FTC: entrée en vigueur des nouvelles règles relatives à la COPPA

Le règlement d'application de la Children's Online Privacy Protection Act (COPPA) adopté en décembre 2012 (billet) est entré en vigueur hier, 1er juillet et, comme le rappelle la Federal Trade Commission (FTC): 

"The COPPA rule was mandated when Congress passed the Children’s Online Privacy Protection Act of 1998. It requires that operators of websites or online services that are either directed to children under 13 or have actual knowledge that they are collecting personal information from children under 13 give notice to parents and get their verifiable consent before collecting, using, or disclosing such personal information, and keep secure the information they collect from children."

(Source: FTC, News Release, July 1, 2013)

Pour permettre aux entreprises de se conformer à ce règlement, la FTC propose différents documents, notamment : 

• un guide The Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business pour permettre à une entreprise de répondre aux exigences de la COPPA, à savoir 1) déterminer si l'entreprise collecte des renseignements personnels concernant des enfants de moins de 13 ans et, si tel est le cas elle doit 2) adopter une politique de confidentialité; 3) informer les parents avant de collecter de tels renseignements personnels; 4) obtenir leur consentement; 5) leur accorder un droit d'accès et de rectification et 6) mettre en oeuvre des mesures de sécurité tenant compte de la sensibilité des données;
• une vidéo expliquant aux entreprises les droits et les obligations prévus par la COPPA et son règlement d'application; 

La FTC propose également un guide Protecting Your Child's Privacy Online destiné aux parents afin de leur donner les outils nécessaires pour protéger leurs enfants et comprendre les enjeux relatifs à la collecte et au traitement de leurs renseignements personnels par les entreprises.

Et dans son communiqué, la FTC indique qu'elle a reconduit les programmes suivants: Aristotle International, Inc., Children’s Advertising Review Unit of the Council of Better Business Bureau, ESRB Privacy Online, TRUSTe, et Privo, Inc., lesquels certifient que les entreprises qui y adhèrent respectent les règles de la COPPA et de son règlement d'application:

"To coincide with the amended COPPA rule taking effect, the FTC has also continued five “safe harbor” programs, whose guidelines now reflect the modified rule. Under COPPA, safe harbor status allows certain organizations to create comprehensive self-compliance programs for their members. Companies that participate in a COPPA safe harbor program are generally subject to the review and disciplinary procedures provided in the safe harbor’s guidelines in lieu of formal FTC investigation and law enforcement. COPPA safe harbor programs are offered by Aristotle International, Inc., the Children’s Advertising Review Unit of the Council of Better Business Bureaus, ESRB Privacy Online, TRUSTe, and Privo, Inc."

(Source: FTC, News Release, July 1, 2013) 

Pour aller plus loin, voir notamment: 

• FEDERAL TRADE COMMISSION, "Revised Children's Online Privacy Protection Rule Goes Into Effect Today", News Release, July 1, 2013.

FTC: nouvelles règles relatives à la COPPA

Début décembre, la Federal Trade Commission (FTC) a complété son processus de révision des règles d'application de la Children's Online Privacy Protection Act (COPPA), processus qui avait commencé en septembre 2011. 

Il convient de mentionner que ces règles, entrées en vigueur en avril 2000, ont pour objet d'encadrer la collecte des renseignements personnels auprès de jeunes de moins de 13 ans et, qu'elles ont été mises de l'avant par la FTC à plusieurs reprises: Playdom Inc., W3 Innovations LLC, www.skidekids.com, par exemple

Les nouvelles règles modifient la définition de certaines notions, notamment: "operator", "personal information", "website or online service directed to children", "collection". Elles renforcent certaines exigences quant à l'information préalable, au consentement des parents, à la sécurité ou encore quant au contrôle exercé par la FTC sur les différents programmes d'exonération. Elles insistent sur l'importance d'adopter des procédures raisonnables pour la conservation et la destruction des des données. 

Ces nouvelles règles entreront en vigueur en le 1er juillet 2013.

