Challenge Expected if FTC Codifies Social Media Engagement Rule

The FTC in December released a draft proposal for updating rules associated with the Children’s Online Privacy Protection Act (see 2312200050). Citing public feedback, the agency proposed banning certain companies from using or sharing personal information to maximize user engagement, including through push notifications, without obtaining verifiable parental consent.

There’s a lot of concern on Capitol Hill and from regulators about social media addiction, but it’s an open question whether the FTC can “shoe-horn” these societal issues into a children’s privacy proposal, given statutory limits, said Maneesha Mithal, former associate director of the FTC’s Division of Privacy and Identity Protection, now at Wilson Sonsini. There will be a lot of questions about defining “prolonged” user engagement and whether regulation is allowed under COPPA, she said.

Examining “societal behaviors is not the same thing as” regulating children’s online privacy, Lartease Tiffith, IAB executive vice president, told us during an interview Tuesday. FTC attempts that conflate kids’ privacy rights with protections against social media addiction will result in court challenges, he said. “This is a court issue.” He said the FTC should not assume all parents share its concerns about social media. “Parents should be able to decide what they want to do with their children and technology, rather than an agency coming in and saying, ‘We’re going to ban everything.’”

One could argue that if the FTC “shoe-horns” addiction issues into COPPA rules, it’s moving beyond the scope of the statute, said Yael Weinman, former attorney adviser to FTC Commissioner Julie Brill, now associate general counsel-privacy at Verizon.

Weinman said the COPPA draft isn’t the “overhaul” many stakeholders anticipated from Chair Lina Khan. She noted the FTC backed off making changes in COPPA’s knowledge standard, despite calls from consumer advocates. The knowledge standard is used to define when a company knows it’s collected a child’s data.

The FTC’s NPRM details how Congress made a “deliberate” decision when approving COPPA to reject a “constructive” knowledge standard, which would hold a company liable in instances when it “should have” known it was collecting a child’s data. Weinman noted how the NPRM includes footnotes essentially saying it’s up to Congress to change the standard: “I can sort of hear the chair’s voice saying, ‘That’s up to you, Congress.’”

It appears the agency moved the COPPA proceeding to the “head of the line” in front of competing initiatives like Khan’s comprehensive privacy rulemaking, said Mithal, who worked at the agency from 1999 to 2021. Mithal said she has heard the agency could soon issue an NPRM for its rulemaking on comprehensive privacy, but the recent addition of two Republican commissioners could mean delays as they get acclimated. Mithal noted how the COPPA changes are subject to a more streamlined rulemaking process, while the comprehensive privacy rules must go through the lengthier Magnuson-Moss proceeding.