On July 27th, The Progress & Freedom Foundation hosted a Capitol Hill panel discussion entitled “Online Child Safety, Privacy, and Free Speech: An Overview of Challenges in Congress & the States.” The event featured remarks from:

• Parry Aftab, Executive Director, WiredSafety.org
• Todd Haiken, Senior Manager of Policy, Common Sense Media
• Jim Halpert, Partner, DLA Piper
• Berin Szoka, Senior Fellow, The Progress & Freedom Foundation

We’ve just released the transcript of the event, which I have also pasted down below the fold in a Scribd document reader. Also, the audio for this event can be heard by clicking below:

Download mp3

Here is the full event description:

Online child safety, privacy, and free speech remain hotly debated issues at both the federal and state level. Bills introduced in Congress to address cyberbullying concerns propose either educational initiatives or a criminalization approach. Access to objectionable content also remains a concern and a new, government-mandated task force is looking into those issues. Meanwhile, state officials, including many state attorneys general, continue to explore age verification mandates for social networking sites and some have considered building on the federal Children’s Online Privacy Protection Act (COPPA) to expand “parental notification” mandates. The Federal Trade Commission (FTC) has recently announced an expedited review of COPPA to see if it is keeping up with new developments. The FTC is also exploring child safety in virtual worlds. New concerns about “sexting,” or the sending of sexual explicit images over mobile devices, has also raised new concerns led some lawmakers to ponder penalties.

How serious are these concerns? Is legislation or regulation needed to address them? What free speech issues are at stake? Should Congress take the lead or leave it to the States to experiment with different models? These and other issues were discussed by a panel of leading experts in the field of online safety and privacy policy.

Transcript PFF Online Child Safety Privacy Hill Event (7-27-2009) http://d.scribd.com/ScribdViewer.swf?document_id=18756666&access_key=key-1blb7az1ag406howibuk&page=1&version=1&viewMode=

The new Maine law I blogged about on Sunday is much worse than I thought based on my initial reading. If allowed to stand, it would constitute a sweeping age verification mandate introduced through the back door of “child protection.”

The law, which goes into effect in September, would extend the approach of the Children’s Online Privacy Protection Act (COPPA) of 1998 by requiring “verifiable parental consent” before the collection of kids “personal information” about kids, not just those under 13, but also adolescents age 13-17.  Unlike other state-level proposals in New Jersey, Illinois, Georgia and North Carolina, Maine’s “COPPA 2.0” law would also cover health information, but would only govern the collection and use of  data for marketing purposes (while the FTC has interpreted COPPA to cover to essentially any capability for communicating personal information among users).

But the Maine law would go much further than these proposals or COPPA itself by banning transfer or use of such data in anything other than de-identified, aggregate form. Still I took some comfort in the fact that the Maine law, unlike COPPA or these other proposals, lacked the second of COPPA’s two prongs: (i) collection from kids and (ii) collection on sites that are directed at kids. It’s because of the second prong that COPPA applies not only when a site operator knows that it’s collecting information from kids (or merely allowing them to share information with other users), but also when the operator’s site is (like, say, Club Penguin) targeted to kids in terms of its subject matter, branding, interface, etc. Because I initially concluded that the Maine law would apply only to knowing collection, I supposed that it would be less likely to require age verification of all users, as other COPPA 2.0 proposals would—something that would be unlikely to survive a First Amendment challenge based on the harm to online anonymity.

But I was quite wrong. During the PFF Capitol Hill briefing Adam and I held on Monday, Jim Halpert, one of our panelists, noted that the bill imposed “strict liability.” When I re-read the law, two small provisions with enormous consequences jumped out at me.  First, this section:

Unlawful collection. It is unlawful for a person to knowingly collect or receive health-related information or personal information for marketing purposes from a minor without first obtaining verifiable parental consent of that minor’s parent or legal guardian.

The knowledge requirement above pertains to whether the collection is done “knowingly,” not whether the operator “has actual knowledge that it is collecting personal information from a child” (COPPA’s language). It’s possible that the Maine legislature meant to require that operators know that they’re collecting information from kids, not merely that the collection is intentional and not inadvertent, but if so, they either didn’t read COPPA or don’t understand statutory drafting.

But even if operators could be held liable if they had actual knowledge that they were collecting personal or health information without parental consent, the other operative language of the bill has no knowledge requirement at all. Thus, if an operator truly had no idea it was collecting information from a kid—kids commonly lie about their age to gain access to age-restricted sites—the operator would still be strictly liable for transferring or using that data under the other operative provisions of the law:

Unlawful use. A person may not sell, offer for sale or otherwise transfer to another person health-related information or personal information about a minor if that information: A. Was unlawfully collected pursuant to subsection 1; B. Individually identifies the minor; or C. Will be used… for the purpose of marketing a product or service to that minor or promoting any course of action for the minor relating to a product.

