Today, U.S. Rep. Kathy Castor (FL14) introduced an updated “Protecting the Information of our Vulnerable Children and Youth Act” or the “Kids PRIVCY Act” to strengthen the Children’s Online Privacy Protection Act (COPPA). The bill builds on COPPA's strengths and expands privacy protections for children and teenagers, and incorporates key elements of the UK's Age-Appropriate Design Code, including expansion of coverage to sites likely to be accessed by children and teenagers, a requirement for a Privacy and Security Impact Assessment, and direction to operators to make the best interests of children and teenagers a primary design consideration.

“Online and digital technology, tracking and data gathering have outpaced current privacy protections for children and consumers,” said Rep. Castor. “Companies shouldn’t be allowed to unreasonably track and target children. Many companies have been violating the minimal privacy protections in place today as devices and applications have become more sophisticated in targeting kids. The 117^th version of the Kids PRIVCY Act builds on COPPA's strengths, expands privacy protections for children and teenagers, and incorporates key elements of the UK's Age-Appropriate Design Code. It’s time to strengthen online protections for our youngest neighbors and bring these safeguards into the 21^st century.”

"Common Sense applauds Rep. Castor for her continued efforts to protect children and teens online. This bill would provide much needed updates to COPPA, prohibiting especially problematic practices like behavioral ad targeting, extending flexible protections to teens on all sites they frequent, and requiring that companies prioritize the best interests of young people. The U.S. has fallen behind other nations in prioritizing and protecting young people online, but Rep. Castor's Kids PRIVCY Act would start to change course to help ensure kids and families across the country get the protections they deserve across the online ecosystem,” said Ariel Fox Johnson, Senior Counsel, Global Policy, Common Sense. 

“Representative Castor’s Kids PRIVCY Act is a game changer. By building on COPPA, expanding privacy protections to teens, and incorporating key elements of the UK”s groundbreaking Age Appropriate Design Code, the legislation will create the safeguards young people deserve. And by banning surveillance advertising to children and teens, the bill will allow young people to safely use the internet without being exposed to harmful, exploitative data-driven marketing. Anyone with concerns about how children are treated online should support this important legislation,” said Josh Golin, Executive Director, Fairplay.

“Children and teens will receive strong safeguards to protect their privacy online under this proposed new law. Young people are now subjected to relentless surveillance from marketers, who employ stealthy “Big Data” tactics to track and target kids and adolescents when they use mobile phones, gaming platforms, and social media. Rep. Castor’s “Kids PRIVCY Act” will ensure that regulators keep young people safe, prevent them from being targeted with discriminatory and manipulative tactics, and ensure they are treated fairly in the digital marketplace,” said Jeff Chester, Executive Director, Center for Digital Democracy.

“Managing children's relationships with technology has become an increasingly daunting and difficult job for parents. Digital platforms often collect children’s data, target them with personalized advertising based on their behaviors online, and generally fail to prioritize the best interests of young people. The Kids PRIVCY Act is a much needed step toward making digital environments safer for young people by updating the Children’s Online Privacy Protection Act for the 21^st Century so children—and now teens too—can have control over their data online, just as COPPA intended. The American Academy of Pediatrics thanks Rep. Castor for her leadership in protecting children’s health and supporting parents,” said Jenny Radesky, MD, FAAP, American Academy of Pediatrics Council on Communications and Media.

The bill is supported by children’s advocacy organizations, health care professionals and privacy experts, including: American Academy of Pediatrics, Common Sense Media, Fairplay, Center for Digital Democracy, Parent Coalition for Student Privacy, Consumer Action, ParentsTogether Action, Dr. Ellen Wartella Sheikh Hamad bin Khalifa Al-Thani Professor of Communication at Northwestern University, Accountable Tech, 5Rights Foundation, Parents Television and Media Council, XR Safety Initiative, Children and Screens: Institute of Digital Media and Child Development, Serge Egelman Research Director of the Usable Security & Privacy Group at the International Computer Science Institute (ICSI) at University of California, Berkeley, Electronic Privacy Information Center, Media Alliance, US PIRG, Consumer Federation of America, Woodrow Hartzog, Professor of Law and Computer Science at Northeastern University, Oakland Privacy, Public Citizen, National Center for Missing & Exploited Children, Network for Public Education, Brandie M. Nonnecke, PhD, Stop Predatory Gambling, SumOfUs, National Center on Sexual Exploitation, Lynn's Warriors, Amnesty International USA, Rape, Abuse & Incest National Network (RAINN), the American Psychological Association and the American Academy of Child and Adolescent Psychiatry.

Supporting quotes can be found here.

The legislation specifically strengthens privacy protections for children and teenagers by:

• Banning Companies from Providing Targeted Advertisements to Children and Teenagers: Prohibits companies from targeting children and teenagers based on their personal information and behavior.
• Considering Best Interests of Children and Teenagers: Requires an operator to make the best interests of children and teenagers a primary design consideration when designing its service.
• Requiring Opt-In Consent for all Individuals Under 18: Companies must obtain specific, informed, and unambiguous opt-in consent before collecting, retaining, selling, sharing, or using a young consumer or child’s personal information.
• Creating a Right to Access, Correct, and Delete Personal Information: Companies must provide individuals the opportunity to access, correct, or delete their personal information at any time.
• Protecting Additional Types of Information: Expands the type of information explicitly covered to include physical characteristics, biometric information, health information, education information, contents of messages and calls, browsing and search history, geolocation information, and latent audio or visual recordings.
• Requiring User-Friendly Privacy Policies: Companies must make publicly available privacy policies that are clear, easily understood, and written in plain and concise language.
• Creating a Protected Class of “Teenagers” Ages 13-17: For the first time in statute, the bill provides protection for teenagers 13-17, allowing them to control who collects their personal information and what companies can do with it.
• Expands Coverage of Companies: Applies to all sites likely to be accessed by children and teens, not just child-directed services.
• Limiting Disclosure to Third Parties: The bill prohibits companies from sharing personal information without consent. Furthermore, it creates additional duties companies must comply with before disclosing any personal information with third parties.
• Requiring Reasonable Data Security Policies, Practices, and Procedures: Requires companies to have a written security policy, point of contact for information security management and processes to identify, assess, and mitigate vulnerabilities.
• Prohibiting Industry Self-Regulation: Repeals dangerous safe harbor provision that allow for lax enforcement and rubberstamping of potentially unlawful practices.
• Strengthening FTC Enforcement: Raises the maximum allowable civil penalty per violation by 50 percent and allows the FTC to pursue punitive damages. Also establishes a Youth Privacy and Marketing Division at the FTC.
• Providing for Parental Enforcement: Parents will be able to bring civil actions to help enforce the bill and any resulting regulations.
• Banning Forced Arbitration: In a much-needed reversal of current law, companies will no longer be able force their consumers to waive their right to sue.