Privacy & Information Security Law Blog

On October 8, 2021, Senator Ed Markey (D-Mass) and Representatives Kathy Castor (D-Fla) and Lori Trahan (D-Mass) penned a letter to Chair of the Federal Trade Commission Lina Khan, urging the agency to ensure that companies uphold the commitments made in their children’s privacy notices and “hold them accountable if they fail to do so.” In the letter, the lawmakers noted that many technology companies have recently announced updates to their respective platforms’ policies that are intended to enhance children and teen protections in compliance with the UK’s Age Appropriate Design Code (“AADC”), which took effect on September 2, 2021.

The AADC sets out 15 standards that online services need to meet in order to protect children and teens online, including requirements to (1) take into consideration the best interests of children, (2) refrain from using children’s personal data in ways that are detrimental to their wellbeing, and (3) ensure that settings are “high privacy” by default. The lawmakers highlighted similarities between the AADC standards and recent legislative proposals in the U.S. to update the Children’s Online Privacy Protection Act (“COPPA”), and noted that the changes instituted by the tech companies are “an important step towards making the internet safer for young users.”

The FTC has authority pursuant to Section 5 of the FTC Act to investigate and bring enforcement actions regarding misrepresentations in most organizations’ privacy notices. Section 5 of the FTC Act prohibits companies from engaging in “unfair or deceptive acts or practices in or affecting interstate commerce.” Deceptive practices include those in which a representation, omission, or practice is likely to mislead the consumer. The lawmakers stated that the FTC “thus has a statutory obligation” to ensure companies are complying with their public statements and policies on children’s and teen’s privacy, and encouraged the agency to “use every tool at [its] disposal to vigilantly scrutinize companies’ data practices and ensure that they abide by their public commitments.”