Thus, the only way affected site operators ( e.g., anyone who asks for user’s names as part of a profile and also uses personal information in marketing) could protect themselves under the law would be to age verify all users. Thus, the Maine law is, like other COPPA 2.0 proposals, simply an age verification mandate imposed on all adult users of sites with increasingly prevalent social networking functionality dressed up as a child protection measure. Again, unlike other COPPA 2.0 proposals, the Maine law would not apply to all sites that collect personal information for marketing purposes, but for those that do, it would have the same consequence as other COPPA 2.0 proposals.  As we argue in our paper (p.24), COPPA 2.0 proposals in general are very likely to be struck down on the same grounds as the Child Online Protection Act (COPA), COPPA’s evil twin sister, which would have required age verification for all content deemed “harmful to minors” and which the courts have struck down as blatantly unconstitutional.

Although one might argue that the Maine law does less harm to speech because it applies only to sites that collect and use/transfer data for marketing purposes, while COPPA’s reach is far broader, the Dormant Commerce Clause argument against the law would also probably succeed: the law unduly burdens interstate commerce by imposing Maine’s standards on the rest of the country. Under the law’s strict liability regime, efforts to geo-target users in Maine (themselves a significant burden on website operators) would not protect out-of-state site operators from liability for collecting data from some users in Maine because geo-targeting is necessarily imperfect.

But wait; there’s more! Other COPPA 2.0 proposals would have this consequence because they would apply either to all social networking sites with a certain functionality (Illinois) or to collection of information through sites “directed at” adolescents (New Jersey), which could apply to sites used by large numbers of adults. But for most sites, such laws would only apply where the operator had “actual knowledge” that the user was a kid, thus recognizing (for those sites) that perfect age verification is impossible and that some kids will inevitably circumvent any age verification system imposed. By contrast, the Maine law would hold sites liable for “predatory marketing” for every collection, use, or transfer of a kid’s personal information whether or not the operator knew (or even had reason to know) that they were collecting information from kids at a rate of $10-20k for the first offense and $20k+ (with no upper bound at all) for each subsequent offense. Since offense here could mean each individual act of collection, and since large social networking websites have tens of millions of users, operators might theoretically be subject to fines in the hundreds of billions of dollars!

If this law survives constitutional challenge, I’ll eat the HTML in which this post is written! More likely, the legislature will back down at the first whiff of a legal challenge and go back to finding other, less obviously unconstitutional ways to impress their constituents with how much they care about “Protecting the Children” (or how little they care about free speech or know about how the Internet works).

Maine has just enacted a law severely restricting marketing to kids: the Act To Prevent Predatory Marketing Practices against Minors, summarized by Covington & Burling. Adam and I released a major paper in June about such laws: COPPA 2.0: The New Battle over Privacy, Age Verification, Online Safety & Free Speech. Maine is following the lead of several other states that have tried to expand the Children’s Online Privacy Protection Act (COPPA) of 1998 to cover nost just kids under 13 but adolescents as well and potentially all social networking sites. We discussed at length the problems such laws create, particularly the possibility that large numbers of adults would, for the first time, be subject to age verification mandates before accessing (or participating in) the growing range of sites with social networking capabilities.  This, in turn, would significantly “chill” free speech online by undermining anonymity.

Like COPPA 2.0 proposals in New Jersey (simply extending COPPA to cover adolescents) and Illinois (applying COPPA to most social networking sites), the Maine law tries to build on COPPA’s “verifiable parental consent” requirement for the 13-17 audience as well as those under 13.

On the one hand, the Maine law goes much further than these other COPPA 2.0 proposals. While the original bill was limited to the Internet and wireless communications, the final bill’s scope applies to all communications.  The bill also covers “health-related” information (HRI) as well as “personal information” (PI). On the other hand, the Maine law is thus somewhat narrower than other COPPA 2.0 proposals and COPPA itself in that it applies only to “marketing or advertising products, goods or services.” While COPPA is commonly misunderstood to cover only marketing, it actually covers essentially any “collection” (broadly defined) of personal information from kids for any purpose—including merely giving kids access to communications functionality that might let them share personal information with other users (even if the site itself is not “collecting” that information in the commonly understood sense).

Verifiable parental consent is required for collection of HRI or PI (§ 9552(1)). So far, the Maine law is clearly trying to stick to the basic COPPA model while expanding its application to adolescents, health information and the offline world. (Indeed, the law concludes by authorizing the state AG to bring enforcement actions for violations of COPPA, as COPPA itself allows.) But the Maine law goes much further by banning:

• The transfer of HRI/PI to third parties if it “individually identifies the minor” (§ 9552(2)); and
• The use of HRI/PI “for the purpose of marketing a product or service to that minor or promoting any course of action for the minor relating to a product” (§ 9553).

