WEBVTT - Someone Think of the Children 0:00:04.400 --> 0:00:07.800 Welcome to Tech Stuff, a production from I Heart Radio. 0:00:12.119 --> 0:00:14.840 Hey there, and welcome to tech Stuff. I'm your host, 0:00:14.960 --> 0:00:18.120 Jonathan Strickland. I'm an executive producer with I Heart Radio 0:00:18.239 --> 0:00:22.040 and I love all things tech. And on Monday's episode, 0:00:22.079 --> 0:00:26.640 I looked at the topic of privacy or privacy and 0:00:26.720 --> 0:00:31.600 the Internet and how companies collect and use private information. Essentially, 0:00:31.920 --> 0:00:34.920 the point of that episode was to show how in 0:00:34.960 --> 0:00:40.680 the era of big data, practically everything we do generates 0:00:40.720 --> 0:00:44.400 at least a data point that goes into a constantly 0:00:44.560 --> 0:00:49.159 more detailed depiction of who we are, digitally speaking, and 0:00:49.240 --> 0:00:53.760 that numerous companies are profiting off that information. And sometimes 0:00:53.800 --> 0:00:56.000 it means we as individuals actually see some sort of 0:00:56.040 --> 0:01:00.480 benefit from that, right like targeted personalized experien ins can 0:01:00.520 --> 0:01:03.040 be a benefit, but sometimes it really just means we're 0:01:03.080 --> 0:01:06.880 being exploited in some way. Now, you could say that 0:01:07.000 --> 0:01:10.280 for adults, this is just the price you pay to 0:01:10.360 --> 0:01:14.479 be a modern citizen of our digital world, particularly when 0:01:14.520 --> 0:01:19.200 it involves joining various online platforms and services that include 0:01:19.240 --> 0:01:23.039 statements that explain that the service is going to collect, share, 0:01:23.120 --> 0:01:27.080 and leverage data from users. And you could argue, hey, 0:01:27.200 --> 0:01:29.200 you agreed to do this when you signed up for 0:01:29.240 --> 0:01:33.200 an account, even if you didn't bother reading the fine print. However, 0:01:33.280 --> 0:01:37.040 it is a different matter entirely when it comes to kids. 0:01:37.880 --> 0:01:41.720 Kids don't have the awareness of what it means to 0:01:41.840 --> 0:01:46.679 share information about themselves. They don't understand the potential consequences. 0:01:46.720 --> 0:01:49.200 So it wouldn't be ethical to convince a kid to 0:01:49.240 --> 0:01:53.560 sign any sort of binding agreement without that kid's parent 0:01:53.800 --> 0:01:57.720 or guardian present and consenting to it. And so when 0:01:57.760 --> 0:02:01.280 it comes to the privacy of kids, things take a 0:02:01.320 --> 0:02:04.840 pretty serious turn. In the United States. That includes the 0:02:04.920 --> 0:02:09.160 passing of a law in nine called the Children's Online 0:02:09.240 --> 0:02:14.240 Privacy Protection Act or KAPPA CEO p p A. Today, 0:02:14.360 --> 0:02:18.600 I want to explore what prompted the drafting and passage 0:02:18.720 --> 0:02:21.600 of KAPPA, and some cases in which companies have been 0:02:21.639 --> 0:02:25.799 found guilty of failing to comply with the rules of KAPPA, 0:02:25.919 --> 0:02:29.880 and how that has affected content on the Internet in general. 0:02:30.600 --> 0:02:34.120 Generally speaking, when it comes to technology and the law, 0:02:34.480 --> 0:02:38.760 there is a lot of opportunity for messiness. Technology advances 0:02:38.960 --> 0:02:41.320 at a far faster pace than what we see in 0:02:41.360 --> 0:02:45.280 the legal world. Heck, the folks who draft legislation tend 0:02:45.320 --> 0:02:48.960 to be let's say a bit on the older side, 0:02:49.320 --> 0:02:52.160 which can also mean that they can sometimes be a 0:02:52.200 --> 0:02:55.919 little bit out of touch when it comes to modern technology. 