Attorney General Bonta Proposes COPPA Update: Children’s Private Online Information Must Be Protected

Updates to COPPA need to go further to protect children’s online data 

OAKLAND — California Attorney General Rob Bonta today, in response to the Federal Trade Comission's (FTC) notice of proposed rulemaking, joined a bipartisan multistate letter to the FTC proposing updates to regulations implementing the Children’s Online Privacy Protection Act (COPPA). In the letter, the attorneys general express support for updates to COPPA and advocate for further clarity and specification for proposed rules.

“The Federal Trade Commission’s proposed rule would strengthen our ability to enforce restrictions on companies selling children’s data and protect consumers who seek to manage what information websites can collect from kids,” said Attorney General Bonta. “Together with a broad bipartisan coalition from across the country, I support this effort and look forward to working collaboratively with the FTC to keep protecting children’s privacy.”

COPPA requires operators of websites and online services that are either directed to children under 13, or that have actual knowledge that they are collecting personal information from children under 13, to provide notice to parents and obtain parental consent before collecting, using, or disclosing personal information from children. 

The proposed rule would update COPPA by:

• Requiring separate “opt-in” consent for targeted advertising: The proposed new rule would require separate notice and parental consent before an operator can disclose children’s information to third parties, including third-party advertisers.
• Clarifying the “mixed audience” category:  There currently is ambiguity about when child-directed websites must provide COPPA protections to all users and when they may screen users for age and only provide COPPA protections to users who self-identify as under 13 years old. The FTC proposes to clarify this distinction by providing a new definition of “mixed audience."
• Adding “biometric identifiers” to the definition of “personal information”: The FTC proposes to expand the definition of “personal information” under COPPA to include biometric identifiers, like fingerprints or handprints, retina and iris patterns, genetic data, or data derived from voice, gait, or facial data.
• Limits on the “support for the internal operations” exception: Operators may currently collect persistent identifiers without first obtaining parental consent under an exception that permits “support for the internal operations of the website or online service.” The FTC proposes adding new requirements and disclosures for operators who rely on this exception.
• New limits on nudging kids to stay online: The FTC proposes adding new limitations on operators’ use of personal information to prompt or encourage children to use their service more.
• COPPA and schools: The FTC seeks to permit schools and school districts to provide consent for the collection, use, and disclosure of children’s personal information, but limit that consent to use for educational rather than commercial purposes.
• Data security, retention, and deletion: The FTC proposes strengthening data security, retention, and deletion requirements. For example, the FTC proposes requiring disclosure of data retention policies, and prohibiting operators from using retained information for any secondary purpose.

In the letter, the attorneys general support proposed updates to the COPPA Rule and respond to certain issues raised by the FTC, including how to define “personal information” as it relates to children and how to obtain parental consent to use children’s personal information in connection with advertising. The letter also advocates for limiting potential exemptions being considered by the FTC and addresses proposals regarding limitations on the use of personal information in ways that could be harmful to children, such as nudging kids to stay online longer.

Attorney General Bonta is committed to protecting children online. In October 2023, Attorney General Bonta co-led a bipartisan coalition of 33 attorneys general in filing a federal lawsuit against Meta Platforms, alleging that Meta, among other things, designed and deployed harmful features on Instagram and Facebook that addict children and teens to their mental and physical detriment. In November 2023, Attorney General Bonta announced the public release of a largely unredacted copy of the federal complaint against Meta. The removal of the redactions provides additional context for the misconduct that the attorneys general allege.

In March 2023, Attorney General Bonta as part of a bipartisan multistate coalition, filed an amicus brief supporting efforts to compel TikTok to produce subpoenaed materials and evidence as part of ongoing nationwide investigations into the company’s role in the growing youth mental health crisis. In December 2023, Attorney General Bonta joined a multistate amicus brief in Murthy v. Missouri supporting the right of the federal government to communicate with social media companies about matters of public concern. In January 2024, Attorney General Rob Bonta, Senator Nancy Skinner, and Assemblymember Buffy Wicks introduced the Protecting Youth from Social Media Addiction Act (SB 976), and the California Children’s Data Privacy Act (AB 1949), landmark legislation seeking to protect youth online.

In submitting today’s letter, Attorney General Bonta is joined by the attorneys general of Oregon, Illinois, Mississippi, Tennessee, Colorado, Connecticut, Massachusetts, New Jersey, North Carolina, Alabama, Alaska, Arizona, Arkansas, Delaware, District of Columbia, Florida, Georgia, Hawaii, Indiana, Kentucky, Maine, Maryland, Michigan, Minnesota, Nebraska, Nevada, New Hampshire, New Mexico, New York, Ohio, Oklahoma, Pennsylvania, Puerto Rico, Rhode Island, South Carolina, South Dakota, Utah, Vermont, U.S. Virgin Islands, Virginia, Washington, and Wisconsin.

A copy of the multistate letter is available here.