COPPA updates go into effect today, if anyone is watching

The FTC revised the Children’s Online Privacy Protection Rule (COPPA) in December 2012 to take into account the rapidly expanding move to mobile applications, social media and the evolving nature of personally identifiable information. Those rules go into effect July 1, 2013.

COPPA is supposed to inform parents of data being collected about their children and provide opportunities for the parents to consent or opt out of the service.[1] Unfortunately, in application, COPPA has been applied as an either/or test – a site either caters to children and therefore complies with COPPA or prohibits use of services by children and therefore takes no steps to comply with parental notification and consent rules.

Many operators provide non-children services but do nothing to discourage use by children under 13, a practice which has obviated the impact of COPPA. Social media sites, in particular, tend to avoid compliance with COPPA and instead post disclaimers requiring that the users are over 13. But these sites have no verification procedures as to identity or age.

The FTC hopes to change this with the new rules. The amendments to COPPA are intended to minimize this gamesmanship by reducing the ability for a company to ignore actual usage by under-age customers and hide behind age disclaimers. Only time will tell whether the new rules will have that effect.

A second aspect of the new rule will likely have more impact. Self-regulatory associations can submit their certification program to the FTC for pre-approval. Provided members remain within compliance of the certified program, the approval serves as a safe-harbor, protecting members of the association from FTC enforcement actions. Examples of those applications include the following:

The self-regulatory associations, particularly the ESRB, take member enforcement very seriously. The multi-billion dollar gaming industry has become the model for differentiating products based on market segment. It has a strong incentive to segregate its under-13 products from the other products. Of course, it remains to be seen whether this will result in fewer 10-year-olds sneaking onto 15+ (or 18+) platforms, but the video game industry has been more effective than most in reducing the casual avoidance of the age restrictions.

The biggest change under COPPA revisions is the type of information now covered as personally identifiable information. Mobile and social media have transformed the tools available to individually track a customer. Persistent identifiers such as unique IDs, computer or chip serial numbers, unique device identifiers, IP addresses, and geo-location tags all work individually or together to create unique identification. None of those tools include a name or address, yet serve to provide comprehensive, persistent information regarding the identity of each individual. COPPA therefore expands the definition of personally identifiable information to reduce personalized targeting of advertising at children.

As an example of how personally identifiable information has evolved, this paragraph describes the ESRB’s updated guidance on personally identifiable information:

Personally Identifiable Information means any information that can be used to identify an individual or which enables direct contact with an individual. This would include an individual’s name, online contact information (i.e. email addresses or other identifier that permits direct online contact with a person via instant messaging, video, voice over internet protocol or any other means not specifically defined herein), phone number, fax number, home address, social security number, driver’s license number, credit card number, photos, videos, or audio containing the image or voice of a child, persistent identifiers (such as a customer number held in a cookie or a processor serial number, a unique device identifier, or IP address), or geo-location information sufficient to identify a street name and name of town. Demographic information that is combined with personal information (including, but not limited to, gender, educational background, or political affiliation) also becomes Personally Identifiable information. Personally Identifiable Information does not include information that is encoded or rendered anonymous, or publicly available information that has not been combined with non-public Personally Identifiable Information (and has not been previously defined as Personally Identifiable Information.)

The expanded COPPA will take months to truly affect the marketplace. Even then, it will only be effective if companies take the obligations not to track seriously and treat their customers with respect – something missing from the past 15 years of COPPA compliance.

Some and perhaps a majority of people prefer to be served ads that are relevant and interesting, so they don’t mind the outcome of behavioral advertising even if they are squeamish regarding the methods used to select the ads. But Congress assumes that children have fewer defenses to advertising and these techniques can be manipulative and harmful. Targeting individual minors under 13 is therefore prohibited without the parents consent. Hopefully, the COPPA revisions will make this difference begin to matter.

For more information, see the additional guidance provided by the FTC:

The FTC has also released two new pieces designed to help small businesses that operate child-directed websites, mobile applications and plug-ins ensure they are compliant with upcoming changes to the rule.