0:02:56.040 --> 0:02:58.320 And we see this all the time with politicians just 0:02:58.440 --> 0:03:03.360 struggling to understand the scope and the effect of technology 0:03:03.400 --> 0:03:07.959 while simultaneously trying to draft legislation that in some way 0:03:08.000 --> 0:03:11.960 intersects with technology. It doesn't always go well, and often 0:03:11.960 --> 0:03:15.640 this means there's a figurative disconnect between the law and 0:03:15.680 --> 0:03:19.399 the tech, and that can lead to unintended consequences. At 0:03:19.400 --> 0:03:23.800 the same time, we can see the clear need for legislation, 0:03:23.840 --> 0:03:26.960 at least in some cases. The fact that there aren't 0:03:27.120 --> 0:03:30.800 hard and fast legal protections for online privacy in general 0:03:31.080 --> 0:03:33.880 has led us to this condition in the United States 0:03:34.120 --> 0:03:39.000 in which our data becomes digital currency. Only it's currency 0:03:39.040 --> 0:03:43.320 that we the generators, the people that are making that data. 0:03:43.880 --> 0:03:47.080 We don't get to profit off of that, at least 0:03:47.080 --> 0:03:51.120 not you know, directly. Other people and companies are making 0:03:51.280 --> 0:03:55.040 billions of dollars off the data that we create, which 0:03:55.320 --> 0:03:59.640 doesn't seem terribly fair, does it That we're not compensated 0:04:00.040 --> 0:04:03.720 for generating all this information. Our compensation tends to be 0:04:03.920 --> 0:04:08.320 the use of a service or platform. Anyway, My point 0:04:08.400 --> 0:04:11.840 is we can have situations in which we need legislation, 0:04:12.440 --> 0:04:15.800 and yet we can also have those situations where the 0:04:15.880 --> 0:04:18.760 laws we get may not measure up to what we 0:04:18.800 --> 0:04:21.400 actually need. So let's take a look at Kappa and 0:04:21.440 --> 0:04:25.440 figure out if it does what it's supposed to do. Now, 0:04:25.440 --> 0:04:27.200 of course, this means we also have to look at 0:04:27.240 --> 0:04:32.200 some history, and a predecessor to Kappa is an industry 0:04:32.360 --> 0:04:37.120 organization called the Children's Advertising Revenue Unit or caru CE 0:04:37.320 --> 0:04:41.560 a are you, that formed in nineteen seventy four out 0:04:41.560 --> 0:04:45.760 of the Better Business Bureau here in the United States. Now, traditionally, 0:04:46.320 --> 0:04:50.120 marketing targeted adults, right, there was adults that heard all 0:04:50.200 --> 0:04:54.160 the different ads, But by the nineteen seventies, television programs 0:04:54.279 --> 0:04:57.839 that were aimed specifically at kids were really becoming a 0:04:57.880 --> 0:05:02.120 regular thing. And if the audience for those shows were kids, well, 0:05:02.160 --> 0:05:05.320 that meant that the ads that were being displayed during 0:05:05.320 --> 0:05:09.040 those shows were also being directed towards kids, and that 0:05:09.080 --> 0:05:12.120 meant marketers had to craft ads that would appeal to 0:05:12.240 --> 0:05:15.280 kids potentially so that those kids would go and then 0:05:15.320 --> 0:05:18.240 convince their parents to buy whatever stuff they were seeing 0:05:18.279 --> 0:05:20.679 on television, whether it was a toy or a serial 0:05:20.920 --> 0:05:25.120 or whatever. But again, this brings up some pretty tough 0:05:25.320 --> 0:05:29.320 ethical questions. How do you market to kids who aren't 0:05:29.360 --> 0:05:33.000 old enough to make decisions for themselves? Rather than risk 0:05:33.240 --> 0:05:37.479 having the government step in and get involved. The television 0:05:37.480 --> 0:05:41.839 and advertising industries saw the wisdom in a self regulating body, 0:05:42.200 --> 0:05:46.440 and CARU created some basic core principles which would also 0:05:46.480 --> 0:05:52.280 become important for Kappa. The guidelines that CARU essentially set 0:05:52.320 --> 0:05:55.359 they say stuff like kids may not be aware that 0:05:55.440 --> 0:05:59.279 they're even being advertised too, and they might have limited 0:05:59.320 --> 0:06:04.679 experience with the persuasive nature of advertising. So therefore, advertisers 0:06:04.680 --> 0:06:08.800 need to show a special responsibility when they are marketing 0:06:08.839 --> 0:06:11.720 towards kids. And as someone who grew up in the 0:06:11.760 --> 0:06:15.240 seventies and eighties, I can tell you that it could 0:06:15.240 --> 0:06:17.960 get pretty tricky to separate the ads from the content 0:06:18.120 --> 0:06:20.960 back in those days, partly because a lot of the 0:06:20.960 --> 0:06:25.159 shows geared towards kids were really nothing more than, you know, 0:06:25.240 --> 0:06:28.800 grandiose commercials for lines of toys and stuff. I'm looking 0:06:28.839 --> 0:06:33.479 at you, Transformers and g I Joe and he Man. 0:06:34.320 --> 0:06:37.800 The guideline stress the advertisers need to be substantive in 0:06:37.839 --> 0:06:41.160 their claims when it comes to ads directed at kids. So, 0:06:41.200 --> 0:06:45.159 in other words, ads should not give kids the idea 0:06:45.200 --> 0:06:47.480 that they'd be able to do stuff with a product 0:06:47.800 --> 0:06:51.320 that just isn't possible, you know, like buying a he 0:06:51.480 --> 0:06:53.960 Man plastic sword, and that if you just say, by 0:06:53.960 --> 0:06:56.440 the power of Gray Skull, I have the power, you 0:06:56.480 --> 0:07:00.400 will somehow magically get a page boy haircut and giant muscles. 