 and update those privacy 
policies. And it is why it is worth revisiting the passage of COPPA in 
1998 and its successes over the past two decades.
  As many of my colleagues remember, the late nineties were an exciting 
and scary period for technology. This spectacular growth in home 
internet access ushered in a digital and communications revolution, 
making it easier than ever to find information, discover new 
communities, and interact with friends, families, and strangers online. 
In fact, I am the author of the key three bills that moved America from 
analog to digital, from narrowband to broadband. I am very proud of 
that. Not one home had broadband in America in February of 1996, so I 
am proud of those bills I authored at the time.
  We want the benefit of the information superhighway. We want the 
revolution. But in that early internet period, the possibilities 
appeared endless: online classrooms, remote work, telehealth services. 
The internet threatened to upend every aspect of society, and we 
lawmakers, the public, individuals across the globe--we were now trying 
to catch up with these changes that the laws that I authored were now 
ushering in, real changes in commerce, education, and healthcare.
  Even in those heady days, however, the dark side of the digital 
revolution was already apparent, the sinister side of cyber space. 
Heads rose almost immediately. New personal computers and access to the 
internet created vast

[[Page S1000]]

opportunities for corporate surveillance, allowing the new online 
platforms to amass large quantities of our personal information and our 
data with every click, every typed word. Every website visited became 
another data point in the ever-expanding profiles that websites, web 
browsers, and other online companies built on their users. This was in 
the ``BF'' era, the before Facebook era. Before there ever was a 
Facebook, they were already doing it. As soon as we moved to broadband, 
as soon as the three laws passed, the initial companies all moved in 
that direction. And that is when the Big Tech titans just began to 
master the lucrative art of targeted advertising, using all of this 
collected data.
  But they understood that our data had value, and they began building 
huge data collection apparatus. For those of us closely monitoring the 
digital revolution, online companies' voracious appetite for our data 
exposed extreme risk to our privacies. As our social, economic, and 
political lives increasingly took place online, Big Tech's near-
constant surveillance threatened to expose every part of every life in 
America to eliminate personal privacy as we know it.
  Back in the 1990s, I was deeply concerned about this risk, and I 
introduced legislation to enact an electronic privacy bill of rights 
across all technology platforms in our country. And, like today, 
lobbyists blanketed Capitol Hill, warning that limits on data practices 
would harm innovation, block the internet revolution, and threaten 
America's place as the world's economic leader.
  So my comprehensive privacy bill, even though I got it passed in the 
House in 1995, which would be in place right now for all Americans, and 
other privacy legislation, ultimately, all fell victim to this lobbying 
firestorm. And, 26 years later, we still don't have a national 
comprehensive privacy law. We came so close in 1995 and 1996.
  But on one aspect of this problem, reason prevailed: children's 
privacy. So what I did then, in October of 1998, is I went back to my 
Republican colleagues, and I said: Well, if we are not going to protect 
adults and we are not going to protect teenagers, at least let us 
protect kids in America under the age of 13. Let's have a child online 
privacy protection law for those kids. Can I get that from you?
  So the law wasn't perfect, but COPPA fundamentally changed how 
websites and online services interacted with children. The law, No. 1, 
prohibited companies from collecting information data on children under 
the age of 13 without obtaining parental consent. No. 2, it required 
companies to give parents access to their children's personal 
information. And, No. 3, it required companies to post clear privacy 
policies describing their collection of children's personal 
information.
  No longer could websites vacuum up children's data without any 
parental consent. No longer could they think of this as a hidden, vast 
