Speaker 1: Welcome to Tech Stuff, a production from I Heart Radio.
Speaker 1: Hey there, and welcome to tech Stuff. I'm your host,
Speaker 1: Jonathan Strickland. I'm an executive producer with I Heart Radio
Speaker 1: and I love all things tech. And on Monday's episode,
Speaker 1: I looked at the topic of privacy or privacy and
Speaker 1: the Internet and how companies collect and use private information. Essentially,
Speaker 1: the point of that episode was to show how in
Speaker 1: the era of big data, practically everything we do generates
Speaker 1: at least a data point that goes into a constantly
Speaker 1: more detailed depiction of who we are, digitally speaking, and
Speaker 1: that numerous companies are profiting off that information. And sometimes
Speaker 1: it means we as individuals actually see some sort of
Speaker 1: benefit from that, right like targeted personalized experien ins can
Speaker 1: be a benefit, but sometimes it really just means we're
Speaker 1: being exploited in some way. Now, you could say that
Speaker 1: for adults, this is just the price you pay to
Speaker 1: be a modern citizen of our digital world, particularly when
Speaker 1: it involves joining various online platforms and services that include
Speaker 1: statements that explain that the service is going to collect, share,
Speaker 1: and leverage data from users. And you could argue, hey,
Speaker 1: you agreed to do this when you signed up for
Speaker 1: an account, even if you didn't bother reading the fine print. However,
Speaker 1: it is a different matter entirely when it comes to kids.
Speaker 1: Kids don't have the awareness of what it means to
Speaker 1: share information about themselves. They don't understand the potential consequences.
Speaker 1: So it wouldn't be ethical to convince a kid to
Speaker 1: sign any sort of binding agreement without that kid's parent
Speaker 1: or guardian present and consenting to it. And so when
Speaker 1: it comes to the privacy of kids, things take a
Speaker 1: pretty serious turn. In the United States. That includes the
Speaker 1: passing of a law in nine called the Children's Online
Speaker 1: Privacy Protection Act or KAPPA CEO p p A. Today,
Speaker 1: I want to explore what prompted the drafting and passage
Speaker 1: of KAPPA, and some cases in which companies have been
Speaker 1: found guilty of failing to comply with the rules of KAPPA,
Speaker 1: and how that has affected content on the Internet in general.
Speaker 1: Generally speaking, when it comes to technology and the law,
Speaker 1: there is a lot of opportunity for messiness. Technology advances
Speaker 1: at a far faster pace than what we see in
Speaker 1: the legal world. Heck, the folks who draft legislation tend
Speaker 1: to be let's say a bit on the older side,
Speaker 1: which can also mean that they can sometimes be a
Speaker 1: little bit out of touch when it comes to modern technology.
Speaker 1: And we see this all the time with politicians just
Speaker 1: struggling to understand the scope and the effect of technology
Speaker 1: while simultaneously trying to draft legislation that in some way
Speaker 1: intersects with technology. It doesn't always go well, and often
Speaker 1: this means there's a figurative disconnect between the law and
Speaker 1: the tech, and that can lead to unintended consequences. At
Speaker 1: the same time, we can see the clear need for legislation,
Speaker 1: at least in some cases. The fact that there aren't
Speaker 1: hard and fast legal protections for online privacy in general
Speaker 1: has led us to this condition in the United States
Speaker 1: in which our data becomes digital currency. Only it's currency
Speaker 1: that we the generators, the people that are making that data.