0:07:00.440 --> 0:07:03.880 I can tell you from personal experience that's just not 0:07:04.240 --> 0:07:09.160 the case. Other guidelines say that advertisers should not advertise 0:07:09.200 --> 0:07:14.040 products or services that are not appropriate for kids two kids, 0:07:14.080 --> 0:07:17.760 So you shouldn't be getting like ads for car dealerships 0:07:17.760 --> 0:07:20.640 in the middle of your Saturday morning cartoon block or 0:07:20.680 --> 0:07:24.240 something like that, and that adds should include a diverse 0:07:24.320 --> 0:07:28.520 representation within them. They shouldn't all be the same ethnicity. 0:07:28.760 --> 0:07:32.120 And that also adds should reinforce positive social interactions, like 0:07:32.200 --> 0:07:35.520 being honest in such In other words, the idea was, yeah, 0:07:35.800 --> 0:07:38.840 we're gonna allow for advertising to kids, but let's do 0:07:38.920 --> 0:07:41.120 it in a way where at least it seems like 0:07:41.200 --> 0:07:43.960 it's wholesome. Now, I think it's fair to say that 0:07:44.000 --> 0:07:48.239 these guidelines, which would again go on to inform the 0:07:48.360 --> 0:07:52.520 rules for Kappa, weren't the product of necessarily a sincere 0:07:52.680 --> 0:07:57.120 concern for children so much as it was an effort 0:07:57.160 --> 0:08:00.040 to head the government off at the past. And I 0:08:00.080 --> 0:08:03.000 say this as someone who has studied advertising and marketing 0:08:03.000 --> 0:08:05.560 a little bit, and I walked away with a distinct 0:08:05.560 --> 0:08:10.120 impression that ethics are you know, that's mostly something that 0:08:10.200 --> 0:08:15.960 happens to other industries compared to marketing and advertising. Sometimes 0:08:16.160 --> 0:08:19.640 ethics were seen as something of a drawback in that field, 0:08:19.920 --> 0:08:23.120 particularly if you study the advertising of the fifties and 0:08:23.200 --> 0:08:26.520 sixties the stuff. You should know. Guys have done episodes 0:08:26.600 --> 0:08:30.440 on advertising from that era, and those episodes are phenomenal 0:08:30.480 --> 0:08:36.439 and they really detail how sleazy that world could be. 0:08:37.000 --> 0:08:39.880 And while that kind of foolishness might be aimed at 0:08:39.920 --> 0:08:42.760 adults without much of a blink of an eye, the 0:08:42.800 --> 0:08:47.400 story is different when there are kids involved. That being said, 0:08:47.640 --> 0:08:50.800 Cairo takes the issue of advertising to kids in a 0:08:50.840 --> 0:08:54.520 responsible way as a serious thing, because, again, if the 0:08:54.640 --> 0:08:57.680 organization fails in this regard, if the industry starts to 0:08:57.720 --> 0:09:01.800 fall short, the government is going to step in. There 0:09:01.800 --> 0:09:05.840 will be a a strong position from the citizens for 0:09:05.880 --> 0:09:08.280 the government to step in and do something about it. 0:09:08.600 --> 0:09:12.040 And like many industries, the advertising world is not super 0:09:12.160 --> 0:09:16.240 keen on the idea of regulation. But let's move forward. 