CDD files Appeal to make public NIST grant to Privo
The Children's Online Privacy Protection Act (COPPA), a federal law my NGO led the campaign for back in the mid-1990's, was designed to ensure that parents (or the responsible adult) be able to make meaningful decisions about commercial data collected from a child (thru age 12). It's based on a concept requiring serious (read honest) and full disclosure of data collection and use practices, with prior affirmative consent (informed opt-in) before any collection occurs. Given the powerful array (link is external)of digital marketing techniques focused on collecting our information, and the need to ensure that parents have federal safeguards for the children's privacy, COPPA means that online marketing companies and their partners need to act in a highly responsbile, transparent and truly privacy appropriate manner.
We are concerned that some in the online marketing industry want to create an easy "one-stop shopping" process that encourages parents to approve data collection for their child. Kids are a very lucrative market, spending (link is external)and influencing many billions a year. Some companies view COPPA as an obstacle to their plans to generate profits by online marketing to kids. Despite claims of respecting privacy (and which can also be viewed by examining the commercial market targeting adolescents), the default most marketers have adopted is full non-stop personalized data collection and real-time targeting. But COPPA makes such practices, commonplace in the digital ad industry, much harder to do. In part, it's because under the law they have to actually explain first what they intend to do and get permission. That approach is anathema to most in the online marketing business.
When we learned that the National Institute for Standards and Technology (NIST, a division of the Department of Commerce) gave a federal $1.6 million grant (link is external)to Privo (link is external)designed to create a "parent consent at Internet scale" system for COPPA we were concerned. Privo's partners in its grant include "one of the world's largest toy companies" as well as Verizon (link is external). CDD, through our attorneys at the Institute for Public Representation, Georgetown Law Center, filed a FOIA request. The public needs to know how Privo's (link is external) system will operate; whether it's really designed to help parents make meaningful decisions; what role does the major toy company and Verizon (which has expanded (link is external) its own data targeting apparatus) play.
NIST redacted nearly all of the Privo related documents, failing to provide the public the information and accountability necessary (especially when it's about the privacy of children). Today, we filed an Appeal and intend to pursue our legal options. (See attachment below.) More details coming.