It’s unclear what either prohibition will mean in practice. Obviously, if the law imposed a complete ban on the use of HRI/PI, there would be no point to obtaining verifiable parental consent in the first place! Thus, the law seems to contemplate that the prohibition on transferring individually identifying information would leave data-collectors free to transfer de-identified data once they’ve obtained verifiable parental consent for the initial collection. I’m no marketing expert but I imagine that Maine legislators were trying to ban the sale of lists that identify individual kids, while allowing the use of de-identified data for, say, analyzing patterns of interests among kids.

It’s less clear what the use-prohibition (§ 9553) actually means. Would it allow kids-oriented marketing based on aggregated de-identified information? If so, what would that actually mean in the real world? Would that be a distinction without a difference by effectively shutting down legitimate marketing most people would find unobjectionable, harmless, or even very helpful? If the law wouldn’t even allow such use of aggregate data, why, again, would any company ever bother obtaining parental consent?

Indeed, the Association of National Advertisers has interpreted this provision as amounting to an outright ban, regardless of parental permission, and points out that the bill:

would seemingly cut off “minors”‘… from being marketed to about colleges and universities, testing services such as the SAT and ACT, test prep services, class rings, among many other potential categories.

ANA vows to “have the law abrogated or modified so that it will not continue to place such extraordinarily broad restrictions on marketers, when the legislature reconvenes” in January—even though the law goes into effect in mid-September. They could challenge the law on a number of grounds in the courts.

While the First Amendment analysis of commercial free speech rights doubtless be complicated, a simpler argument could be brought on Dormant Commerce Clause grounds: Under the Supreme Court’s 1970 decision in  Pike v. Bruce Church, if “the burden imposed . . . is clearly excessive in relation to the putative local benefit, and if the local interest can be promoted by other regulations that have a lesser impact on interstate activities,” the court may strike down a state law that burdens interstate commerce. Indeed, the courts have struck down a number of Internet-related state laws on such grounds.

Insofar as Maine’s law affects online communications, it could be struck down on Dormant Commerce Clause grounds by forcing out-of-state websites to treat users in Maine differently—or to treat all users as if they were in Maine. To some extent, this will depend on how the statute is actually construed. COPPA applies both to knowing collection and to collection through child-oriented sites like Club Penguin (because the operator should know that they are collecting information from a child), but the Maine law applies only to knowing collection. If the statute is narrowly construed, this would mean that only websites that ask user for their age (say, in setting up a social networking profile) would generally be affected. A broader reading might affect websites that are oriented towards, or simply popular among, minors, in which case sites would essentially be forced to age verify all users (as with other COPPA 2.0 proposals). While this seems unlikely given the meaning generally attached to the word “knowing” in American law, even the narrow reading would affect many social networking sites.

The other major unanswered question lies in how broadly the term “individually identifiable information” would be construed. Like COPPA, the Maine law covers all such information, but rather than define this term exhaustively, the laws simply provide a few more specific categories of examples. Maine’s list differs from COPPA’s in that it does not include e-mail addresses, telephone numbers, screen names, or other contact information. But the list does include names, and this is enough to implicate profile-basedsocial networks like Facebook. If construed more broadly, the Maine law could affect other website operators.

In any event, if websites have to try to accomodate Maine’s law, they might have to track user location to ensure that they comply with Maine law.  As we noted in our paper:

If a site relied only on location information provided by the user, adolescents would quickly learn to lie about what state they live in just as children have learned to lie about how old they are to avoid triggering COPPA’s “actual knowledge” requirement.  Alternatively, websites could attempt to determine a user’s location automatically based on their IP address, but such “IP geocoding” is not always accurate and can be subverted by use of a proxy.

Finally, in case you were wondering where this bill came from, here’s the purpose statement for the original bill:

This bill addresses the current practices of persons using the Internet and other wireless communications devices, with or without promotional incentives, to acquire health-related information about minors and then using that information unscrupulously. Under this bill, it is unlawful to solicit or collect health-related information about a minor who is not emancipated without the express written consent of the minor’s parent or guardian, to transfer any health-related information that identifies a minor or to use any of that information to market a product or service to a minor regardless of whether or not the information was lawfully obtained. Unlawful marketing includes promoting a course of action relating to a product.

If a challenge is brought in court, the state will have to be a lot more specific about defining the harm at issue than merely asserting that information is being collected and might be unsed “unscrupulously.” As the Supreme Court declared in the 1993 case of Edenfield v. Fane, the government’s burden in justifying a restrictions on even commercial speech (which is accorded less protection than non-commercial speech):

is not satisfied by mere speculation or conjecture; rather a governmental body seeking to sustain a restriction on commercial speech must demonstrate that the harms it recites are real and that its restriction will in fact alleviate them to a material degree.

In short, this new law raises many legal and practical questions. I’ll be watching closely to see how any effort have the law amended or challenged in court plays out.  I suspect we’ll see more states following Maine’s lead if this law stands in its current form.