0:09:16.600 --> 0:09:19.320 So while you might look back on the children's programming 0:09:19.320 --> 0:09:22.880 and advertising from the eighties and into the nineties and say, huh, 0:09:22.960 --> 0:09:26.199 it seems like those guidelines were pretty lucy goosey, and 0:09:26.240 --> 0:09:29.439 that a lot of a lot of programming may not 0:09:29.520 --> 0:09:33.200 have followed it all that closely, the fact was that 0:09:33.440 --> 0:09:35.800 Cairo was in charge of making sure things didn't go 0:09:35.920 --> 0:09:39.400 too far astray in the United States, and then in 0:09:39.440 --> 0:09:43.320 the early nineties, the mainstream public became aware of this 0:09:43.600 --> 0:09:47.800 thing called the Internet. Now, those of you who have 0:09:47.840 --> 0:09:50.480 listened to this show for a long time, or those 0:09:50.480 --> 0:09:53.280 of you who have studied the Internet, know that the 0:09:53.320 --> 0:09:56.880 Internet and its predecessors like our ponnet have actually been 0:09:56.880 --> 0:09:59.600 around for a really long time. But outside of a 0:09:59.640 --> 0:10:03.000 RelA tive ly small population of researchers and students and 0:10:03.040 --> 0:10:07.440 government officials, hardly anyone knew anything about it. And that 0:10:07.600 --> 0:10:10.800 changed with the launch and evolution of the Worldwide Web. 0:10:11.760 --> 0:10:15.720 The Web was a much more user friendly and intuitive 0:10:15.760 --> 0:10:19.000 way to access the Internet. The adoption of the Web 0:10:19.360 --> 0:10:23.280 by the mainstream didn't happen overnight, but without the Web, 0:10:23.320 --> 0:10:25.680 I think it's pretty safe to say that the general 0:10:25.720 --> 0:10:28.840 awareness about the Internet in general h and what you 0:10:28.840 --> 0:10:31.880 could do with it would have lagged behind by several 0:10:32.000 --> 0:10:36.360 years at the least. Anyway, once websites started to really 0:10:36.480 --> 0:10:39.600 be a thing, and once companies began to kind of 0:10:39.640 --> 0:10:43.760 cautiously dip their corporate toe in the web and see 0:10:43.800 --> 0:10:47.240 how they might conduct commerce and further, how they might 0:10:47.320 --> 0:10:51.320 advertise to people online, CARU really began to get a 0:10:51.320 --> 0:10:54.719 bit proactive in the online space. There was a legitimate 0:10:54.760 --> 0:10:58.040 concern that one of the things that makes the web great, 0:10:58.559 --> 0:11:01.959 that being that it's easy to access stuff if you 0:11:02.080 --> 0:11:05.280 just have a browser, uh, internet connection and some basic 0:11:05.320 --> 0:11:08.400 web skills, that also makes the web a potential pitfall 0:11:08.480 --> 0:11:12.920 when it comes to how children access and process information. Moreover, 0:11:13.480 --> 0:11:16.600 as I mentioned in Monday's episode, it didn't take very 0:11:16.640 --> 0:11:18.920 long at all for companies to use the Internet in 0:11:19.040 --> 0:11:23.040 order to start gathering information about users in order to 0:11:23.480 --> 0:11:26.880 advertise to them more effectively, And it wasn't long at 0:11:26.920 --> 0:11:30.800 all before companies began to build out databases of user information. 0:11:31.280 --> 0:11:34.080 And while you might make the argument that a mature adult, 0:11:34.679 --> 0:11:37.000 or you know, at least someone who's of an adult 0:11:37.080 --> 0:11:40.360 age has the wherewithal to sign over their right to 0:11:40.440 --> 0:11:44.160 privacy with an understanding of what that actually means. The 0:11:44.240 --> 0:11:48.120 saint can't be said of kids, and thus CARU focused 0:11:48.160 --> 0:11:51.960 on how various sites and services would gather and use 0:11:52.000 --> 0:11:56.240 information online when it came to the information of children. 0:11:57.400 --> 0:12:01.600 In nine CARU published a new set of guidelines called 0:12:01.960 --> 0:12:05.840 Interactive Electronic Media. This was in an effort to get 0:12:05.880 --> 0:12:08.680 ahead of issues that were starting to pop up thanks 0:12:08.679 --> 0:12:11.720 to the web. The goal was to create new guidelines 0:12:11.800 --> 0:12:14.640 for the online space that would protect the privacy of 0:12:14.679 --> 0:12:17.880 those under the age of thirteen, which was kind of 0:12:17.880 --> 0:12:21.800 an arbitrary age picked it. It reflected the ages that 0:12:21.880 --> 0:12:25.120 CARU was focused on as part of advertising in general, 0:12:25.600 --> 0:12:27.880 and it was easy to see the need for this 0:12:27.960 --> 0:12:32.680 approach because even as early as nineteen there were companies 0:12:32.720 --> 0:12:36.360 that were advertising to kids online and they weren't necessarily 0:12:36.440 --> 0:12:39.080 following the CARU guidelines that had been in place for 0:12:39.240 --> 0:12:43.840 like television advertising. Plus, there was the issue of companies 0:12:43.840 --> 0:12:48.960 collecting information about these young consumers without parental consent. The 0:12:49.040 --> 0:12:51.360 canary in the coal mine for this issue turned out 0:12:51.360 --> 0:12:54.480 to be a website called kids Calm, which, as the 0:12:54.559 --> 0:12:58.839 name implies, was a child focused site. Kids Calm used 0:12:58.880 --> 0:13:03.640 tools like register straation forms, pen Pal programs, and contest 0:13:03.840 --> 0:13:08.120 entries to gather information about their users, that is, kids 0:13:08.240 --> 0:13:10.559 who are visiting the site, and hey, this is a 0:13:10.600 --> 0:13:13.520 good time to remind you that if you happen to 0:13:13.520 --> 0:13:18.160 be entering a sweepstakes or contest online or even offline, 0:13:18.440 --> 0:13:21.080 what you're really doing is you're handing over your information 0:13:21.120 --> 0:13:24.680 to some third party, and you can bet that information 0:13:24.760 --> 0:13:27.920 is going to be used in some way. It may 0:13:28.160 --> 0:13:30.880 be used directly by the entity you hand it to. 0:13:31.200 --> 0:13:33.800 So it may be that, for example, it's a magazine 0:13:33.800 --> 0:13:36.240 publisher and you filled out this information. Well, now the 0:13:36.280 --> 0:13:40.040 magazine publisher is going to market other magazines directly to you. 0:13:40.720 --> 0:13:44.160 Or it might mean that your information gets put into 0:13:44.240 --> 0:13:48.320 a database that other companies can pay to access, or 0:13:48.360 --> 0:13:51.520 it could be a combination of the two. Anyway, kids 0:13:51.559 --> 0:13:54.200 Calm was doing this, but the big problem was that 0:13:54.800 --> 0:13:57.920 a lot of kids Calm users were you know kids. 0:13:58.960 --> 0:14:03.040 The FTC investigated Kids Come after receiving a complaint letter 0:14:03.120 --> 0:14:06.760 about the site from the Center of Media Education. The 0:14:06.840 --> 0:14:10.160 FTC found kids Come in violation of several FTC rules 0:14:10.160 --> 0:14:13.120 with regard to the collection and sharing of data, and 0:14:13.200 --> 0:14:16.000 it had turned out that kids Come was in fact 0:14:16.320 --> 0:14:20.280 sharing a database of user information with third parties. On 0:14:20.320 --> 0:14:23.680 the bright side, the data was an aggregate, so it 0:14:23.800 --> 0:14:28.160 was not formatted to reveal personal information unique to individuals. 0:14:28.520 --> 0:14:31.600 It was more inaggregate. It was all collected so that 0:14:31.640 --> 0:14:35.320 there was no personally identifiable people in there. It could 0:14:35.320 --> 0:14:38.400 have been worse, is what I'm saying. Kids Come agreed 0:14:38.440 --> 0:14:40.960 to change its ways and to conform to the rules, 0:14:41.480 --> 0:14:44.640 and that site stuck around till two thousand nineteen. But 0:14:44.680 --> 0:14:47.520 the case of kids Come laid bare the potential dangers 0:14:47.560 --> 0:14:51.040 of data collection when it comes to young kids. This 0:14:51.080 --> 0:14:53.320 matter was seen as a serious one and it led 0:14:53.360 --> 0:14:56.800 to the Federal Trade Commission or FTC, to draft the 0:14:56.920 --> 0:15:00.920 Children's Online Privacy Protection Act KAPPA, and again that was 0:15:00.960 --> 0:15:06.360 passed into law. In that law used CARUS Interactive Electronic 0:15:06.480 --> 0:15:10.600 Media Guidelines as a foundation. The law applies to websites 0:15:10.640 --> 0:15:14.240 and service operators that either directly target children for the 0:15:14.280 --> 0:15:18.560 purposes to collect, use, or disclose personal information of those children, 0:15:19.280 --> 0:15:23.479 or that have actual knowledge that those sites and services 0:15:23.520 --> 0:15:25.600 are in the process of doing whatever it is they 0:15:25.640 --> 0:15:30.160 are doing, also collecting, using, or disclosing children's personal information. So, 0:15:30.200 --> 0:15:33.440 in other words, whether a company is setting out explicitly 0:15:33.600 --> 0:15:38.120 to collect information about specific kids or that just happens 0:15:38.160 --> 0:15:40.680 to be a byproduct of whatever the company is doing, 0:15:41.280 --> 0:15:44.920 these laws have to apply to those types of entities. 