Speaker 1: We don't get to profit off of that, at least
Speaker 1: not you know, directly. Other people and companies are making
Speaker 1: billions of dollars off the data that we create, which
Speaker 1: doesn't seem terribly fair, does it That we're not compensated
Speaker 1: for generating all this information. Our compensation tends to be
Speaker 1: the use of a service or platform. Anyway, My point
Speaker 1: is we can have situations in which we need legislation,
Speaker 1: and yet we can also have those situations where the
Speaker 1: laws we get may not measure up to what we
Speaker 1: actually need. So let's take a look at Kappa and
Speaker 1: figure out if it does what it's supposed to do. Now,
Speaker 1: of course, this means we also have to look at
Speaker 1: some history, and a predecessor to Kappa is an industry
Speaker 1: organization called the Children's Advertising Revenue Unit or caru CE
Speaker 1: a are you, that formed in nineteen seventy four out
Speaker 1: of the Better Business Bureau here in the United States. Now, traditionally,
Speaker 1: marketing targeted adults, right, there was adults that heard all
Speaker 1: the different ads, But by the nineteen seventies, television programs
Speaker 1: that were aimed specifically at kids were really becoming a
Speaker 1: regular thing. And if the audience for those shows were kids, well,
Speaker 1: that meant that the ads that were being displayed during
Speaker 1: those shows were also being directed towards kids, and that
Speaker 1: meant marketers had to craft ads that would appeal to
Speaker 1: kids potentially so that those kids would go and then
Speaker 1: convince their parents to buy whatever stuff they were seeing
Speaker 1: on television, whether it was a toy or a serial
Speaker 1: or whatever. But again, this brings up some pretty tough
Speaker 1: ethical questions. How do you market to kids who aren't
Speaker 1: old enough to make decisions for themselves? Rather than risk
Speaker 1: having the government step in and get involved. The television
Speaker 1: and advertising industries saw the wisdom in a self regulating body,
Speaker 1: and CARU created some basic core principles which would also
Speaker 1: become important for Kappa. The guidelines that CARU essentially set
Speaker 1: they say stuff like kids may not be aware that
Speaker 1: they're even being advertised too, and they might have limited
Speaker 1: experience with the persuasive nature of advertising. So therefore, advertisers
Speaker 1: need to show a special responsibility when they are marketing
Speaker 1: towards kids. And as someone who grew up in the
Speaker 1: seventies and eighties, I can tell you that it could
Speaker 1: get pretty tricky to separate the ads from the content
Speaker 1: back in those days, partly because a lot of the
Speaker 1: shows geared towards kids were really nothing more than, you know,
Speaker 1: grandiose commercials for lines of toys and stuff. I'm looking
Speaker 1: at you, Transformers and g I Joe and he Man.
Speaker 1: The guideline stress the advertisers need to be substantive in
Speaker 1: their claims when it comes to ads directed at kids. So,
Speaker 1: in other words, ads should not give kids the idea
Speaker 1: that they'd be able to do stuff with a product
Speaker 1: that just isn't possible, you know, like buying a he
Speaker 1: Man plastic sword, and that if you just say, by
Speaker 1: the power of Gray Skull, I have the power, you
Speaker 1: will somehow magically get a page boy haircut and giant muscles.
Speaker 1: I can tell you from personal experience that's just not
Speaker 1: the case. Other guidelines say that advertisers should not advertise
Speaker 1: products or services that are not appropriate for kids two kids,
Speaker 1: So you shouldn't be getting like ads for car dealerships
Speaker 1: in the middle of your Saturday morning cartoon block or
Speaker 1: something like that, and that adds should include a diverse
Speaker 1: representation within them. They shouldn't all be the same ethnicity.
Speaker 1: And that also adds should reinforce positive social interactions, like
Speaker 1: being honest in such In other words, the idea was, yeah,
Speaker 1: we're gonna allow for advertising to kids, but let's do
Speaker 1: it in a way where at least it seems like
Speaker 1: it's wholesome. Now, I think it's fair to say that
Speaker 1: these guidelines, which would again go on to inform the
Speaker 1: rules for Kappa, weren't the product of necessarily a sincere
Speaker 1: concern for children so much as it was an effort
Speaker 1: to head the government off at the past. And I
Speaker 1: say this as someone who has studied advertising and marketing
Speaker 1: a little bit, and I walked away with a distinct
Speaker 1: impression that ethics are you know, that's mostly something that
Speaker 1: happens to other industries compared to marketing and advertising. Sometimes
Speaker 1: ethics were seen as something of a drawback in that field,
Speaker 1: particularly if you study the advertising of the fifties and
Speaker 1: sixties the stuff. You should know. Guys have done episodes
Speaker 1: on advertising from that era, and those episodes are phenomenal
Speaker 1: and they really detail how sleazy that world could be.
Speaker 1: And while that kind of foolishness might be aimed at
Speaker 1: adults without much of a blink of an eye, the
Speaker 1: story is different when there are kids involved. That being said,
Speaker 1: Cairo takes the issue of advertising to kids in a
Speaker 1: responsible way as a serious thing, because, again, if the
Speaker 1: organization fails in this regard, if the industry starts to
Speaker 1: fall short, the government is going to step in. There
Speaker 1: will be a a strong position from the citizens for
Speaker 1: the government to step in and do something about it.
