Federal Trade Commission Office of the Secretary Room H-113 (Annex E) 600 Pennsylvania Avenue, N.W. Washington, DC 20580

Re: COPPA Rule Review, 16 CFR Part 312, Project No. P-104503

The undersigned privacy and consumer organizations write today to applaud the Federal Trade Commission (FTC) for updating the privacy safeguards in the Children’s Online Privacy Protection Act (COPPA) rule by expanding the definition of personal information, limiting the duration information is retained, and improving the mechanisms for protecting this personal information.  We urge the Commission not only to implement these safeguards as part of any final rulemaking but also to seek opportunities to go beyond young people and push, through Commission reports and use of the Commission’s authority under section 5, to apply these privacy protections to internet users of all ages. Information collection online has become a robust ecosystem where marketers and others gather, link, and store information on consumers, both children and adults, for a variety of purposes.  A detailed picture of consumer habits and behaviors emerges from these efforts.  A third party creates and holds a detailed dossier of an individual consumer’s interests, reading habits, friends and family, financial status, health information, religious and political affiliation.  Such a dossier exists largely outside a consumers control and knowledge.

As the FTC rightly recognizes, two identifiers play a key role in the information collection process.  Internet Protocol (IP) information (derived from internet addressing and routing information) and persistent cookies (a unique identifier assigned by the website) create a direct link between individuals and their online activities.  IP addresses and cookies have the same utility as a name, postal address or social security number in identifying users.  These internet identifiers assist in ascertaining the websites consumers visit, in tracking consumer movements across the internet, and in collecting private and often sensitive information such as personal interests, banks, and online accounts.  By recognizing the role that these two identifiers play in identifying consumers online, the Commission is taking the first step toward allowing consumers to regain control over their online information.

We approve also of the provision in the proposed rule including geo-location information within the definition of personal information to be protected. The FTC’s inclusion of geo-location information is an important recognition of the growing breadth and scope of consumer data.  Location enabled devices, including cell phones and laptops, and data derived from them, such as geo-tagged photos and logs of individual movements from location based services, are becoming ubiquitous.  Such devices and data provide not only the ability to identify individuals but also a wealth of new information about them. The proposed rule correctly identifies a third area, a data retention standard, which requires broader protections.   For the first time the Commission has proposed a COPPA requirement to hold personal information no longer than reasonably necessary to fulfill the purpose for which it was collected.  Deleted information cannot be lost, misused or otherwise harm an individual.  This axiomatic fact is why data retention limits are a core privacy value and why it is so important that they be part of not only COPPA but any privacy protection regime. The proposed rule also updates the controls and protections governing consumer personal information.  The new COPPA safe harbor process would now require any party seeking to use a safe harbor to provide evidence of its ability to enforce compliance, a full text of all compliance requirements, and the provision of independent compliance audits.  Website operators would also have to assure consumers that if the operators share information with third parties, the third parties would take  reasonable measures to protect the confidentially and security of consumer information.  Such requirements help assure that any safe harbor provides not just theoretical protection for consumers but actual, enforced safeguards for their personal information.  We applaud the Commission for these proposed improvements to COPPA and urge the FTC to include them in the final rule and, to the greatest extent possible, expand these protections to every American.

Sincerely,

American Civil Liberties Union

Center For Digital Democracy

Center for Financial Privacy and Human Rights

Common Sense Media

Consumer Action

Consumer Federation of America

Consumer Watchdog

Electronic Privacy Information Center

PrivacyActivism

Privacy Journal, Robert Ellis Smith, Publisher

Privacy Rights Clearinghouse

Privacy Rights Now Coalition, Remar Sutton, Founderthe FoolProof Initiative

U.S. Public Policy Council of the Association for Computing Machinery (USACM)

World Privacy Forum