0:15:45.520 --> 0:15:47.920 But as we'll see, this approach is not quite as 0:15:48.000 --> 0:15:51.200 black and white as it sounds. We're gonna take a 0:15:51.240 --> 0:16:01.560 quick break and we'll be right back. Okay, So I 0:16:01.600 --> 0:16:05.000 want to clarify something I said before the break, which 0:16:05.040 --> 0:16:08.680 is how the law applies to sites and services online. Now, Essentially, 0:16:08.720 --> 0:16:12.240 an Internet based entity would need to follow COPPA if 0:16:12.320 --> 0:16:16.800 that entities service was targeting those under thirteen and also 0:16:16.880 --> 0:16:21.400 collecting personal information about those users, or allows a third 0:16:21.440 --> 0:16:24.880 party to collect information about those users, like an advertiser, 0:16:25.520 --> 0:16:28.160 or if the entity runs some sort of ad network 0:16:28.280 --> 0:16:32.040 or uses plug ins that also collect information, such as 0:16:32.120 --> 0:16:36.960 like the Honey extension, that one collects personal information, and 0:16:37.240 --> 0:16:42.200 if Honey knows for a fact that among the users 0:16:42.440 --> 0:16:46.400 of its service there are children under the age of thirteen, 0:16:47.040 --> 0:16:50.360 it has to comply with KAPPA. So, in other words, 0:16:50.520 --> 0:16:52.760 if you know for a fact that the information you 0:16:52.800 --> 0:16:58.960 are collecting includes information from kids, KAPPA applies. Third if 0:16:59.000 --> 0:17:01.920 your site or service aims for a general audience, but 0:17:02.040 --> 0:17:04.520 you happen to know that within that general audience there 0:17:04.520 --> 0:17:06.920 are people under the age of thirteen, and you are 0:17:07.000 --> 0:17:11.600 gathering information on your audience. Kappa applies and see as 0:17:11.680 --> 0:17:14.160 kind of at the heart of what would cause issues 0:17:14.160 --> 0:17:17.880 for content creators on YouTube. There are channels that clearly 0:17:17.960 --> 0:17:21.600 target younger audiences, and there are some that, based on 0:17:21.640 --> 0:17:26.120 the nature of their content, clearly aren't meant for younger audiences. 0:17:26.840 --> 0:17:29.760 But there are tons of channels where it hits this 0:17:29.880 --> 0:17:33.240 kind of gray area in which it might seem at 0:17:33.240 --> 0:17:36.480 a casual glance to be aimed at a younger viewer group, 0:17:37.040 --> 0:17:40.280 but in fact the channel contains content that is not 0:17:40.480 --> 0:17:43.520 appropriate for kids. And this gets into a bunch of 0:17:43.520 --> 0:17:46.359 tangential matters that open up so many kinds of worms 0:17:46.359 --> 0:17:48.879 that I'm just gonna touch on it here. We're not 0:17:48.920 --> 0:17:51.520 going to dive into it. That would be an entirely 0:17:52.040 --> 0:17:54.800 separate episode. So what I mean by all this is 0:17:54.840 --> 0:17:58.320 that there are some forms of media that traditionally people 0:17:58.400 --> 0:18:02.399 associate with chill rans media. So I'm thinking about stuff 0:18:02.440 --> 0:18:07.440 like puppets or animation or video games, and yeah, I'm 0:18:07.480 --> 0:18:09.879 sure most of y'all listening to this can think of 0:18:09.960 --> 0:18:13.560 plenty of examples of those forms of entertainment that are 0:18:13.960 --> 0:18:20.000 definitely and definitively not for kids, like the Broadway show 0:18:20.040 --> 0:18:24.760 Avenue Q that features puppets, but that show ain't for kids. Uh. 0:18:24.800 --> 0:18:28.639 There are lots of different animated series like anime that 0:18:28.840 --> 0:18:32.400 are far too sophisticated and contain content that would not 0:18:32.480 --> 0:18:35.560 be appropriate for children, might disturb them and upset them, 0:18:35.560 --> 0:18:38.359 and it's just not meant for younger viewers. And of course, 0:18:38.400 --> 0:18:41.560 we also know that the idea that video games are 0:18:41.560 --> 0:18:45.359 for kids is really an outdated concept. I mean, nearly 0:18:45.560 --> 0:18:49.840 forty of the video game playing population is between the 0:18:49.880 --> 0:18:54.000 age of eighteen and thirty four. Another significant percentage is 0:18:54.040 --> 0:18:57.560 over the age of sixty five, So when you look 0:18:57.600 --> 0:19:01.000 at it, kids make up a minority of the people 0:19:01.000 --> 0:19:02.840 who are