Speaker 1: And like many industries, the advertising world is not super
Speaker 1: keen on the idea of regulation. But let's move forward.
Speaker 1: So while you might look back on the children's programming
Speaker 1: and advertising from the eighties and into the nineties and say, huh,
Speaker 1: it seems like those guidelines were pretty lucy goosey, and
Speaker 1: that a lot of a lot of programming may not
Speaker 1: have followed it all that closely, the fact was that
Speaker 1: Cairo was in charge of making sure things didn't go
Speaker 1: too far astray in the United States, and then in
Speaker 1: the early nineties, the mainstream public became aware of this
Speaker 1: thing called the Internet. Now, those of you who have
Speaker 1: listened to this show for a long time, or those
Speaker 1: of you who have studied the Internet, know that the
Speaker 1: Internet and its predecessors like our ponnet have actually been
Speaker 1: around for a really long time. But outside of a
Speaker 1: RelA tive ly small population of researchers and students and
Speaker 1: government officials, hardly anyone knew anything about it. And that
Speaker 1: changed with the launch and evolution of the Worldwide Web.
Speaker 1: The Web was a much more user friendly and intuitive
Speaker 1: way to access the Internet. The adoption of the Web
Speaker 1: by the mainstream didn't happen overnight, but without the Web,
Speaker 1: I think it's pretty safe to say that the general
Speaker 1: awareness about the Internet in general h and what you
Speaker 1: could do with it would have lagged behind by several
Speaker 1: years at the least. Anyway, once websites started to really
Speaker 1: be a thing, and once companies began to kind of
Speaker 1: cautiously dip their corporate toe in the web and see
Speaker 1: how they might conduct commerce and further, how they might
Speaker 1: advertise to people online, CARU really began to get a
Speaker 1: bit proactive in the online space. There was a legitimate
Speaker 1: concern that one of the things that makes the web great,
Speaker 1: that being that it's easy to access stuff if you
Speaker 1: just have a browser, uh, internet connection and some basic
Speaker 1: web skills, that also makes the web a potential pitfall
Speaker 1: when it comes to how children access and process information. Moreover,
Speaker 1: as I mentioned in Monday's episode, it didn't take very
Speaker 1: long at all for companies to use the Internet in
Speaker 1: order to start gathering information about users in order to
Speaker 1: advertise to them more effectively, And it wasn't long at
Speaker 1: all before companies began to build out databases of user information.
Speaker 1: And while you might make the argument that a mature adult,
Speaker 1: or you know, at least someone who's of an adult
Speaker 1: age has the wherewithal to sign over their right to
Speaker 1: privacy with an understanding of what that actually means. The
Speaker 1: saint can't be said of kids, and thus CARU focused
Speaker 1: on how various sites and services would gather and use
Speaker 1: information online when it came to the information of children.
Speaker 1: In nine CARU published a new set of guidelines called
Speaker 1: Interactive Electronic Media. This was in an effort to get
Speaker 1: ahead of issues that were starting to pop up thanks
Speaker 1: to the web. The goal was to create new guidelines
Speaker 1: for the online space that would protect the privacy of
Speaker 1: those under the age of thirteen, which was kind of
Speaker 1: an arbitrary age picked it. It reflected the ages that
Speaker 1: CARU was focused on as part of advertising in general,
Speaker 1: and it was easy to see the need for this
Speaker 1: approach because even as early as nineteen there were companies
Speaker 1: that were advertising to kids online and they weren't necessarily
Speaker 1: following the CARU guidelines that had been in place for
Speaker 1: like television advertising. Plus, there was the issue of companies
Speaker 1: collecting information about these young consumers without parental consent. The
Speaker 1: canary in the coal mine for this issue turned out
Speaker 1: to be a website called kids Calm, which, as the
Speaker 1: name implies, was a child focused site. Kids Calm used
Speaker 1: tools like register straation forms, pen Pal programs, and contest
Speaker 1: entries to gather information about their users, that is, kids
Speaker 1: who are visiting the site, and hey, this is a
Speaker 1: good time to remind you that if you happen to
Speaker 1: be entering a sweepstakes or contest online or even offline,
Speaker 1: what you're really doing is you're handing over your information
Speaker 1: to some third party, and you can bet that information
Speaker 1: is going to be used in some way. It may
Speaker 1: be used directly by the entity you hand it to.