Pour aller plus loin: 

• FEDERAL TRADE COMMISSION, "FTC Strengthens Kids’ Privacy, Gives Parents Greater Control Over Their Information By Amending Children’s Online Privacy Protection Rule", Media Release, December 19, 2012. 

FTC (et autres): applications mobiles et jeunes

Il y a quelques mois la Federal Trade Commission (FTC) a publié une étude dans laquelle elle invitait les développeurs d'applications mobiles à revoir la présentation et le contenu de l'information transmise aux jeunes, mais aussi à leurs parents afin que celle-ci soit plus accessible (billet). Le 10 décembre dernier, la FTC rendait publique les conclusions de sa nouvelle étude sur cette même problématique. 

Dans cette nouvelle étude intitulée Mobile Apps for Kids: Disclosures Still Not Making the Grade, la FTC constate que "parents still are not given basic information about the privacy practices and interactive features of mobile apps aimed at kids ... many of the apps shared certain information - such as device ID, geolocation, or phone number - with third parties without disclosing that fact to parents" ... a number of apps contained intercative features - such as advertising, the ability to make in-app purchase, and links to social media - without disclosing these features to parents prior to download". (Source: FTC Staff Report, p. 4)

La FTC en arrive alors à la conclusion que: 

"Since FTC staff conducted its first kids’ app survey, many stakeholders have called for industry to increase transparency in the mobile marketplace, and many initiatives have been launched in pursuit of that goal. Despite these efforts, staff found little or no improvement in the disclosures made and, worse, a significant discrepancy between the privacy disclosures and the actual practices of the surveyed apps. Without adequate and accurate information about apps they download for their kids, parents cannot make informed choices about their children’s privacy and exposure to social networks and other interactive features.

FTC staff has initiated a number of investigations to address the gaps between company practices and disclosures. These discrepancies could constitute violations of COPPA or the FTC Act’s prohibition against unfair or deceptive practices. However, enforcement actions alone, while vitally important, are not enough to ensure that the privacy of consumers and their children are protected adequately. Staff calls on everyone involved in the mobile app marketplace – app stores, app developers, and third-parties that interact with the apps – to follow the three key principles laid out in the FTC’s Privacy Report: (1) adopting a “privacy- by-design” approach to minimize risks to personal information; (2) providing consumers with simpler and more streamlined choices about relevant data practices; and (3) providing consumers with greater transparency about how data is collected, used, and shared. Of greatest relevance to the findings in this report, industry participants must work together to develop accurate disclosures regarding what data is collected through kids’ apps, how it will be used, who it will be shared with, and whether the apps contain interactive features such as advertising, the ability to make in-app purchases, and links to social media." 

(Source: FTC Staff Report, p. 21)

Cette étude de la FTC fait écho à celle menée par Pew Internet & American Life Project selon laquelle "most parents of teenagers are concerned about what their teenage children do online and how their behavior could be monitored by others. Some parents are taking steps to observe, discuss, and check up on their children's digital footprints" ... et cette étude menée auprès de 802 parents et jeunes démontre que :

"- 81% of parents of online teens say they are concerned about how much information advertisers can learn about their child’s online behavior, with some 46% being “very” concerned.
- 72% of parents of online teens are concerned about how their child interacts online with people they do not know, with some 53% of parents being “very” concerned.
- 69% of parents of online teens are concerned about how their child’s online activity might affect their future academic or employment opportunities, with some 44% being “very” concerned about that. 
- 69% of parents of online teens are concerned about how their child manages his or her reputation online, with some 49% being “very” concerned about that." 

(Source: Pew Internet, p. 2)

Cette étude de la FTC fait également écho au rapport du Défenseur des droits intitulé Enfants et écrans: grandir dans le monde numérique proposant notamment de "faire reconnaître aux mineurs le droit à une protection renforcée de leur vie privée (droit à l'oubli, droit au déréférencement)" (p. 8).