The painful issue of cyberbullying has recently taken center stage in the ongoing debate about online child safety. Last week I wrote about Lori Drew’s acquittal on charges related to Megan Meier’s tragic suicide, suggesting that the judge in the case was right to overturn her conviction on a very expansive reading of the federal anti-hacking statute. While I think that decision was necessary on legal grounds, it’s sure to add “fuel to the fire” of calls for “action” in Congress.  Thus, I emphasized that observers of the case need to separate their understandable outrage from the from the questions of (1) whether that statute was properly applied and (2) how the law should treat such cases in the future.

On the second question, Adam and I recently released a major entitled, “Cyberbullying Legislation: Why Education is Preferable to Regulation.”  We distinguish among:

1. Cyberbullying: kid-on-kid abuse online
2. Cyberharassment generally: people of all ages using the Internet to harass each other
3. Adult-on-kid cyberharassment: For example, Lori Drew’s alleged (but still unclear) role in the Megan Meier case

In a nutshell, we argue that education is the better approach to cyberbullying (Problem #1)—an approach taken by a bill introduced in the Senate by Sen. Robert Menendez (D-NJ) and in the House by Rep. Debbie Wasserman Schultz (D-FL) .  We go on to argue that, while it would be difficult to create criminal sanctions for cyberharassment generally (Problem #2) without infringing free speech and due process rights, it might be possible to craft laws narrowly tailored to cyberharassment of kids by adults (Problem #3).

By contrast, Rep. Linda Sánchez has proposed the “Megan Meier Cyberbullying Prevention Act, which by its title purports to deal with that problem (#3) but would actually create a sweeping Federal felony for all cyberharassment (#2). We noted the potential Commerce Clause problems with states trying to regulate Internet speech, and emphasized education as a superior approach at both the federal and state level that avoids constitutional problems, but suggested that, if Congress does ultimately conclude a criminal law is needed for Problem #3, it would well to do look to how the states craft cyberharassment laws before creating any federal penalty.

Just about the time we finished our paper, Tennessee enacted a new law (PDF) that makes it a misdemeanor (up to 1 year in prison and a $2,500 fine) for making threats made online (cyberstalking) as well as certain instances of cyberharassment, defined as communications:

1. Made with “the malicious intent to frighten, intimidate or cause emotional distress”;
2. Made in a “manner the defendant knows, or reasonably should know, would frighten, intimidate or cause emotional distress to a similarly situated person of reasonable sensibilities; and
3. That actually result in making that person “frightened, intimidated or emotionally distressed.”

Prong #1 is essentially the same as the Sánchez bill (with the addition of the word “malicious”), while Prongs #2 and 3 somewhat increase the evidentiary burden faced by any prosecution under the law. So the bill suffers from many of the same problems that the Sánchez bill suffers from, which we discuss in our paper—most importantly, the bill would chill protected online speech because it is unclear when it would apply, and some online speakers would fear prosecution under the bill.

But what’s really disappointing here is that the original Tennessee bill at least recognized the critical importance of drawing distinctions by age.  It would have applied to specifically to harassing communications “with another person who is, or purports to be, less than 18 years of age” or to communications that cause “another person to be frightened, intimidated, or emotionally distressed, provided that the person’s response is one of a person of average sensibilities considering the age of the person.” While neither approach is quite what we recommend in our paper—if we’re going to criminalize anything, it should be adult-on-kid harassment—the original legislation was certainly better to what finally passed, which would likely fail to pass constitutional muster.

In a related context, Adam and I recently released another major paper detailing the serious consequences for online free speech of well-intentioned efforts to expand COPPA’s privacy protections for kids under 13 to cover all adolescents. There as here, while children under a certain age might be uniquely vulnerable and therefore require special protection (such as special penalties for cyberharassment by adults), we can’t treat everyone like small children without severely compromising freedom of expression online and the future vitality of the Internet itself. Again, this is why education is generally a better approach than criminalization.

The Gawker offers a fascinating discussion of the legal right to anonymity:

“There is clearly a moral case that some people should be able to join the public debate and retain their anonymity,” Tench told Gawker. “And I think this will have a chilling effect. Blogs like this can only exist anonymously, and I imagine that anyone who wanted to set one up is thinking about this case.” As well they should. But the notion that anonymous publishers have a right, in perpetuity, to keep their identities a secret—or that people who learn their identities are honor-bound not to reveal them—is nonsense.

Amen! One can resist, fiercely, government efforts to reduce online anonymity through age verification or identity authentication mandates, as Adam Thierer have argued most recently in our work about efforts to expand COPPA to cover adolescents (“COPPA 2.0,” which would indirectly mandate age verification for large numbers of adults for the first time).  One might even argue that there are moral reasons to resist the urge to out pseudonymous/anonymous bloggers (just as one might avoid outing closeted gays out of respect for their privacy).   But one need not accept the pernicious idea that the government should punish the outing of peusodonymous/anonymous writers, which is simply a restraint on legitimate free speech.