The first is a document, “The Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business, which is designed especially for small businesses and contains a step-by-step process for companies to determine if they are covered by COPPA, and what steps they are required to take to protect children’s privacy. The FTC also released a video aimed at businesses to help explain their obligations under the revised rule, including an explanation of the changes.

Finally, the FTC has updated a guide for parents, “Protecting Your Child’s Privacy Online,” that explains what COPPA is, how it works and what parents can do to help protect their children’s privacy online.

These new documents provide guidance from the FTC staff that supplements the rule and other COPPA–related material previously published by the FTC, including an updated set of frequently asked questions about the rule. FTC staff will periodically update the FAQs.

In addition to the guidelines and frequently asked questions, FTC staff maintain a “COPPA Hotline” email address, COPPAHotLine@ftc.gov, where industry members can send questions on how to ensure they are compliant with the rule. Comments on the FAQs or suggestions for new FAQs may also be submitted through the COPPA Hotline email address.


[1] The COPPA rule requires that operators of websites or online services that are either directed to children under 13 or have actual knowledge that they are collecting personal information from children under 13 give notice to parents and get their verifiable consent before collecting, using, or disclosing such personal information, and keep secure the information they collect from children.

When are video games unlike movies – when publicity rights are at stake

In a 2-1 vote, the Third Circuit Court of Appeals reversed a district court ruling in favor of EA Sports, finding that the publicity rights of Former Rutgers football player, Ryan Hart, were violated by depicting Hart in the videogame NCAA Football in 2004-06. The decision is a step forward for collegiate players seeking compensation from the exploitation by the NCAA and its licensing partners. The suit highlights the inability for players to receive compensation even after they have left college and NCAA eligibility rules no longer bar them from receiving payment.

The decision is step backwards for free speech advocates who seek clearer and more consistent protection from claims of publicity rights when celebrities and athletes are depicted in communicative works like films and video games. While the decision provides a thoughtful roadmap through the various legal tests applied to publicity rights, the court’s application of New Jersey law is at odds with the same test’s application in California. This will likely lead to increased confusion and more rounds of litigation until new statutes are enacted or cases decided.

The decision focuses on the exactitude of the video game in reproducing the player but unfortunately pays less attention to the exactitude of the Supreme Court/s recent decision in Brown v. Entm’t Merchs. Ass’n, 131 S. Ct. 2729 (2011). The Third Circuit quoted Brown on the protection afforded video games under the First Amendment. “[V]ideo games communicate ideas — and even social messages — through many familiar literary devices (such as characters, dialogue, plot, and music) and through features distinctive to the medium (such as the player’s interaction with the virtual world).”

Although the court recognizes that “video games enjoy the full force of First Amendment protections,” it highlights the limits of those rights. “As with other types of expressive conduct,” the court explains, “the protection afforded to games can be limited in situations where the right of free expression necessarily conflicts with other protected rights.”

Seeking to apply the best balancing test between the First Amendment and state publicity rights, the court reviews and rejects both the “Predominant Use Test” and the “Rogers Test.” Under the Predominant Use Test, the Missouri Supreme Court held that “[i]f a product is being sold that predominantly exploits the commercial value of an individual’s identity, that product should be held to violate the right of publicity and not be protected by the First Amendment,   even   if   there   is   some ‘expressive’ content in it that might qualify as ‘speech’ in other circumstances.” Unfortunately the Missouri Supreme Court then treated a comic book as such a commercial product and found the use Tony Twist’s likeness a commercial misappropriation when transformed into the evil Anthony “Tony Twist” Twistelli. The Third Circuit correctly rejected this application of such a test.

By our reading, the Predominant Use Test is subjective at best, arbitrary at worst, and in either case calls upon judges to act as both impartial jurists and discerning art critics. These two roles cannot co-exist.

The Third Circuit similarly rejected the Rogers Test, which relies on trademark considerations.