Pour aller plus loin, 

• FEDERAL TRADE COMMISSION, Mobile Apps for Kids: Disclosures Still Not Making the Grade, December 2012.  
• PEW INTERNET & AMERICAN LIFE PROJECT and BERKMAN CENTER FOR INTERNET ? SOCIETY, Parents, Teens and Online Privacy, Novermber 14, 2012.  
• DÉFENSEUR DES DROITS, Enfants et écrans: grandir dans le numérique, 20 novembre 2012.

FTC: guide pour les développeurs d'applications mobiles

La Federal Trade Commission (FTC) vient de publier un guide destiné aux développeurs d'applications mobiles relatif à la publicité et à la protection des renseignements personnels.
 

Ce guide insiste, entre autres, sur l'importance de dire la vérité et d'informer clairement les utilisateurs des caractéristiques et des conditions d'utilisation de l'application. Ou encore sur la nécessité: 

• de prendre en considération, dès la conception du produit, les principes de protection des renseignements personnels (Privacy by Design); 
• d'adopter, de publier et de respecter ses engagements en matière de protection des renseignements personnels; 
• de tenir compte de la Children's Online Privacy Protection Act (COPPA) si l'application est destinée à des utilisateurs de moins de 13 ans. Rappelons que la FTC est en train de procéder à la révision de cette loi (billet); 
• de ne collecter des renseignements personnels sensibles qu'avec le consentement des personnes concernées; 
• d'adopter des mesures de sécurité propres à assurer la confidentialité des renseignements personnels. 

Pour aller plus loin: 

• FEDERAL TRADE COMMISSION, Marketing Your Mobile App - Get It Right From the Start, August 2012. 
• FEDERAL TRADE COMMISSION, "FTC Publishes Guide to Help Mobile App Developers Observe Truth-in-Advertising, Privacy Principles", Press Release, September 5, 2012.

FTC et révision de la COPPA

On peut lire sur le site de la Federal Trade Commission (FTC) que la date limite pour envoyer des commentaires quant au projet de révision des règles d'application de la Children's Online Privacy Protection Act (COPPA) a été prolongée jusqu'au 24 septembre 2012. 

Il convient de rappeler que la COPPA est entrée en vigueur en 2000. En vertu de cette loi, tout site Web qui collecte des renseignements personnels auprès de jeunes de moins de 13 ans doit obtenir le consentement préalable des parents. 

La FTC veille à l'application de cette loi. En septembre 2011, elle a débuté ses travaux visant à réviser cette loi et ses règles d'application. À cette fin, elle a publié des études (billet) ou encore mis en place des consultations (billet 1 et 2). 

La consultation en cours concerne les règles d'application de cette loi, plus particulièrement les modifications présentées le 1er août 2012:  

"The proposed modifications to the definitions of "operator" and "website or online service directed to children" would allocate and clarify the responsibilities under COPPA when third parties such as advertising networks or downloadable software kits ("plug-ins") collect personal information from users through child-directed websites or services. The Commission proposes to state within the definition of "operator" that personal information is "collected or maintained on behalf of" an operator where it is collected in the interest of, as a representative of, or for the benefit of, the operator. This change would make clear that an operator of a child-directed site or service that chooses to integrate the services of others that collect personal information from its visitors should itself be considered a covered "operator" under the Rule.
The Commission also proposes to modify the definition of "website or online service directed to children" to:

1. Clarify that a plug-in or ad network is covered by the Rule when it knows or has reason to know that it is collecting personal information through a child-directed website or online service;
2. Address the reality that some websites that contain child-oriented content are appealing to both young children and others, including parents. Under the current Rule, these sites must treat all visitors as under 13 years of age. The proposed definition would allow these mixed audience websites to age-screen all visitors in order to provide COPPA's protections only to users under age 13; and,
3. Clarify that those child-directed sites or services that knowingly target children under 13 as their primary audience or whose overall content is likely to attract children under age 13 as their primary audience must still treat all users as children.

Finally, the Commission proposes to modify the Rule's definition of "personal information" to make clear that a persistent identifier will be considered personal information where it can be used to recognize a user over time, or across different sites or services, where it is used for purposes other than support for internal operations. In connection with this change, the Commission proposes to modify the definition of "support for internal operations" in order to explicitly state that activities such as: site maintenance and analysis, performing network communications, use of persistent identifiers for authenticating users, maintaining user preferences, serving contextual advertisements, and protecting against fraud and theft will not be considered collection of "personal information" as long as the information collected is not used or disclosed to contact a specific individual, including through the use of behaviorally-targeted advertising, or for any other purpose".