This exchange, cited by the Gawker article, is particularly interesting, and demonstrates how one can distinguish the question of whether outing is “right” or “appropriate” from the question of whether it should be punished by law:

When the National Review‘s Ed Whelan revealed Publius, who writes for Obsidian Wings, to be a professor of law at the South Texas College of Law named John F. Blevins earlier this month, the palpable online outrage forced Whelan to apologize.

As Berin mentioned last week, we have a new paper out on proposals to expand the Children’s Online Privacy Protection Act (COPPA) of 1998.   We generically refer to those COPPA-expansion efforts as “COPPA 2.0.” Hence, the title of our paper: “COPPA 2.0: The New Battle over Privacy, Age Verification, Online Safety & Free Speech.”  To recap what Berin already noted, in the name of improving online child safety, some legislators and state attorneys general (AGs) are advocating the expansion of COPPA’s “verifiable parental consent” model of age verification before certain sites or services may collect, or enable the sharing of, personal information for children.

Unlike “COPPA 1.0,” however, which only applied to children under the age of 13, “COPPA 2.0” would apply to all minors up to age 17.  Moreover, the range of sites covered by the new law would generally be expanded to include just about any site or service with social networking functionality.

Since Berin has already summarized our general concerns with efforts to expand COPPA’s “verifiable parental consent” online age verification system to cover more online users and sites, I thought I would focus here on what I believe will be the most controversial (and important) part of our paper — our discussion about how COPPA 2.0 affects the speech rights of both adults and adolescents.

Remember COPA?

To understand why COPPA expansion will raise serious First Amendment issues, we first need to step back and recall the legal battle over the Children’s Online Protection Act (COPA), another 1998 law sometimes confused with COPPA.  Both COPPA and COPA rest on a stratification of users by age, but the approach of the two laws is very different: While COPPA requires age verification if content is “directed at” minors under age 13, COPA would have required that all website operators restrict access to material deemed “harmful to minors” by minors under the age of 17 and therefore requires age verification of all users who attempt to access such content (in order to identify minors). COPPA is focused on certain kinds of potentially harmful contacts while COPA is focused on potentially harmful content.

But by expanding the age range of COPPA to include adolescents, COPPA 2.0 proposals essentially converge with COPA, reaching the same practical consequence: age verification mandates for large numbers of adults as users (not as parents). Only the scope of sites covered by the laws is different: under COPA, sites deemed “harmful to minors,” and, under COPPA 2.0, adolescent-oriented or certain social networking sites. Thus, to the extent that COPPA 2.0 proposals require age verification of adults, they would be subject to constitutional attacks similar to those against COPA.  But COPPA 2.0 proposals would also burden the rights of adults to communicate with adolescents and the free speech rights of adolescents.

Finally, the fact that COPPA (like COPA) applies only to commercial sites would do little to protect it from constitutional attack, because in a world of user-generated content, the commercial nature of a site has little to do with the commercial/non-commercial nature of the speech carried on it. For example, obviously commercial sites like MySpace and Facebook serve as platforms for a wide variety of not-for-profit and political communications.

How COPPA 2.0 Would Impact the Free Speech Rights of Adults

After a decade-long court battle over the constitutionality of COPA, the U.S. Supreme Court in January 2009 rejected the government’s latest request to revive the law, meaning it is likely dead. Three of the key reasons the courts struck down COPA would also apply to COPPA 2.0 proposals.

(1) First, like COPA, COPPA  2.0 would raise burden the speech rights of adults to access information subject to age verification requirements, both by making speech more difficult and by stigmatizing it.  In 2003, the Third Circuit noted that age verification requirements “will likely deter many adults from accessing restricted content, because many Web users are simply unwilling to provide identification information in order to gain access to content, especially where the information they wish to access is sensitive or controversial.” In 2008, in striking down COPA for the third and final time, the Third Circuit approvingly quoted the district court, which had noted that part of the reason age verification requirements deterred users from accessing restricted content was “because Internet users are concerned about security on the Internet and because Internet users are afraid of fraud and identity theft on the Internet.” The district court had held that: “Requiring users to go through an age verification process would lead to a distinct loss of personal privacy” by threatening their anonymity.

By imposing broad age verification requirements, COPPA 2.0 would restrict the rights of adults to send and receive information anonymously just as COPA did. If anything, the speech burdened by COPPA 2.0 deserves more protection, not less, than the speech burdened by COPA: Where COPA merely burdened access to content deemed “harmful to minors” (viz., pornography), COPPA 2.0 would burden access to material by adults as well as minors not because that material is harmful or obscene but merely because it is “directed at” minors! Thus, the content covered by COPPA 2.0 proposals could include not merely pornography, but communications about political nature, which deserved the highest degree of First Amendment protection.