In analyzing the right of publicity claim under Oregon law, the Second Circuit noted Oregon’s “concern for the protection of free expression,” and held that Oregon would not “permit the right of publicity to bar the use of a celebrity’s name in a movie title unless the title was wholly unrelated to the movie or was simply a disguised commercial advertisement for the sale of goods or services.”

The application of the Rogers test to the content of a work almost leads to a finding of free speech, although the content would violate the test where the content was really an advertisement. For example, where the paid ad were an advertorial, a newspaper column of paid content, or in the case of a TV episode which was little more than an infomercial for a forthcoming product. In these cases the content was also a disguised commercial advertisement for sale of goods or services. Unless the content were an advertisement, the Rogers Test would permit the publisher to succeed over the publicity rights.

The Third Circuit adopted the Transformative Use Test developed in California, which is based upon the Copyright Act’s fair use standard. Specifically, that court, in Comedy III Prods., Inc. v.  Gary Saderup, Inc., 21 P.3d 797, 804-08 (Cal. 2001), adopted the first fair use factor, “the purpose and character of the use,” as the sole determinant test to balance the publicity rights claims and free speech claims. In Campbell v. Acuff-Rose Music, Inc., 510 U.S. 569, 579 (1994)), the Supreme Court explained the meaning of this fair use factor:

whether the new work merely “supercede[s] the objects” of the original creation, or instead adds something new, with a further purpose or different character, altering the first with new expression, meaning, or message; it asks, in other words, whether and to what extent the new work is “transformative.”

The Transformative Use Test has been applied inconsistently in California:

  • Tee-shirts depicting The Three Stooges to be insufficiently transformative to protect the free speech rights of the artist.
  • Comic books depicting Johnny and Edgar Winter as “villainous half-man, half-worm creatures, both with long white hair and albino features” sufficiently transformative to be free speech.
  • Video game depicting musician Kierin Kirby sufficiently transformative to protect Sega’s free speech rights to incorporate her image in a video game.
  • Avatars depicting No Doubt in video game Band Hero were life-like depictions and therefore violation of contractual limitation on publicity rights was a violation of those rights.

The Third Circuit applied this transformative test and in a 2-1 decision found that the literal depiction of Hart’s avatar was insufficiently transformative to protect the free speech rights of the video game makers. The dissent emphasized the video game’s creative and transformative elements as a whole rather than the particular depiction in isolation.

Unfortunately both the majority and dissent ignored this highly inconsistent and arbitrary nature of the Transformative Use Test. Like the Predominant Use Test rejected by the court, the application of the Transformative Use Test remains a rather arbitrary rule. Since both the Hart decision and the Kierin Kirby decision were summary judgment decisions, the courts were basing their decisions on stipulations that the individuals were depicted in the games.

More troubling, if the First Amendment decision of Brown is to be given full effect, then this analysis should apply to television coverage of sports as well. If Hart’s image is exploited in a video game, is it not also exploited when broadcast? The NCAA cannot make any claim to the publicity rights of its former players or players who are no longer eligible under its rules. (Whether the nation’s colleges should be able to strip undergraduates of their privacy and publicity rights as a condition of college eligibility is a broader question best left to a different analysis.) I cannot distinguish between’ Hart’s avatar and a Tina Fey sketch on Saturday Night Live depicting Sarah Palin. Frankly, judges should be empowered to make that distinction either.

I have advocated for a different outcome,[1] based more closely on the Rogers Test of the Second Circuit that emphasizes that publicity rights only exist when the name or likeness is used for a commercial transaction. As such newspapers, news broadcasts, comic books and video games are immune from publicity rights claims unless they are used to promote a commercial transaction, in other words, they are a disguised advertisement for sale of a good or product.

