House Bill Would Allow Suits Over Kids’ Privacy Violations (1)

A House Democrat is attempting to overhaul decades-old online protections for children by giving parents the right to sue companies and expanding privacy coverage to teenagers, but the proposal may struggle to gain traction across the aisle.

Rep. Kathy Castor (D-Fla.) is introducing a bill (H.R. 5703) Thursday that would dramatically change the enforcement of the Children’s Online Privacy Protection Act (COPPA) that was signed into law in 1998. If it becomes law, it would affect large technology companies that host content directed toward children, including Google’s YouTube, which has faced fines for kids’ privacy violations.

“I think there’s been an awakening in the Congress and somewhat across the country in the depth and breadth of surveillance and data gathering and tracking. So I anticipate we will have a lot of interest,” Castor, a member of the House Energy and Commerce Committee, said in an interview.

The Protecting the Information of our Vulnerable Children and Youth Act (PRIVCY) includes a private right to action, which would allow parents to bring civil lawsuits against companies for children’s privacy violations. Democrats have pursued the private right of action in separate comprehensive federal privacy bill negotiations, but the provision so far has not attracted Republican support. Republicans oppose a private right of action because they say it exposes companies to lawsuits that could harm smaller startups without large legal departments.

Castor’s bill currently has no cosponsors or Republican support. Strong opposition from Republicans to a private right of action in any privacy bill means it will likely face an uphill battle this Congress.

Still, Castor is optimistic she’ll get some bipartisan support. “I’m hopeful that a lot of our GOP colleagues will understand we’re talking about children here and the surveillance of their online practices,” she told reporters in a call on Thursday.

Rep. Cathy McMorris Rodgers (R-Wash.), ranking member on the subcommittee, said she is “supportive of strengthening COPPA,” and is reviewing Castor’s bill. Earlier in the week she said she didn’t support a private right of action in a broad federal privacy bill, and has concerns that allowing civil lawsuits could negatively affect innovation and small businesses.

McMorris Rodgers said she sees a bipartisan COPPA bill that Reps. Tim Walberg (R-Mich.) and Bobby Rush (D-Ill.) introduced earlier this month as model legislation that doesn’t include a private right of action. “I’m encouraged that people are interested and want to engage on this issue. Any progress on COPPA needs to be bipartisan, and there is a bipartisan bill from Reps. Walberg and Rush that we’re reviewing,” she said in an emailed statement.

The tech industry also pushed back on the inclusion of private right of action in the bill.

“Empowering the plaintiff’s bar to go after every business is the surest way to eliminate age appropriate content for young people,” said Carl Szabo, vice president and general counsel at NetChoice, a trade group whose membership includes Google and Twitter. “Just as COPPA was responsible for decimating innovative content for children, a private right of action will do the same for young people.”

Jim Dunstan, general counsel at TechFreedom, a tech policy think tank, also voiced concern. “Most importantly, allowing unfettered private rights of action will create yet another cottage industry of class action lawyers shaking down kids content creators. Kids lose, creators lose. Only the lawyers win,” he said.

Castor’s bill does have the backing of Rep. Jan Schakowsky (D-Ill.), chairwoman of the Energy and Commerce Consumer Protection and Commerce Subcommittee. Schakowsky said Democrats continue to work on a private right of action and to reach a middle ground with Republicans. “It’s not an all-or-nothing proposition,” she said. Schakowsky said she thinks Castor’s bill could move with her committee’s broad bipartisan draft privacy bill that staff circulated in December.

Increased FTC Authority

Castor’s measure would raise the Federal Trade Commission’s maximum allowable civil penalty per violation by 50% and would allow the agency to pursue punitive damages. The bill would also ban forced arbitration, which currently allows companies to force consumers to waive their right to sue. The bill would place protections on children’s biometric, facial recognition, and geolocation information.

COPPA currently imposes requirements on websites or online services directed at children under the age of 13. Castor’s bill would create a new protected class of “young consumers” for children ages 13 to 17, ban companies from sending targeted advertisements to children, require opt-in consent from children under the age of 18, and require companies to allow consumers the right to access, correct, or delete their personal information, according to text of the bill obtained by Bloomberg Government.

The bill would hold companies responsible if they had both actual and constructive knowledge that they were collecting information from children or young consumers. Currently, COPPA only holds companies accountable if they have “actual knowledge,” which has been interpreted as specific information that confirms the child’s age, like a birth date.

Castor’s bill would expand that to include “constructive knowledge” to hold companies responsible for protecting children’s privacy if they knew or had reason to know that children were using their website.

“COPPA’s current actual knowledge standard has been strictly interpreted, leading to companies like TikTok pretending for years that they did not have children on their site,” Ariel Fox Johnson, senior counsel for policy and privacy at Common Sense Media, a nonprofit that aims to promote safe technology and media for children, said on a press call. This bill would not let companies “turn a blind eye” to knowledge of children on their site, she said.

McMorris Rodgers cautioned that she wants to ensure changes to the knowledge standard aren’t counterproductive. “We want to make it easier to confirm whether a user is a child, not harder. I’m also concerned about the impact a private right of action would have on small businesses and innovation,” she said in a statement.

In September, the FTC fined YouTube a record $170 million and limited advertising in kids’ videos to settle claims that the company violated children’s privacy laws. Critics called the fine an insufficient deterrent that didn’t go far enough to prevent future violations.

The FTC is also reviewing its COPPA rule. The agency held a workshop and collected public feedback on whether to update the rule to address how children’ privacy is affected by new technologies, business models, and evolving privacy harms online. It is still reviewing the thousands of comments it received in December.

Other Bipartisan Bills Offered

There are two bipartisan bills in the House and Senate that may gain traction.

The measure (H.R. 5573) introduced by Walberg and Rush would raise the age of parental consent for 13-16 year-olds and protect the geolocation and biometric data of children.

Sens. Josh Hawley (R-Mo.) and Ed Markey (D-Mass.) introduced their version of a COPPA update (S. 748) last March, which would require parental consent to collect data on children under the age of 13, and users’ consent for kids ages 13 to 15. It would also protect geolocation and biometric data.

Neither bill would allow parents the right to sue companies over children’s privacy violations.

Castor’s bill has the backing of several children’s safety groups that want to see it combined with the Senate bill.

“Our hope is that the House will support this bill and merge it with the Senate’s Markey/Hawley COPPA 2.0 proposal to produce strong pro-kids federal privacy legislation,” said Katharina Kopp, deputy director Center for Digital Democracy, a consumer protection and privacy organization.

With assistance from Ben Brody (Bloomberg News) and Daniel R. Stoller

To contact the reporter on this story: Rebecca Kern in Washington at rkern@bgov.com

To contact the editors responsible for this story: Zachary Sherwood at zsherwood@bgov.com; Jodie Morris at jmorris@bgov.com; Brandon Lee at blee@bgov.com