playing video games, and yet we still have 0:19:02.920 --> 0:19:06.560 this association that video games are for kids. But the 0:19:06.600 --> 0:19:09.720 fact that these types of entertainment have this traditional association 0:19:09.760 --> 0:19:12.960 with children's media is an ongoing issue that I'm sure 0:19:12.960 --> 0:19:17.359 we're gonna loop back into before the end of this podcast. Anyway, 0:19:17.760 --> 0:19:21.760 Kappa passes in and while I've talked about who is 0:19:21.800 --> 0:19:24.760 subject to KAPPA. I haven't really covered the actual rules yet, 0:19:25.119 --> 0:19:27.480 so we're gonna go over those. And these rules come 0:19:27.600 --> 0:19:32.040 straight from the f TCS website on Kappa. Those entities 0:19:32.040 --> 0:19:35.760 that are subject to Kappa must and I quote, post 0:19:35.840 --> 0:19:40.840 a clear and comprehensive online privacy policy describing their information practices. 0:19:40.840 --> 0:19:45.600 For personal information collected online from children, they must provide 0:19:45.640 --> 0:19:50.439 direct notice to parents and obtain verifiable parental consent with 0:19:50.640 --> 0:19:56.119 limited exceptions, before collecting personal information online from children. They 0:19:56.200 --> 0:19:59.399 must give parents the choice of consenting to the operator's 0:19:59.440 --> 0:20:03.080 collection and internal use of a child's information, but prohibiting 0:20:03.119 --> 0:20:06.880 the operator from disclosing that information to third parties, unless 0:20:06.960 --> 0:20:10.080 disclosure is integral to the site or service, in which 0:20:10.080 --> 0:20:14.119 case this must be made clear to parents. They must 0:20:14.160 --> 0:20:18.000 provide parents access to their child's personal information to review 0:20:18.200 --> 0:20:22.120 and or have the information deleted. They must give parents 0:20:22.160 --> 0:20:26.000 the opportunity to prevent further use or online collection of 0:20:26.000 --> 0:20:30.960 a child's personal information. They must maintain the confidentiality, security, 0:20:31.040 --> 0:20:35.120 and integrity of information they collect from children, including by 0:20:35.160 --> 0:20:39.120 taking reasonable steps to release such information only to parties 0:20:39.160 --> 0:20:44.000 capable of maintaining its confidentiality and security. They must retain 0:20:44.080 --> 0:20:47.320 personal information collected online from a child for only as 0:20:47.359 --> 0:20:51.000 long as is necessary to fulfill the purpose for which 0:20:51.080 --> 0:20:55.040 it was collected, and delete the information using reasonable measures 0:20:55.040 --> 0:20:59.600 to protect against its unauthorized access or use. And they 0:20:59.680 --> 0:21:03.800 must uh not condition a child's participation in an online 0:21:03.800 --> 0:21:07.120 activity on the child providing more information than is reasonably 0:21:07.160 --> 0:21:10.840 necessary to participate in that activity. So what that last 0:21:10.840 --> 0:21:12.720 one means, by the way end quote, what that last 0:21:12.720 --> 0:21:15.200 one means is that you can't require kids to fill 0:21:15.240 --> 0:21:19.400 out like a lengthy online form with stuff like their 0:21:19.440 --> 0:21:22.120 full name and home address and phone number and email 0:21:22.560 --> 0:21:25.200 just so that they can play a game, because it's 0:21:25.240 --> 0:21:27.560 not necessary to have that information in order for the 0:21:27.600 --> 0:21:30.120 kid to play a game. That's what that last one means. 0:21:31.000 --> 0:21:34.639 The FTC also goes on to define what constitutes personal information, 0:21:35.080 --> 0:21:39.600 so specifically, the FTC when they say personal information, they 0:21:39.680 --> 0:21:42.639 mean the first and last name of a person, their 0:21:42.680 --> 0:21:46.080 home or address including street name and town or city, 0:21:46.560 --> 0:21:50.960 their online contact information, their screen name or handle that 0:21:51.040 --> 0:21:55.480 can serve as online contact information on certain services and platforms. 