In addition, a second category of commercial appropriation similarly exists when substantially then entire person’s act is exploited. Thus if a news station were to broadcast all of a concert under the guise of covering that concert, it would steal the commercial exploitation of the work itself. That approach accommodates the Supreme Court decision in Zacchini v. Scripps-Howard Broad. Co., 433 U.S. 562 (1977). In Zacchini, the entire act of the Human Cannonball was broadcast on the news and Zacchini sued for damages as a result. The Supreme Court explained that free speech rights must provide balance with state publicity rights, agreeing that a cause of action for Zacchini’s right of publicity was appropriate under Ohio law.

When a publisher of communicative content takes a substantial portion of the commercial work, then a fair use style balancing is essential to be sure that the communicative work has not usurped the marketplace of the commercial work. Such a test will protect the magicians, comedians, musicians, poets, and trapeze artists of the world. Depicting an athlete in a video game or in a fantasy sports league hardly usurps the athlete’s entire performance; it remains communicative rather than a product or service. It should not matter whether the depiction is accurate or transformed, for that decision is precisely an aesthetic decision inappropriate for determination by judges and courts.

The Hart decision may increase the importance of the Transformative Use Test outside of California, but it does not provide a more thoughtful or more predictable distinction between free speech and publicity rights. The time for a uniform state statute is finally at hand.


[1] Garon, Jon M., Beyond the First Amendment: Shaping the Contours of Commercial Speech in Video Games, Virtual Worlds and Social Media (November 20, 2011). Available at SSRN: http://ssrn.com/abstract=1962369 or http://dx.doi.org/10.2139/ssrn.1962369;

Garon, Jon M., Playing in the Virtual Arena: Avatars, Publicity and Identity Reconceptualized through Virtual Worlds and Computer Games (March 26, 2008). Chapman Law Review, Vol. 11, No. 3, 2008. Available at SSRN: http://ssrn.com/abstract=1334950 or http://dx.doi.org/10.2139/ssrn.1334950.

Beyond Google’s Looking Glass – The Internet of Things is Already Here

Seal of the United States Federal Trade Commis...

(photo: Wikipedia)

Perhaps triggered by the New York Times coverage of Google Glass, The FTC announced both a call for submissions and a workshop related to the Internet of Things and its implications on privacy, fair trade practice, and security implications for both data and people. The FTC announcement highlights both the benefits and risks of device connectivity.

Connected devices can communicate with consumers, transmit data back to companies, and compile data for third parties such as researchers, healthcare providers, or even other consumers, who can measure how their product usage compares with that of their neighbors.  The devices can provide important benefits to consumers:  they can handle tasks on a consumer’s behalf, improve efficiency, and enable consumers to control elements of their home or work environment from a distance. At the same time, the data collection and sharing that smart devices and greater connectivity enable, pose privacy and security risks.

The issue is not new. The ITU released a 2005 study discussing the implications of the Internet of Things. The ITU described a near, technological future in which “industrial products and everyday objects will take on smart characteristics and capabilities. … Such developments will turn the merely static objects of today into newly dynamic things, embedding intelligence in our environment, and stimulating the creation of innovative products and entirely new services.”

I have previously described some of these concerns in an article, Mortgaging the Meme.[1]

In each of these situations, an automated and consumer-defined relationship will replace the pre-existing activities. In many situations, this will create efficiency and convenience for the consumer, but it will also reduce the opportunities for human interaction and subtly rewrite the engagement between customer and company. Those that understand this change will adjust their technologies to improve the service and increase the customer‘s reliance on its systems. Companies that do not understand how this engagement will occur, risk alienating customers and losing markets quickly.

Beyond consumer interactions, other uses may arise. Ethical and privacy concerns regarding misuse tend to focus on government, business and organized crime. These include unwarranted surveillance, profiling, behavioral advertising and target pricing campaigns. As a result, as companies increasingly rely on these tools, they also bear a responsibility to do so in a socially positive manner that increases the public‘s estimation of the company.

Timing for the FTC submissions and workshop are overdue. Reading the New York Times quote regarding app developers, there is a sense that unlike the technology giants such as Microsoft and Google, the developers are thinking more about the technology’s potential than its potential impact. One such example from the Times: “‘You don’t carry your laptop in the bathroom, but with Glass, you’re wearing it,’ said Chad Sahlhoff, a freelance software developer in San Francisco. ‘That’s a funny issue we haven’t dealt with as software developers.’”