(Source: FTC, News, 01-08-2012)

À suivre donc ...

Pour aller plus loin, 

• FEDERAL TRADE COMMISSION, 
• "FTC Extends Deadline to Comment on Proposed Modifications to the Children's Online Privacy Protection Rule Until September 24, 2012", News Release, August 27, 2012.  
• "FTC Seeks Comments on Additional Proposed Revisions to Children's Online Privacy Protection Rule", News Release, August 1, 2012.
• "Children's Online Privacy Protection Rule - Additional Proposed Modifications", (2012) vol. 77 n° 151 Federal Register 46643
• "Children's Online Privacy Protection Rule - Proposed Rules", (2011) vol. 76 n° 187 Federal Register 59804.

FTC: applications mobiles et politique de confidentialité

Dans le cadre de ses travaux sur les amendements à apporter à la Children's Online Privacy Protection Act (billet), la Federal Trade Commission (FTC) vient de publier une étude intitulée Mobile Apps for Kids: Current Privacy Disclosures Are Disappointing.

Cette étude invite les développeurs d'applications mobiles à revoir la présentation et le contenu de l'information transmise aux jeunes, mais également à leurs parents afin que celle-ci soit plus accessible.

"FTC staff believes that all members of the kids app ecosystem [...] should play an active role in providing key information to parents who download apps. The mobile app marketplace is growing at a tremendous speed, and many consumer protections, including privacy and privacy disclosures, have not kept pace with this development. Parents need easy access to basic information so they can make informed decisions about the apps they allow their children to use". 

(Source: FTC Staff Report, p. 7)

Dès lors, il est indiqué que

"App developers should provide this information through simple and short disclosures or icons that are easy to find and understand on the small screen of a mobile device. Parents should be able to learn what information an app collects, how the information will be used, and with whom the information will be shared.16 App developers also should alert parents if the app connects with any social media, or allows targeted advertising to occur through the app. Third parties that collect user information through apps also should disclose their privacy practices, whether through a link on the app promotion page, the developers’ disclosures, or another easily accessible method."

(Source: FTC Staff Report, p. 7)

Pour y arriver, la FTC reconnaît que: 

"Additional work is needed to identify the best means and place for conveying data practices in plain language and in easily accessible ways on the small screens of mobile devices. Staff encourages industry members, privacy groups, academics, and others to develop and test new ways to provide information to parents – for example, by standardizing language, creating icons, or using a layered approach."

(Source: FTC Staff Report, pp. 7 et 8)

Après avoir expliqué sa méthodologie, la FTC en arrive à la conclusion que : 

"The mobile apps marketplace is a constantly evolving new media that offers parents many new options for entertaining and educating their children. Staff’s survey shows, however, that parents generally cannot determine, before downloading an app, whether the app poses risks related to the collection, use, and sharing of their children’s personal information. Although the two major U.S. mobile app stores provide some information and controls governing apps, all members of the mobile app ecosystem – the app stores, the developers, and the third parties providing services within the apps – must do more to ensure that parents have access to clear, concise and timely information about the apps they download for their children. Parents should be able to learn, before downloading an app for their children, what data will be collected, how the data will be used, and who will obtain access to the data. Armed with such information, parents can make knowledgeable decisions about the apps they choose for their children, and embrace these technologies with more confidence. Staff is committed to working with all stakeholders on these issues, and also plans to continue its vigorous enforcement of the COPPA statute and Rule. Staff hopes that this report will spur greater transparency and meaningful disclosure about the data collection practices in apps for children."