surveillance apparatus without even a disclosure. No longer could they 
amass troves of data on our kids without parental oversight. All that 
ended with COPPA, the Children's Online Privacy Protection Act of 1998, 
but only for kids under the age of 13.
  But, ultimately, the core problem facing our children, both in the 
1990s and even more so today, is Big Tech's relentless and unyielding 
drive to accumulate more and more data on its users, including 
children. And this data may seem vague and uncertain, but it is 
anything but. It is a child's name, email address, location, their 
height, their weight, their health conditions, their fingerprints and 
facial scan, their likes and dislikes, even their sexual orientation 
and gender identity.
  If you can identify a characteristic of a child, chances are that Big 
Tech wants to know about it and wants to use it to develop an ever more 
precise profile on that one specific child to target that child with 
information that advertisers and others will pay to talk to that child.
  Why? Because of targeted advertising. More data means more effective, 
targeted ads at that child, at that teenager, which means more money 
for the Big Tech companies, bigger mansions, bigger yachts, bigger 
superjets for them. But it all comes at the expense of individual 
children and teenagers all across our country. And the more money they 
make, it allows the tech giants to invest in new ways to keep our young 
people glued to their screens.
  So the hearings I had in the 1990s were on AI and how AI is going to 
be used in order to do all of this targeting. I had all of those 
hearings in the 1990s. It is not new. It is just now on steroids, even 
worse, even more dangerous.
  So the giants are absolutely committed to keeping this continued 
because the media giants of today are really advertising giants. That 
is all they are. Data is the fuel for Big Tech's profit machine and the 
raw material that sustains Big Tech's business model.
  This endless quest for more data incentivizes Big Tech to maximize 
user engagement and attention. The formula is very simple: More time on 
social media means more data to fuel the targeted advertising machine. 
That means more revenue for Big Tech, coming at the expense of the 
privacy of teenagers and children in our country.
  Addiction equals data, equals money--simple formula. Addiction equals 
data, equals money. That is their business model. You can put it on a 
3-by-5 card. It is not complicated, and it is a lot of money.
  In 2022, according to a recent Harvard study, the major Big Tech 
platforms earned nearly $11 billion in advertising revenue from U.S. 
users under the age of 17. So $11 billion they made off of kids, 
targeting ads toward them. That is 11 billion reasons to build ever 
more sophisticated data profiles on younger users; 11 billion reasons 
to develop new addictive features; 11 billion reasons to keep our young 
people clicking, swiping, and liking.
  The question then is how to break this self-fulfilling cycle, how to 
change Big Tech's incentives to modify their operations to benefit 
children rather than addict them. The answer is to address the 
underlying source of the problem: the data that fuels Big Tech's 
business model itself.
  If Big Tech no longer has an incentive to maximize the data collected 
on a young person, it will lose the incentive to develop ever-changing 
methods to addict that child, that teenager to the product in the first 
place. By breaking the incentive to collect data, we can permanently 
change Big Tech's approach to children and to teenagers in our country.
  So, back in 1998, my original child online protection bill took a 
first step to change those incentives. It put up barriers that limited 
websites' ability to collect endless data on children, putting parents 
in control, and, over the past 26 years, the Federal Trade Commission 
has used its authority under the Children's Online Privacy Protection 
Act to hold all sorts of companies accountable for invading kids' 
privacy.
  Using my law from 1998, by 2003--the Federal Trade Commission--it 
was Mrs. Fields Cookies and Hershey collecting children's information 
online without obtaining parental consent. In 2008, it was Sony. In 
2019, Google agreed to pay $170 million for its YouTube channels' 
violation of COPPA. And, just last year, Epic Games, Microsoft, and 
Amazon all agreed to settlements for COPPA violations.