(2) Second, like COPA, COPPA expansion threatens the speech rights of website operators. The necessary corollary of blocking adults from accessing certain content anonymously — and thereby deterring some users from accessing that content — is that COPPA 2.0, like COPA, would necessarily reduce the audience size of websites subject to age verification mandates. Furthermore, such mandates would encourage websites to self-censor themselves to avoid offering content they fear could be considered “directed at” adolescents because doing so might subject them to an age verification mandate — or to legal liability if they fail to implement age verification. The substantial cost of age verification could significantly impact, if not make impossible, the business models of many personal information-collecting (PI) sites, which generally do not charge for content and rely instead on advertising revenues. The Third Circuit cited all of these burdens on the free speech rights of website operators in striking down COPA.

(3) Third, less restrictive alternatives are available to COPPA 2.0, just as they were for COPA.

The Third Circuit drew on the Supreme Court’s 2004 decision striking down COPA on the grounds that “blocking and filtering software is an alternative that is less restrictive than COPA, and, in addition, likely more effective as a means of restricting children’s access to materials harmful to them.” Similarly, parental control software already empowers parents to restrict their kids’ access to PI-collecting sites. (It’s particularly easy for parents to restrict access to the leading social networking sites that seem to be driving so much of the push for COPPA 2.0, so that their kids.)

Thus, the free speech rights burdened COPPA 2.0 proposals are at least as important as those burdened by COPA, and blocking software already empowers parents to restrict their kids’ access to PI-collecting sites, just as it allows parents to restrict access to pornography. Of course, if COPPA 2.0 laws were actually enacted and subject to legal challenge, the outcome of the case would depend largely on the level of constitutional scrutiny involved. COPPA 2.0 advocates might argue that, whatever the rights at stake, a lower level of constitutional scrutiny should apply because COPPA 2.0 does not target a special category of content. If true, this could mean that, although age verification mandates to restrict access to “harmful” material are unconstitutional, far more sweeping mandates restricting access to non-harmful information could be constitutional. Such inconsistency is indeed a perverse consequence of the fact that our First Amendment jurisprudence focuses not on the rights at stake, but on whether a regulation is “content-neutral” in deciding what level of scrutiny to apply—which, in turn, often determines the outcome of the case. But in this case, COPPA 2.0 proposals likely would be subject to strict scrutiny to the extent that they are, like COPA, focused on a certain category of content: that “directed at” adolescents (rather than “harmful to minors”).

Legislators who attempt to escape strict scrutiny by defining the scope of their bill not by its targeted audience but by reference to specific functional capabilities (in the definition of “social networking site”) will likely find that a court will see through such window-dressing: If they recognize that such bills are nonetheless aimed at a certain category of adolescent-oriented content, they will apply strict scrutiny anyway. But even under intermediate scrutiny, COPPA 2.0 proposals would be subject to serious attack.

Minors Have Speech Rights, Too!

In addition, in COPPA 2.0 approaches, the government would restrict the ability of adolescents to access content, not because it could be harmful to them or because it is obscene, but merely because it is “directed to” them. While the First Amendment rights of minors may not be on par with those of adults, adolescents do have the right to access certain types of information and express themselves in certain ways. The Supreme Court has held (in Planned Parenthood of Cent. Mo. v. Danforth) that “constitutional rights do not mature and come into being magically only when one attains the state-defined age of majority.” It remains unclear how an expanded COPPA model might interfere with the First Amendment rights of adolescents, but it is clear that privacy and speech rights would come into conflict under COPPA 2.0, as they do in other contexts.

For example, how might the parental-consent based model limit the ability of adolescents to obtain information about “safer sex” or how to deal with trauma, depression, family abuse, or addiction. Would an abusive father authorize a teen to visit a website about how to report child abuse? Would a parent of an adolescent struggling with their sexual identity let their kid participate in a self-help social networking page for gay and lesbian youth? What rights are at play here and how do we reconcile them?

Maintaining the ability of kids to participate online interactions goes beyond content that most people would recognize as “serious”—from the perspective of both First Amendment values and the education of children. As a recent MacArthur Foundation study of the online youth Internet use concluded:

Contrary to adult perceptions, while hanging out online, youth are picking up basic social and technological skills they need to fully participate in contemporary society. Erecting barriers to participation deprives teens of access to these forms of learning. Participation in the digital age means more than being able to access “serious” online information and culture.

It was at least in part in recognition of such difficult First Amendment questions that Congress removed the requirement in the initial legislative draft of COPPA that would have required PI-based sites to “use reasonable efforts to provide the parents with notice and an opportunity to prevent or curtail the collection or use of personal information collected from children over the age of 12 and under the age of 17.”

Even if parents have an absolute right to block their adolescents’ access to such data, they can already exercise that right by applying strict controls on the computers in their home. COPPA 2.0 proposals go well beyond recognizing this right by setting the default to “parental consent required” for adolescents to access a wide range of content—meaning that parents must “opt-in” on behalf of their children before their children can participate in PI-collecting sites. This, in turn, burdens the ability of adolescents to communicate, because their parents might censor (rightly or wrongly) certain information, or simply fail to understand the technologies involved or to be actively engaged. But whatever the free speech rights of adolescents, if anyone should be interfering with those rights, it should be their parents — not the government.