Many fields will benefit from increased device connectivity. Just a few:

  • Public transportation systems designed around real-time usage and traffic patterns.
  • Prescription monitoring to help patients take the right medications at the correct time.
  • Fresher, healthier produce.
  • Protection of pets and children.
  • Social connectivity, with photo-tagging and group-meeting moving into the real world.
  • Interactive games played on a real-world landscape.

There are also law enforcement uses that must be carefully considered. After the Boston Marathon attack, for example, calls for public surveillance will undoubtedly increase, including calls for adding seismic devices and real-time echo-location. Gunshots, explosions, and even loud arguments could become self-reporting.

Common household products sometimes become deadly in large quantities. RFID technology could be used to monitor quantity concentration of potentially lethal materials and provide that data to the authorities.

The consumer use, public use, and law enforcement use must be thoughtfully reviewed to balance the benefits of the technology with the intrusions into privacy and the legacy of retrievable information that such technology creates.

FTC staff will accept submissions through June 1, 2013, electronically through iot@ftc.gov or in written form. The workshop will be held on November 21st. These are the questions posed by the FTC thus far:

  • What are the significant developments in services and products that make use of this connectivity (including prevalence and predictions)?
  • What are the various technologies that enable this connectivity (e.g., RFID, barcodes, wired and wireless connections)?
  • What types of companies make up the smart ecosystem?
  • What are the current and future uses of smart technology?
  • How can consumers benefit from the technology?
  • What are the unique privacy and security concerns associated with smart technology and its data?  For example, how can companies implement security patching for smart devices?  What steps can be taken to prevent smart devices from becoming targets of or vectors for malware or adware?
  • How should privacy risks be weighed against potential societal benefits, such as the ability to generate better data to improve healthcare decision making or to promote energy efficiency?
  • Can and should de-identified data from smart devices be used for these purposes, and if so, under what circumstances?

While the FTC has asked some good questions, they are only the beginning. Please submit your thoughts and join the FTC conversation.


[1] Jon M. Garon, Mortgaging the Meme: Financing and Managing Disruptive Innovation, 10 NW. J. TECH. & INTELL. PROP. 441 (2012).

New FTC Dot Com guide reminds firms to keep disclosures close – and disclaimers even closer

On March 12, 2013, The Federal Trade Commission released new guidance for mobile and other online advertisers that explains “how to make disclosures clear and conspicuous to avoid deception.” The announcement contains the this introduction:

Updating guidance known as Dot Com Disclosures, which was released in 2000, the new FTC staff guidance, .com Disclosures: How to Make Effective Disclosures in Digital Advertising, takes into account the expanding use of smartphones with small screens and the rise of social media marketing.  It also contains mock ads that illustrate the updated principles.

Like the original, the updated guidance emphasizes that consumer protection laws apply equally to marketers across all mediums, whether delivered on a desktop computer, a mobile device, or more traditional media such as television, radio, or print.

dotcom dislosuresFTC Guidance on online advertising, like that for the Endorsement Guides affecting testimonials, blogs, social media marketing and celebrity endorsements, remains premised on the ability of the FTC to identify those specific steps that are likely to violate Section 5 of the FTC Act. Section 5 (15 USC 45) prohibits “unfair or deceptive acts or practices in or affecting commerce.” The Federal Reserve summary of the rule and compliance evaluation is a very helpful tool for all advertisers, not just banks. Violations of the guidelines are not illegal, merely indicators that Section 5 has been violated. In reality, however, most enforcement actions never go to trial. The FTC enters into determinations, levies fines and establishes injunctive relief and specific performance which may significantly intrude on business practices. Most companies agree to these terms rather than facing potentially harsher and more costly litigation. As such, the guidelines are much more than mere advisory guidelines.