Speaker 1: So it may be that, for example, it's a magazine
Speaker 1: publisher and you filled out this information. Well, now the
Speaker 1: magazine publisher is going to market other magazines directly to you.
Speaker 1: Or it might mean that your information gets put into
Speaker 1: a database that other companies can pay to access, or
Speaker 1: it could be a combination of the two. Anyway, kids
Speaker 1: Calm was doing this, but the big problem was that
Speaker 1: a lot of kids Calm users were you know kids.
Speaker 1: The FTC investigated Kids Come after receiving a complaint letter
Speaker 1: about the site from the Center of Media Education. The
Speaker 1: FTC found kids Come in violation of several FTC rules
Speaker 1: with regard to the collection and sharing of data, and
Speaker 1: it had turned out that kids Come was in fact
Speaker 1: sharing a database of user information with third parties. On
Speaker 1: the bright side, the data was an aggregate, so it
Speaker 1: was not formatted to reveal personal information unique to individuals.
Speaker 1: It was more inaggregate. It was all collected so that
Speaker 1: there was no personally identifiable people in there. It could
Speaker 1: have been worse, is what I'm saying. Kids Come agreed
Speaker 1: to change its ways and to conform to the rules,
Speaker 1: and that site stuck around till two thousand nineteen. But
Speaker 1: the case of kids Come laid bare the potential dangers
Speaker 1: of data collection when it comes to young kids. This
Speaker 1: matter was seen as a serious one and it led
Speaker 1: to the Federal Trade Commission or FTC, to draft the
Speaker 1: Children's Online Privacy Protection Act KAPPA, and again that was
Speaker 1: passed into law. In that law used CARUS Interactive Electronic
Speaker 1: Media Guidelines as a foundation. The law applies to websites
Speaker 1: and service operators that either directly target children for the
Speaker 1: purposes to collect, use, or disclose personal information of those children,
Speaker 1: or that have actual knowledge that those sites and services
Speaker 1: are in the process of doing whatever it is they
Speaker 1: are doing, also collecting, using, or disclosing children's personal information. So,
Speaker 1: in other words, whether a company is setting out explicitly
Speaker 1: to collect information about specific kids or that just happens
Speaker 1: to be a byproduct of whatever the company is doing,
Speaker 1: these laws have to apply to those types of entities.
Speaker 1: But as we'll see, this approach is not quite as
Speaker 1: black and white as it sounds. We're gonna take a
Speaker 1: quick break and we'll be right back. Okay, So I
Speaker 1: want to clarify something I said before the break, which
Speaker 1: is how the law applies to sites and services online. Now, Essentially,
Speaker 1: an Internet based entity would need to follow COPPA if
Speaker 1: that entities service was targeting those under thirteen and also
Speaker 1: collecting personal information about those users, or allows a third
Speaker 1: party to collect information about those users, like an advertiser,
Speaker 1: or if the entity runs some sort of ad network
Speaker 1: or uses plug ins that also collect information, such as
Speaker 1: like the Honey extension, that one collects personal information, and
Speaker 1: if Honey knows for a fact that among the users
Speaker 1: of its service there are children under the age of thirteen,
Speaker 1: it has to comply with KAPPA. So, in other words,
Speaker 1: if you know for a fact that the information you
Speaker 1: are collecting includes information from kids, KAPPA applies. Third if
Speaker 1: your site or service aims for a general audience, but
Speaker 1: you happen to know that within that general audience there
Speaker 1: are people under the age of thirteen, and you are
Speaker 1: gathering information on your audience. Kappa applies and see as
Speaker 1: kind of at the heart of what would cause issues
Speaker 1: for content creators on YouTube. There are channels that clearly
Speaker 1: target younger audiences, and there are some that, based on
Speaker 1: the nature of their content, clearly aren't meant for younger audiences.