Some parents may object that, however effective parental control software may be in the home, it does not allow parents to control what their kids’ access outside the home. This argument is understandable on some level, but in the end, it amounts to a demand that roadblocks be put up everywhere for the sake of particularly sensitive parents at the expense of everyone else in society, including potentially huge numbers of adult users — and of online anonymity in general.

But Illinois’s COPPA 2.0 proposal goes even further, not merely expanding COPPA to cover a particular variety of social networking sites, but requiring that such sites “allow the parent or guardian of the minor unrestricted access to the profile webpage of the minor at all times.” Congress considered just such a parental access mandate in the initial draft of COPPA legislation back in 1998, but ultimately removed it from the final version of the legislation, apparently because even some of COPPA’s supporters worried, given the bill’s initial application to the 13-16 age bracket, that “The establishment of a parental right to access all personal information about a teenager may intrude on older minors’ privacy, rather than protect.”

What about Communication between Adolescents & Adults?

Finally, COPPA 2.0 could infringe on the free speech rights of adults to communicate with adolescents online by driving PI-collecting sites to segregate users by age or to attempt to block access by adolescents. The vast majority of adult-minor interactions online are not of a harassing or predatory nature—indeed, they generally involve adults looking to help or assist minors in various ways. As the MacArthur Foundation study cited above concluded:

In contexts of peer-based learning, adults … have an important role to play, though it is not the conventionally authoritative one. In friendship-driven practices, direct adult participation is often unwelcome, but in interest-driven groups we found a much stronger role for more experiences participants to play. Unlike instructors in formal educational settings, however, these adults are passionate hobbyists and creators, and youth see them as experienced peers, not as people who have authority over them. These adults exert tremendous influence in setting communal norms and what educators might call “learning goals,” though they do not have direct authority over newcomers.

A substantial portion of those interactions involve parents talking to their own kids, older and younger siblings communicating with one another, teachers and mentors talking to their students, or even co-workers of different ages communicating. Even when adult-minor communications involve complete strangers, there is typically a socially-beneficial purpose. Think of two people — one an adult and one a minor — debating politics on a discussion board, or creating a Wikipedia entry together. What about a presidential campaign website that involves millions of volunteers of all ages communicating and collaborating to a common purpose? There are countless other examples. How would such interactions be affected by COPPA 2.0? Restricting such interactions would raise profound First Amendment concerns about freedom of speech as well as of association.

In any First Amendment analysis, a court must consider not only the free speech rights at stake and the availability of less restrictive alternatives to regulation, but the governmental interest being advanced. Again, neither COPPA nor the COPPA 2.0 proposals discussed herein (e.g., the New Jersey and Illinois proposals) requires exclusion of older users from a website, nor directly governs the sharing of personal information among users (where that sharing does not also constitute collection by the site itself). But separation of adolescents from adults is likely to be an indirect effect of COPPA 2.0 requirements—as COPPA 2.0 advocates probably realize—because, once PI-collecting sites are required to age-verify users, they will face reputational, political and potentially legal pressure to make interactions between adolescents and children more difficult in the name of “child safety.” More subtly, if PI-collecting site operators have an incentive to avoid being considered “directed at” adolescents, they will also have an incentive to discourage adolescent participation on their site—which achieves a similar result.

Here, one must further ask if attempting to quarantine children from adults (however indirectly) actually advances, on net, a strong governmental interest in child protection. Such a quarantine is unlikely to stop adults with truly nefarious intentions from communicating with minors, as systems designed to exclude participation by adults in a “kids-only” or “adolescents-only” area can be easily circumvented. Given the lack of strong identity records for minors, it’s much easier for an adult to pretend to be a minor than vice versa. The effect of age stratification on truly bad actors is likely to be marginal at best—or harmful at worst: Building walls around adolescents through age-verification might actually make it easier for predators to target teens, since a predator who gains access to a supposedly teen-only site will be less likely to be exposed as a predator by targeting an adult they think is a teen. So for the sake of marginal (if any) gains in child protection, would we not be excluding beneficial interaction between adults and minors?

To hear some of the advocates of COPPA 2.0 talk about how teens currently behave online, one might think that online environments in which adolescents were left to their own devices—imagine a “Teen MySpace” for the 13-17 crowd, walled off from the rest of MySpace—would be far worse, perhaps an online version of Lord of the Flies. These concerns are clearly exaggerated: The critics frequently complain about “the way kids talk to each other these days” while looking at their own past adolescent banter with rose-colored lenses. What is clear is that adolescents (and young adults) behave better in online environments where adults are present, too. Perhaps the best demonstration of this fact has been the uproar from adolescents and young adults that has accompanied Facebook’s explosive growth in popularity among older users in recent months. Many kids hate the idea of adults joining Facebook precisely because the presence of adults encourages kids to “self-regulate” by exercising better judgment and following better netiquette.