  In total, the Federal Trade Commission has held 36 companies 
accountable thanks to its authority to protect kids online under COPPA, 
and COPPA's true impact is so much bigger because those 36 cases that 
the Federal Trade Commission won are a deterrent to hundreds of 
companies trying to do the same thing, because they can see how big the 
penalty will be if they violate the terms of the law.
  And then, last year, 33 attorneys general filed claims under COPPA 
against Meta, against Facebook, for collecting personal data on 
millions of users that Facebook and Instagram knew were children. They 
knew they were children. Their algorithms could tell them they were 
children.
  And Meta's willful blindness toward these users was breathtaking. One 
internal Meta report estimated that, in 2015, 4 million users on 
Instagram were under the age of 13, and they knew it. And it 
represented 30 percent of all 10- to 12-year-olds in the country, and 
they knew it. They knew what they were doing.
  In other cases, Meta employees allegedly declined to conduct research 
on users that the company knew were

[[Page S1001]]

under age 13 because such research would reveal that children used its 
platforms. They didn't want to know what they knew. They didn't want 
the documentation to reinforce and prove that they were in violation of 
the law.
  So if it looks like a duckling, swims like a duckling, quacks like a 
duckling, it is probably a duckling. And that is what these companies 
are doing. We know. They know. Everybody knows what they are doing.
  So the States' complaint makes this clear: Meta knew that Facebook 
and Instagram were filled with ducklings but deliberately stuck their 
head in the sand. And, by the way, for people watching, Facebook just 
changed their name to Meta, but it is still the same. It is still 
Facebook. It is still Instagram. And they are both owned by Meta.
  So thanks to COPPA, Meta is being held accountable for this brazen 
conduct, for collecting vast quantities of data for its targeted 
advertising machine without even trying to obtain parental consent at 
all.
  Despite the valiant efforts of the Federal Trade Commission and State 
regulators, websites and online services have found ways to skirt these 
privacy protections to amass troves of data on young people and feed 
their data-fueled business model.
  And, most notably, teenagers are unprotected by COPPA. Similarly, the 
law does not contain strict protections against excessive data 
collection or targeted advertising by Big Tech.
  When I first pushed for COPPA in 1998, I summarized my plan in three 
words: disclosure, knowledge, and no--disclosure of privacy policies, 
knowledge of the information collected on our children being reused for 
other purposes, and the right to say no to the reuse or sale of that 
information.
  Today, the same formula works, except the no. It is now more like a 
``no, no, no, no; stop it; end this.''
  We have a mental health teenage and child crisis in our country, and 
the Surgeon General of the United States has pointed the finger at 
social media: No. Stop it. End it.
  And the companies must still disclose their privacy practices to 
users and still must ensure their parents can access the information 
collected on their kids and prohibit future use of that information. 
But we need to adapt. We need to adopt stronger and more aggressive 
protections to disrupt Big Tech's business model, to provide Big Tech 
with financial incentives to build healthy platforms for our young 
people and not these dangerous cesspools that have been created.
  And that is why, for over a decade, I have been introducing 
legislation to crack open Big Tech's business model by prohibiting 
targeted advertising for kids and teens and to prohibit Big Tech from 
collecting data on young people beyond what is necessary to provide the 
service. These provisions--along with raising the COPPA age to cover 
teens up to age 17 and preventing online platforms like Meta from 
pretending their users aren't children or teens--target the perverse 
incentives with Big Tech's business model. They fix the rot under the 
floorboards of this whole system, rather than just applying a new layer 
of paint.
  This is the ``no, no, no'' that this Senate, this country must say to 
Big Tech, and it is the foundation of my and Senator Cassidy's COPPA 
2.0 legislation, which has now passed through the U.S. Senate Commerce 
Committee. The committee unanimously, last year, No. 1, said no 
targeted advertising toward teenagers and children; No. 2, no 
unnecessary data collection from children and teenagers in our country; 
No. 3, no deliberately ignoring young users and pretending you don't 
know that they are young because your algorithms tell you they are 
young. You know it. You know it, just because of all of the other sites 
these young people go to. You know who they are.
  By addressing the business model, COPPA 2.0 also preserves the real 
benefits of social media. It allows young people to open accounts, 
converse with friends and family, find new communities, learn, grow, 
develop, and take part in rich online spaces.
  I have heard from countless young people that these spaces are 
essential for their own development and growth. So, as policymakers at 
every level, but especially in this body, we consider different 
approaches to regulating social media and addressing the youth mental 
health crisis. We must remember the ultimate source of the whole 
problem is the data which they collect. We cannot allow them. We cannot 
permit them to continue to collect that data and then use it to go back 
and target kids with it.

  And any effort to combat this crisis has to include effective reforms 
to minimize this data collection, enhance privacy protection for young 
people online, and ban targeted advertising for kids and teens. That is 
what COPPA 2.0 does. I am deeply proud to lead this legislation with my 
good friend from Louisiana, Senator Cassidy, a physician who knows that 
there is a mental health crisis in our country. And I am thankful for 
the thoughtful work of Chair Cantwell and Ranking Member Cruz on this 
bill, and I am delighted to say that both have agreed to cosponsor 
COPPA 2.0.
  COPPA 2.0 is bipartisan. It is a commonsense effort to address Big 
Tech's insatiable appetite for data and their incentive to addict our 
kids and teens to their platforms by returning to the lessons from the 
1990s, which we knew was going to be a problem right from the 
beginning. We can put an end to Big Tech's impunity. We can turn social 
media platforms into healthy spaces for our young people. We can 
finally look our kids in the eye and say: We are making changes for 
them, to protect them, to deal with this mental health teen and 
children's crisis in our country.
  The surgeon general has pointed the finger at this as a major source 
of the problem. We have to do something about it. So I urge my 
colleagues, on a bipartisan basis--and I know it is bipartisan at this 
time--that we move, and we move rapidly. We have to give relief to 
parents and families all across our country.
  We just can't allow Big Tech CEOs to determine the morality of our 
country, the values of our country. The technologies should animate our 
values, not the values of tech CEOs. They should have the values of the 
American people that are built into it.
  So that is my hope. I urge all of my colleagues to support this 
legislation, and I will just add, parenthetically, that the other thing 
I was able to do in 1996 was to pass in that bill, the legislation 
which pays for kids, the poorest kids in America, to be online at their 
desks in schools. Otherwise, rich kids would have had it, and poor kids 
would not. So far, that program is a $75 billion program--$75 billion--
the largest single educational technology program in the history of our 
country to make sure that poor kids have it on their desk. And for the 
first time in American history, a new technology was introduced at the 
same pace for poor kids as the rich kids. But we still have much more 
work to do to make sure that they can afford it at all, that they can 
have access to it, because our country is changing, and the technology 
is helping to change it, and we must keep up with the policies that we 
know are going to be necessary--especially to protect young people in 
our country. They are only 20 percent of our population, but they are 
100 percent of our future, and we, in the Senate, must act this year to 
protect them.
  I yield the floor.
  The PRESIDING OFFICER (Mr. Markey). The Senator from Iowa.