The new guidelines attempt to remind advertisers that disclaimers and additional terms must be near claims and specific even in the constrained space of mobile advertising:

If a disclosure is needed to prevent an online ad claim from being deceptive or unfair, it must be clear and conspicuous.  Under the new guidance, this means advertisers should ensure that the disclosure is clear and conspicuous on all devices and platforms that consumers may use to view the ad.  The new guidance also explains that if an advertisement without a disclosure would be deceptive or unfair, or would otherwise violate a Commission rule, and the disclosure cannot be made clearly and conspicuously on a device or platform, then that device or platform should not be used. …

The new guidance points out that advertisers using space-constrained ads, such as on some social media platforms, must still provide disclosures necessary to prevent an ad from being deceptive, and it advises marketers to avoid conveying such disclosures through pop-ups, because they are often blocked.

The guide is long and full of detailed examples. But the list of rules is actually quite intuitive. These are probably the most important:

1.         To make a disclosure clear and conspicuous, advertisers should:

  • Place the disclosure as close as possible to the triggering claim.
  • Take account of the various devices and platforms consumers may use to view advertising and any corresponding disclosure.  If an ad is viewable on a particular device or platform, any necessary disclosures should be sufficient to prevent the ad from being misleading when viewed on that device or platform.
  • When a space-constrained ad requires a disclosure, incorporate the disclosure into the ad whenever possible.  However, when it is not possible to make a disclosure in a space-constrained ad, it may, under some circumstances, be acceptable to make the disclosure clearly and conspicuously on the page to which the ad links.
  • When using a hyperlink to lead to a disclosure,
  • make the link obvious;
  • label the hyperlink appropriately to convey the importance, nature, and relevance of the information it leads to;
  • use hyperlink styles consistently, so consumers know when a link is available;
  • place the hyperlink as close as possible to the relevant information it qualifies and make it noticeable;
  • take consumers directly to the disclosure on the click-through page;
  • assess the effectiveness of the hyperlink by monitoring click-through rates and other information about consumer use and make changes accordingly.
  • Preferably, design advertisements so that “scrolling” is not necessary in order to find a disclosure. When scrolling is necessary, use text or visual cues to encourage consumers to scroll to view the disclosure.
  • Keep abreast of empirical research about where consumers do and do not look on a screen.
  • Recognize and respond to any technological limitations or unique characteristics of a communication method when making disclosures.
  • Display disclosures before consumers make a decision to buy — e.g., before they “add to shopping cart.” Also recognize that disclosures may have to be repeated before purchase to ensure that they are adequately presented to consumers.
  • Repeat disclosures, as needed, on lengthy websites and in connection with repeated claims. Disclosures may also have to be repeated if consumers have multiple routes through a website.
  • If a product or service promoted online is intended to be (or can be) purchased from “brick and mortar” stores or from online retailers other than the advertiser itself, then any disclosure necessary to prevent deception or unfair injury should be presented in the ad itself — that is, before consumers head to a store or some other online retailer.
  • Necessary disclosures should not be relegated to “terms of use” and similar contractual agreements.
  • Prominently display disclosures so they are noticeable to consumers, and evaluate the size, color, and graphic treatment of the disclosure in relation to other parts of the webpage.
  • Review the entire ad to assess whether the disclosure is effective in light of other elements — text, graphics, hyperlinks, or sound — that might distract consumers’ attention from the disclosure.
  • Use audio disclosures when making audio claims, and present them in a volume and cadence so that consumers can hear and understand them.
  • Display visual disclosures for a duration sufficient for consumers to notice, read, and understand them.
  • Use plain language and syntax so that consumers understand the disclosures.

2.         If a disclosure is necessary to prevent an advertisement from being deceptive, unfair, or otherwise violative of a Commission rule, and it is not possible to make the disclosure clearly and conspicuously, then that ad should not be disseminated. This means that if a particular platform does not provide an opportunity to make clear and conspicuous disclosures, then that platform should not be used to disseminate advertisements that require disclosures.