Lawmakers Urged to Bolster Privacy for Kids, Marginalized People

A landmark data privacy draft bill still lacks adequate protections for minors and marginalized communities, advocates and one key lawmaker say.

Key House and Senate committee leaders have been broadly lauded for breaking years of deadlock with a bipartisan privacy proposal, as technology companies and consumers clamor for a uniform data protection regime nationwide.

The measure spearheaded by House Energy and Commerce Chair Frank Pallone (D-N.J.), ranking member Cathy McMorris Rodgers (R-Wash.), and Senate Commerce, Science, and Transportation ranking member Roger Wicker (R-Miss.) includes a prohibition on targeted advertising if companies have “actual knowledge” that an individual is under 17 years old.

Photo: Sajjad Hussain/AFP via Getty Images

Apps on an iPhone on May 26, 2021.

The term, which was pulled from the Children’s Online Privacy Protection Act (Public Law 105-277), “has been a huge loophole for big tech companies to claim ignorance,” Rep. Kathy Castor (D-Fla.) said during an Energy and Commerce subcommittee hearing Tuesday. “This clearly is an area where there is room for improvement in the draft if we are serious about protecting kids online.”

Alphabet Inc.’s YouTube is the most prominent example of a company that touts its popularity with kid consumers in conversations with prospective advertisers—and simultaneously claims to be a “general audience site” not subject to COPPA, said Jolina Cuaresma, senior counsel for privacy and technology policy at Common Sense Media.

YouTube didn’t immediately respond to a request for comment.

Rep. Gus Bilirakis (R-Fla.), the top Republican on the Consumer Protection subcommittee, said it was important to make the legislation better—but within limits.

“To be clear, this is historic, and we need to keep moving together and build upon the constructive feedback while rejecting tactics that may seek to derail our bipartisan work,” he said at the subcommittee’s Tuesday hearing.

Earlier: Bipartisan Draft Bill Would Fortify Children’s Data Privacy

Legal Obligations, Suits

Even if the company were subject to COPPA, the law doesn’t mandate firms to make a good faith attempt to determine a user’s age, Cuaresma added. Common Sense Media, which focuses on children and technology, isn’t advocating for strict liability. Instead, it wants the draft bill to impose an obligation that companies use age information not just in their marketing divisions, but also in their legal divisions.

The bipartisan privacy bill would also prohibit companies from transferring the data of individuals that to their knowledge are between 13 and 17 years old without express, affirmative consent. Common Sense is advocating for the language to be changed to cover anyone under 18, in part to simplify compliance.

“It’s really easy to get confused about whether somebody is 14 or 17,” Cuaresma said. “My daughter has a pretty mature voice and can often pass for me, and so I would like to make sure we are not creating burdens for small companies by creating all of these different ages in a bill.”

The bipartisan bill also allows individuals to directly sue companies, known as a private right of action, for certain privacy violations. In cases involving minors, companies are prohibited in the bipartisan bill from forcing consumers to settle the dispute via private arbitration.

David Brody, managing attorney of the Digital Justice Initiative at the Lawyers’ Committee for Civil Rights Under Law, said it is most important to improve the bipartisan bill’s “narrow private right of action” that “curtails the ability of individuals to obtain relief from a court.”

Earlier: Tech Companies Couldn’t Force Arbitration Under Draft Bill

Senate Commerce Chair Maria Cantwell (D-Wash.) has introduced her own draft privacy bill with even broader private right of action language. Cantwell says she broke away from her counterparts because the enforcement mechanisms in the trio’s bill aren’t strong enough.

On the other hand, John Miller, senior vice president of policy and general counsel at the Information Technology Industry Council, said companies are still concerned the private right of action language in the bipartisan draft is too broad and won’t limit a likely wave of litigation.

ITI is a global trade association whose members include giants such as Alphabet Inc.’s Google, Meta Platforms Inc., and Apple Inc.

Discrimination in Algorithms

Advocacy groups, such as the Lawyers’ Committee, the Future of Privacy Forum, and the Electronic Privacy Information Center, have also shed light on how communities of color and marginalized populations face discriminatory algorithms and artificial intelligence models that reinforce structural racism and bias.

Caitriona Fitzgerald, the Electronic Privacy Information Center’s deputy director, recommended adding more robust requirements to assessments of algorithm impact “so they do not simply become box-checking exercises,” including by compelling businesses to explain how each algorithm was developed, the training data, and the anticipated purposes and capabilities.

Brody, from the Lawyers’ Committee, lauded the “very strong” civil rights provisions in the bipartisan bill, including the algorithmic bias assessment requirements and antidiscrimination language, but maintained enforcement must be better.

“The current proposal inserts several procedural hurdles that will not reduce litigation costs but will block injured individuals from being able to have their day in court—such as traps designed to trip up individuals who do not use magic words when asserting their rights,” he said.

To contact the reporter on this story: Maria Curi in Washington at mcuri@bloombergindustry.com

To contact the editors responsible for this story: Anna Yukhananov at ayukhananov@bloombergindustry.com; Sarah Babbage at sbabbage@bgov.com