Tampa’s Rep. Kathy Castor is seeking to give kids (and their parents) significantly more control over their data.
Castor filed a bill Thursday that would strengthen existing online privacy protections for kids younger than 18. Among the bill’s most significant proposals is an outright ban on ads targeted to individual children.
“The laws on the books simply do not match our modern challenges,” Castor said.
Conversations about consumer data privacy have reached the national stage in recent years as more attention is given to how tech companies collect, use and sell data. Such pervasive tracking has prompted several information privacy laws around the country, the most stringent of which went into effect in California this year.
Castor’s bill seeks to amend the federal Children’s Online Privacy Protection Act, one of the few federal online privacy laws. The law currently provides data privacy for children 13 years old or younger, requiring parental permission before their data can be collected for marketing purposes.
Castor’s “Protecting the Information of our Vulnerable Children and Youth Act” broadens protections to teenagers aged 13 to 17, requiring consent from the teenagers themselves. And it says that companies cannot make access to their platforms contingent on its young users agreeing to have information about them harvested.
“Snapchat can’t kick you out just because you don’t agree to their collection,” said Josh Golin, executive director for the Campaign for Commercial Free Childhood. His nonprofit consulted on the bill.
Those covered by the bill would be able to dictate which companies, if any, can collect their personal data and how it is used. Anyone younger than 18 years old would need to affirmatively opt in to tracking and ads, as opposed to being tracked by default.
“We need to move to something that puts a little more burden on the companies,” said Michelle Richardson, director of the Center for Democracy and Technology’s privacy and data project.
Currently, companies can only be prosecuted under the law if they know they collect data from children. Many companies, Richardson said, don’t openly acknowledge they have such young users to get around this. The bill requires the law to apply in instances where companies should know some of their users are children, such as TikTok and Instagram.
To enforce these proposed regulations, the Federal Trade Commission would be able to impose a maximum fine of about $63,700 per violation, nearly double the current cap, as well as seek punitive damages.
Parents, too, would be able to go after companies through the courts. Under the current law, they are limited to submitting complaints to the commission or relevant state agencies.
“It’s a fairly significant potential expansion of liability," said Joe Swanson, a cybersecurity and privacy attorney in Tampa.