0:21:56.119 --> 0:22:00.000 A telephone number counts as personal information, social security numb 0:22:00.160 --> 0:22:04.520 or a persistent identifier that indicates a specific user across 0:22:04.600 --> 0:22:08.240 different user sessions and different sites and services. So this 0:22:08.320 --> 0:22:11.439 is something that would be unique to each person, but 0:22:11.600 --> 0:22:15.480 not something that they would have necessarily provided to the service. 0:22:15.560 --> 0:22:18.719 The service provides this to the person. So let's say 0:22:18.880 --> 0:22:21.480 I'm the third person to ever sign up for Facebook, 0:22:21.480 --> 0:22:26.880 and Facebook assigns me user number zero zero zero zero, etcetera, etcetera. Three, 0:22:27.080 --> 0:22:30.359 that's my personal identifier. It's unique to me. It means 0:22:30.359 --> 0:22:33.879 Facebook can track me and my my activities. That's the 0:22:33.920 --> 0:22:35.840 kind of thing they're talking about there. That counts as 0:22:35.880 --> 0:22:39.600 personal information, even though it's something that the site assigns 0:22:39.600 --> 0:22:42.320 to the person, not something that the person gives to 0:22:42.400 --> 0:22:45.960 the site. It also includes any file that has the 0:22:46.040 --> 0:22:48.720 child's image or voice in it, so any sort of 0:22:48.800 --> 0:22:52.680 video file or image file or audio file. It also 0:22:52.720 --> 0:22:56.320 includes geolocation data that can target where the child is, 0:22:56.400 --> 0:23:00.560 including like a street uh. It includes information collected by 0:23:00.600 --> 0:23:04.360 the service from the child or child's parents that complements 0:23:04.400 --> 0:23:07.439 the other types of information mentioned. So that's like the 0:23:07.560 --> 0:23:11.359 registration forms and stuff I was talking about, and some 0:23:11.440 --> 0:23:15.399 of these types of personal identification subsets, such as that 0:23:15.480 --> 0:23:19.120 geolocation data, those were not part of Kappa originally back 0:23:19.160 --> 0:23:23.240 in n and ninety six, geolocation wasn't much of a 0:23:23.320 --> 0:23:26.879 thing because we were still waiting for GPS to be 0:23:26.960 --> 0:23:29.440 kind of opened up to the general public. It was 0:23:29.480 --> 0:23:33.200 still very much a military centered thing, and we were 0:23:33.240 --> 0:23:35.359 just in the very early days of having that change. 0:23:35.840 --> 0:23:40.840 But in the FTC expanded KAPPA a bit, given that, 0:23:41.040 --> 0:23:44.639 you know, tech like smartphones had really created a new 0:23:44.840 --> 0:23:47.720 way to collect data and new types of data that 0:23:47.800 --> 0:23:51.560 could be useful to collect. So that's when we started 0:23:51.560 --> 0:23:53.199 to see some of those other things add it in, 0:23:53.280 --> 0:23:57.840 like geolocation and the personal identifier number. In twenty seventeen, 0:23:57.920 --> 0:24:00.879 the FTC would expand KAPPA again to apply it to 0:24:01.040 --> 0:24:04.920 not only to Web browsers and services on computers and smartphones, 0:24:05.320 --> 0:24:08.320 but also to other types of Internet connected devices like 0:24:08.359 --> 0:24:12.520 IoT type stuff. And that was because with the proliferation 0:24:12.560 --> 0:24:16.080 of IoT sensors and toys and games, the FTC wanted 0:24:16.119 --> 0:24:18.720 to make certain that the rules would apply to these 0:24:18.800 --> 0:24:22.760 new technologies and protect children. I did an episode I 0:24:22.760 --> 0:24:26.040 think it was on Forward Thinking actually the Forward Thinking 0:24:26.080 --> 0:24:30.199 podcast from several years ago, where we talked about the 0:24:30.240 --> 0:24:34.640 Internet connected Barbie doll and how that ended up posing 0:24:34.720 --> 0:24:39.000 as a potential security and privacy threat for children, and 0:24:39.080 --> 0:24:41.240 that's the sort of thing that the FTC really wanted 0:24:41.280 --> 0:24:44.720 to get, you know, a handle on. Now, assuming that 0:24:44.840 --> 0:24:49.160 an entity that must comply with Kappa is following the rules, 0:24:49.480 --> 0:24:52.400 then that entity should be legally in the clear right 0:24:52.440 --> 0:24:54.360 if they as long as they're following the rules then 0:24:55.280 --> 0:24:58.159 and they're making sure they're getting parental consent first, they 0:24:58.160 --> 0:25:01.480 can still collect data, they can still use that data. 0:25:01.560 --> 0:25:03.800