Speaker 1: But there are tons of channels where it hits this
Speaker 1: kind of gray area in which it might seem at
Speaker 1: a casual glance to be aimed at a younger viewer group,
Speaker 1: but in fact the channel contains content that is not
Speaker 1: appropriate for kids. And this gets into a bunch of
Speaker 1: tangential matters that open up so many kinds of worms
Speaker 1: that I'm just gonna touch on it here. We're not
Speaker 1: going to dive into it. That would be an entirely
Speaker 1: separate episode. So what I mean by all this is
Speaker 1: that there are some forms of media that traditionally people
Speaker 1: associate with chill rans media. So I'm thinking about stuff
Speaker 1: like puppets or animation or video games, and yeah, I'm
Speaker 1: sure most of y'all listening to this can think of
Speaker 1: plenty of examples of those forms of entertainment that are
Speaker 1: definitely and definitively not for kids, like the Broadway show
Speaker 1: Avenue Q that features puppets, but that show ain't for kids. Uh.
Speaker 1: There are lots of different animated series like anime that
Speaker 1: are far too sophisticated and contain content that would not
Speaker 1: be appropriate for children, might disturb them and upset them,
Speaker 1: and it's just not meant for younger viewers. And of course,
Speaker 1: we also know that the idea that video games are
Speaker 1: for kids is really an outdated concept. I mean, nearly
Speaker 1: forty of the video game playing population is between the
Speaker 1: age of eighteen and thirty four. Another significant percentage is
Speaker 1: over the age of sixty five, So when you look
Speaker 1: at it, kids make up a minority of the people
Speaker 1: who are playing video games, and yet we still have
Speaker 1: this association that video games are for kids. But the
Speaker 1: fact that these types of entertainment have this traditional association
Speaker 1: with children's media is an ongoing issue that I'm sure
Speaker 1: we're gonna loop back into before the end of this podcast. Anyway,
Speaker 1: Kappa passes in and while I've talked about who is
Speaker 1: subject to KAPPA. I haven't really covered the actual rules yet,
Speaker 1: so we're gonna go over those. And these rules come
Speaker 1: straight from the f TCS website on Kappa. Those entities
Speaker 1: that are subject to Kappa must and I quote, post
Speaker 1: a clear and comprehensive online privacy policy describing their information practices.
Speaker 1: For personal information collected online from children, they must provide
Speaker 1: direct notice to parents and obtain verifiable parental consent with
Speaker 1: limited exceptions, before collecting personal information online from children. They
Speaker 1: must give parents the choice of consenting to the operator's
Speaker 1: collection and internal use of a child's information, but prohibiting
Speaker 1: the operator from disclosing that information to third parties, unless
Speaker 1: disclosure is integral to the site or service, in which
Speaker 1: case this must be made clear to parents. They must
Speaker 1: provide parents access to their child's personal information to review
Speaker 1: and or have the information deleted. They must give parents
Speaker 1: the opportunity to prevent further use or online collection of
Speaker 1: a child's personal information. They must maintain the confidentiality, security,
Speaker 1: and integrity of information they collect from children, including by
Speaker 1: taking reasonable steps to release such information only to parties
Speaker 1: capable of maintaining its confidentiality and security. They must retain
Speaker 1: personal information collected online from a child for only as
Speaker 1: long as is necessary to fulfill the purpose for which
Speaker 1: it was collected, and delete the information using reasonable measures
Speaker 1: to protect against its unauthorized access or use. And they
Speaker 1: must uh not condition a child's participation in an online
Speaker 1: activity on the child providing more information than is reasonably
Speaker 1: necessary to participate in that activity. So what that last
Speaker 1: one means, by the way end quote, what that last
Speaker 1: one means is that you can't require kids to fill
Speaker 1: out like a lengthy online form with stuff like their
Speaker 1: full name and home address and phone number and email
Speaker 1: just so that they can play a game, because it's
Speaker 1: not necessary to have that information in order for the
Speaker 1: kid to play a game. That's what that last one means.
Speaker 1: The FTC also goes on to define what constitutes personal information,
Speaker 1: so specifically, the FTC when they say personal information, they
Speaker 1: mean the first and last name of a person, their
Speaker 1: home or address including street name and town or city,
Speaker 1: their online contact information, their screen name or handle that
Speaker 1: can serve as online contact information on certain services and platforms.
Speaker 1: A telephone number counts as personal information, social security numb
Speaker 1: or a persistent identifier that indicates a specific user across
Speaker 1: different user sessions and different sites and services. So this
Speaker 1: is something that would be unique to each person, but
Speaker 1: not something that they would have necessarily provided to the service.
