Most Americans have long ago given up fighting the notion that their behavior is tracked by advertisers as they move around the web. The subject of our children's privacy, on the other hand, remains a political and cultural firestorm. Now the New York State Attorney General's office is cracking down on a group of kid-focused websites, enforcing a federal law that makes it illegal to track the web browsing habits of children under 13.
After a two year investigation, New York Attorney General Eric Schneiderman announced on Tuesday that his office had found evidence that four companies' popular children's websites didn't comply with the Children’s Online Privacy Protection Act, or COPPA, a federal law that limits marketing to children under 13 and requires website operators to get parental consent before collecting personal information about kids. Viacom, Mattel, JumpStart, and Hasbro, according to the state's head prosecutor, hadn't intentionally built native tools to track personal identifiers like cookies and IP addresses. But they were all contracting with advertising vendors that performed some type of persistent monitoring for targeted ads. The four companies will pay a combined total of $835,000 in fines, and agreed to reform measures to ensure that they comply with COPPA in the future and only work with third-party companies that obey that law.
"We used to worry about our children wandering into bad neighborhoods, now our children live online," Schneiderman said in a press conference. "We have to deal with this the same way we deal with street crime."
The investigation into the collection of kid-tracking sites began two years ago when prosecutors working on a different case happened to visit one of the kid-oriented websites and noticed that targeted ads followed them there, which suggested illegal individualized tracking across the web. The four companies evaluated by the probe produce some of the Internet's most popular children's sites including Nickelodeon and Nick Jr. under Viacom, Barbie, Fisher-Price, and Hot Wheels from Mattel, Hasbro's My Little Pony and Nerf, and Neopets from JumpStart.
The agreement, which Schneiderman said is the first of its kind, requires the companies to do regular audits of their sites to ensure that no new tracking tools have been introduced, and mandates that they vet the practices of all third-party services before working with them. The idea is to send a message to other companies before they collect the same sort of illegal data. Schneiderman noted, "We can tell that the kids are being tracked, but we don’t know what these companies do with this information."
The Federal Trade Commission has been working to enforce COPPA, and settled charges with two app developers in December after the FTC alleged that they had allowed third-party advertisers to persistently track child users in apps targeted at kids. Enforcing the law and performing thorough audits isn't easy, though. In the case of the New York attorney general action, Hasbro's sites had actually already been deemed compliant through the FTC's COPPA safe harbor program, but in fact, Hasbro hadn't disclosed all of its third-party interactions and one of its Nerf ad campaigns involved illegal user tracking.
To allow for more widespread monitoring, Viacom, Mattel, JumpStart, and Hasbro all agreed to update their privacy policies so parents will know how the sites go about complying with COPPA, and so there is a mechanism in place for parents to report concerns and potential violations to companies. COPPA mainly applies to websites that are "directed" at children under 13, but even sites with a general audience have to consider COPPA if they know (or should know) that they are collecting personal information from children like names and email addresses.
As Schneiderman puts it, it's "open season" for digital marketers to track adult behavior online and customize ads for individuals based on their browsing. But kids aren't equipped to understand that aggressive form of marketing. Incidents in which toy companies and wi-fi enabled toys get hacked are troubling enough. The last thing we need is a more industrialized form of commercial tracking, eroding Americans' privacy from childhood on.