(Source: FTC Staff Report, p. 17)

Pour aller plus loin: 

• FEDERAL TRADE COMMISSION, Mobile Apps for Kids: Current Privacy Disclosures Are Disappointing, FTC Staff Report, February 2012.
• FEDERAL TRADE COMMISSION, "FTC Report Shows Privacy Problems with Mobile Apps", Latest News, February 16, 2012.
• FEDERAL TRADE COMMISSION, "FTC Report Raises Privacy Questions About Mobile Applications for Children", For Release, February 16, 2012. 

FTC et la COPPA (2)

La consultation lancée par la Federal Trade Commission (FTC) relative à la Children's Online Privacy Protection Act (COPPA) (billet 1 et 2) se termine le 23 décembre 2011. 

C'est dans cette optique que l'Electronic Privacy Information Center a fait parvenir à la FTC ses commentaires. On peut ainsi lire sur le site de l'EPIC que: 

"EPIC submitted comments to the FTC on a proposed rule for the Children's Online Privacy Protection Act. The proposed rule would revise the definition of Personally Identifiable Information to include identifiers such as cookies, IP addresses, and geolocation information. The new rules also contain data minimization and deletion requirements and simplified methods of obtaining parental consent for data collection. "The proposed revisions update the COPPA Rule by taking better account of the increased use of mobile devices by users and of new data collection practices by businesses," EPIC said. However, EPIC urged the FTC to further improve the rule by applying it to SMS and MMS messaging services, extending the definition of "personal information" to cover the combination of date of birth, gender, and ZIP code, and adding a data-breach notification requirement. EPIC previously testified before the Senate and filed comments with the agency."

(Source: EPIC, News, December 22, 2011)

Pour plus de détails, 

• ELECTRONIC PRIVACY INFORMATION CENTER, "EPIC Submits Comments on Children's Online Privacy Rule", News, December 22, 2011. 
• Comments of the Electronic Privacy Information Center to the Federal Trade Commission, RIN 3084-AB20, "COPPA Rule Review, 16 CFR Part 312, Project No. P104503", December 23, 2011.

FTC et la COPPA

On peut lire sur le site de la Federal Trade Commission (FTC) que la consultation relative à la la Children's Online Privacy Protection Act (COPPA) (billet) est prolongée jusqu'au 23 décembre 2011 et ce, dans les termes suivants:

"The Federal Trade Commission has extended until December 23, 2011, the deadline for the public to submit comments on proposed amendments to the Children’s Online Privacy Protection Rule, which gives parents control over what personal information websites and online services may collect from children under 13. In September, the FTC announced that it was proposing amendments to ensure that the Rule continues to protect children’s privacy as online technologies evolve, with comments due by November 28, 2011. Citing the nature and complexity of the questions and issues raised by the proposed amendments, a number of organizations requested that the Commission extend the comment deadline."

(Source: FTC - 18/11/2011) 

• FEDERAL TRADE COMMISSION, "FTC Extends Deadline for Comments on Proposed Amendments to the Children’s Online Privacy Protection Rule Until December 23", November 18, 2011. 

FTC et les sites pour enfants

La Federal Trade Commission, tout comme avec Playdom (billet) et W3 Innovation LLC (billet), vient de conclure un accord avec le site "www.skidekids.com" pour violation des règles du Children's Online Privacy Protection Act qui interdit la collecte de renseignements personnels d'enfants de moins de 13 ans sans le consentement préalable des parents. Ce site se présente comme étant le "Facebook et le Myspace pour enfants".

• FEDERAL TRADE COMMISSION, "Operator of Social Networking Website for Kids Settles FTC Charges Site Collected Kids’ Personal Information Without Parental Consent", News Release, November 8, 2011.
• "FTC Settles COPPA Violation Charges Against Children’s Social Networking Website", Privacy and Information Security Law Blog, November 9, 2011.
• ELECTRONIC PRIVACY INFORMATION CENTER, "FTC Enforces COPPA Against Website that Collected Children's Personal Information without Parental Consent", Latest News, November 9, 2011. 
• [13-11-2011] David SILVERMAN, "FTC Enters into Consent Decree with Skid-e-Kids for COPPA Violations", Privacy and Security Law Blog, November 9, 2011.