Anne Collier, founder and executive director of the child safety advocacy organization Net Family News, Inc. and editor of NetFamilyNews.org and ConnectSafely.org, suggests that the push for “segregation” by age (e.g., creating a teen-only version of Second Life) for safety’s sake is “losing steam” because:

it’s a response to the predator panic teens and parents have been subjected to in U.S. society, not to the realities of youth on the social Web. What nearly a decade of peer-reviewed academic research shows is that peer-to-peer behavior is the online risk that affects many more youth, the vast majority of online kids who are not already at-risk youth offline. Segregating teens from adults online doesn’t address harassment, defamation, imposter profiles, cyberbullying, etc. It may help keep online predators away from kids (even though online predation, or abuse resulting from online communication, constitutes only 1% of overall child sexual exploitation…), which is a great outcome, but it’s not enough unless all that parents are worried about is predators.

Collier discusses the particularly acute problem of “actual or perceived sexual orientation and gender expression,” which the Salt Lake Tribune has noted are “two of the top three reasons secondary school students said their peers were most often bullied at school.” This kind of harassment recently attracted widespread public attention after two 11-year-old boys committed suicide after experiencing anti-gay harassment and bullying at school. Nationwide, “Lesbian, gay, bisexual, transgender and questioning youth are up to four times more likely to attempt suicide than their heterosexual peers.” This child safety risk is painfully real, with anti-gay harassment being only its most obvious form. But “segregating” teens from adults seems likely to aggravate this problem by removing adults from the mix as a potential source of discipline.

Of course, adults play a critical role in disciplining interaction among the 0-12 age bracket, but not as direct participants in on-site interaction. Again, how many adults actually want to use Club Penguin? Instead, parents can supervise what their kids do online through parental control software. Parents could, of course, use that same software to monitor what their adolescent kids do, too. But as kids get older, most parents realize that the training wheels have to come off at some point. Few parents will want to spy on their 17-year old until the day before the kid starts college (or enlists in the military or gets married). But most parents probably would prefer that, if their kids are interacting in an online environment, they think twice about what they do and say online. It is by no means clear that restricting online interaction between teens and adults will serve that end.

Adam Thierer & I have just released a detailed examination (PDF) of brewing efforts to expand the Children’s Online Privacy Protection Act of 1998 to cover adolescents and potentially all social networking sites—an approach we call “COPPA 2.0.”

As Adam explained on Larry Magid’s CNET podcast, COPPA mandates certain online privacy protections for children under 13, most importantly that websites obtain the “verifiable consent” of a child’s parent before collecting personal information about that child or giving that child access to interactive functionality that might allow the child to share their personal information with others. The law was intended primarily to “enhance parental involvement in a child’s online activities” as a means of protecting the online privacy and safety of children.

Yet advocates of expanding COPPA—or “COPPA 2.0″—see COPPA’s verifiable parental consent framework as a means for imposing broad regulatory mandates in the name of online child safety and concerns about social networking, cyber-harassment, etc. Two COPPA 2.0 bills are currently pending in New Jersey and Illinois. The accelerated review of COPPA to be conducted by the FTC next year (five years ahead of schedule) is likely to bring to Washington serious talk of expanding COPPA—even though Congress clearly rejected covering adolescents age 13-16 when COPPA was first proposed back in 1998.

We’ll discuss some of the key points of our paper in a series of blog posts, but here are the top nine reasons for rejecting COPPA 2.0, in that such an approach would:

• Burden the free speech rights of adults by imposing age verification mandates on many sites used by adults, thus restricting anonymous speech and essentially converging—in terms of practical consequences—with the unconstitutional Children’s Online Protection Act (COPA), another 1998 law sometimes confused with COPPA;
• Burden the free speech rights of adolescents to speak freely on—or gather information from—legal and socially beneficial websites;
• Hamper routine and socially beneficial communication between adolescents and adults;
• Reduce, rather than enhance, the privacy of adolescents, parents and other adults because of the massive volume of personal information that would have to be collected about users for authentication purposes (likely including credit card data);

• Would likely be the subject of massive fraud or evasion since it is not always possible to definitively verify the parent-child relationship, or because the system could be “gamed” in other ways by determined adolescents;
• Do nothing to prevent offshore sites and services from operating outside these rules;
• Present major practical challenges for law enforcement officials in the face of such evasion by both domestic users and offshore sites;
• Could destroy opportunities for new or smaller website operators to break into the market and offer competing services and innovations, thus contributing to consolidation of online content and services by erecting barriers to entry; and
• Violate the Commerce Clause of the U.S. Constitution, since Internet activity clearly represents interstate commerce that states have no authority to regulate.