FTC: lancement d'une consultation sur la COPPA

La Children's Online Privacy Protection Act (COPPA) est entrée en vigueur en 2000. En vertu de cette loi, tout site Web qui collecte des renseignements personnels auprès de jeunes de moins de 13 ans doit obtenir le consentement préalable des parents. La Federal Trade Commission (FTC) veille à l'application de cette loi. 

Face à l'évolution des environnements électroniques la FTC a lancé une consultation en vue de réviser la COPPA dans cinq domaines. 

"The Commission proposes modifications to the Rule in five areas: definitions, including the definitions of "personal information" and "collection", parental notice, parental consent mechanisms, confidentiality and security of children's personal information, and the role of self-regulatory "safe harbor"programs".

(Source: FTC, Press Release - September 15, 2011)

La consultation est ouverte jusqu'au 28 novembre 2011. 

Pour plus de détails, voir notamment: 

• FEDERAL TRADE COMMISSION, Children's Online Privacy Rule: Proposed Rule; Request for Comment (16 CFR Part 312). (attention 122 pages)
• FEDERAL TRADE COMMISSION, "FTC Seeks Comment on Proposed Revisions to Children's Online Privacy Protection Rule", Press Release, September 15, 2011. 

• ELECTRONIC PRIVACY INFORMATION CENTER, "Federal Trade Commission Proposes New Rules for Children's Online Privacy", Latest News, September 15, 2011. 
• Lindsey TONSAGER, "FTC Releases Proposed COPPA Rules", Inside Privacy, September 15, 2011. 
• Somini SENGUPTA, "Update Urged on Children's Online Privacy", New York Times, September 15, 2011. 

(21-09-2011) "FTC Proposes COPPA Rule Changes", Privacy and Information Security Law Blog, September 19, 2011. 

(06-10-2011) Michael BEDER, "House Subcommittee Discusses COPPA Updates, Teen Privacy", Inside Privacy, November 6, 2011.

FTC, W3 Innovation LLC et la protection des jeunes en ligne

Tout comme avec Playdom Inc. (billet), la Federal Trade Commission vient de conclure un accord avec le développeur d'applications mobiles W3 Innovations, LLC, suite à la violation des règles du Children's Online Privacy Protection Act qui interdit la collecte de renseignements personnels d'enfants de moins de 13 ans sans le consentement préalable des parents.

Pour plus de détails, voir notamment:

• FEDERAL TRADE COMMISSION, "Mobile Apps Developer Settles FTC Charges It Violated Children's Privacy Rule - Company Collected Kids' Information Without Their Parents' Consent", News Release, August 15, 2011.
• "FTC Announces First Privacy Settlement Involving Mobile Applications", Privacy and Information Security Law Blog, August 15, 2011.
• Lindsey TONSAGER, "FTC Settles First COPPA Complaint Against Mobile App Developer", Inside Privacy, August 15, 2011.

(17/08/2011) Voir également:

• "FTC Finds Mobile Phone App Violated Children's Privacy Law", Electronic Privacy Information Center, August 16, 2011.
• David SLIVERMAN, "FTC Announces First-Ever COPPA Enforcement Action Against Mobile Apps", Privacy and Security Law Blog, August 17, 2011.
• Tanzina VEGA, "In a First, FTC Settles With App Developer Over Children's Privacy", The New York Times, August 15, 2011.

FTC, Playdom Inc. et la vie privée des jeunes en ligne

La Federal Trade Commission et Playdom. Inc. (une filiale de Disney) ont conclu un accord à l'amiable (3 millions USD) suite à la violation des règles du Children's Online Privacy Protection Act qui interdit la collecte de renseignements personnels d'enfants de moins de 13 ans sans le consentement préalable des parents.

• FEDERAL TRADE COMMISSION, "Operators of online "Virtual Worlds" to pay $3 million to settle FTC charges that they illegally collected and disclosed children's personal information", News Release, 12 may 2011
• Children's Online Privacy Protection Act of 1998
• FEDERAL TRADE COMMISSION - BUREAU OF CONSUMER PROTECTION, "Children's Online Privacy"