Speaker 1: The service provides this to the person. So let's say
Speaker 1: I'm the third person to ever sign up for Facebook,
Speaker 1: and Facebook assigns me user number zero zero zero zero, etcetera, etcetera. Three,
Speaker 1: that's my personal identifier. It's unique to me. It means
Speaker 1: Facebook can track me and my my activities. That's the
Speaker 1: kind of thing they're talking about there. That counts as
Speaker 1: personal information, even though it's something that the site assigns
Speaker 1: to the person, not something that the person gives to
Speaker 1: the site. It also includes any file that has the
Speaker 1: child's image or voice in it, so any sort of
Speaker 1: video file or image file or audio file. It also
Speaker 1: includes geolocation data that can target where the child is,
Speaker 1: including like a street uh. It includes information collected by
Speaker 1: the service from the child or child's parents that complements
Speaker 1: the other types of information mentioned. So that's like the
Speaker 1: registration forms and stuff I was talking about, and some
Speaker 1: of these types of personal identification subsets, such as that
Speaker 1: geolocation data, those were not part of Kappa originally back
Speaker 1: in n and ninety six, geolocation wasn't much of a
Speaker 1: thing because we were still waiting for GPS to be
Speaker 1: kind of opened up to the general public. It was
Speaker 1: still very much a military centered thing, and we were
Speaker 1: just in the very early days of having that change.
Speaker 1: But in the FTC expanded KAPPA a bit, given that,
Speaker 1: you know, tech like smartphones had really created a new
Speaker 1: way to collect data and new types of data that
Speaker 1: could be useful to collect. So that's when we started
Speaker 1: to see some of those other things add it in,
Speaker 1: like geolocation and the personal identifier number. In twenty seventeen,
Speaker 1: the FTC would expand KAPPA again to apply it to
Speaker 1: not only to Web browsers and services on computers and smartphones,
Speaker 1: but also to other types of Internet connected devices like
Speaker 1: IoT type stuff. And that was because with the proliferation
Speaker 1: of IoT sensors and toys and games, the FTC wanted
Speaker 1: to make certain that the rules would apply to these
Speaker 1: new technologies and protect children. I did an episode I
Speaker 1: think it was on Forward Thinking actually the Forward Thinking
Speaker 1: podcast from several years ago, where we talked about the
Speaker 1: Internet connected Barbie doll and how that ended up posing
Speaker 1: as a potential security and privacy threat for children, and
Speaker 1: that's the sort of thing that the FTC really wanted
Speaker 1: to get, you know, a handle on. Now, assuming that
Speaker 1: an entity that must comply with Kappa is following the rules,
Speaker 1: then that entity should be legally in the clear right
Speaker 1: if they as long as they're following the rules then
Speaker 1: and they're making sure they're getting parental consent first, they
Speaker 1: can still collect data, they can still use that data.
Speaker 1: They have to delete it after they use it, but
Speaker 1: they're allowed to do it. But if there's an entity
Speaker 1: that is supposed to comply with Kappa and fails to
Speaker 1: follow the rules with regard to personal information, what happens then?
Speaker 1: All the first thing that someone has to do is
Speaker 1: file a complaint with the FTC or a state authority
Speaker 1: and explain the nature of this complaint with regard to
Speaker 1: the handling of children's information. The FTC would then investigate
Speaker 1: this claim or a state authority would, and they would
Speaker 1: see if the accused online site or service was in
Speaker 1: fact in violation of Kappa. And if the authority determines
Speaker 1: that there has been a violation occurred, they can then
Speaker 1: bring a civil lawsuit against that site or service. The
Speaker 1: rules of Kappa state that the civil case can seek
Speaker 1: a penalty of forty three thousand seven dollars per violation.
Speaker 1: That's the maximum amount per violation, but the FTC might
Speaker 1: not seek the maximum amount depending upon circumstances. So determining
Speaker 1: factors include the number of children affected. If it was
Speaker 1: a few children as opposed to a lot, then that
Speaker 1: changes things how egregious the violation was. If it's something
Speaker 1: where it's found that a company was collecting user names,
Speaker 1: for example, but no other personal identifiable information, they might
Speaker 1: not get hit as hard um the types of personal
Speaker 1: information involved, how the information was used will determine it.
Speaker 1: And like I said, COPPA allows for state agencies to
Speaker 1: enforce compliance with KAPPA with respect to entities that are
Speaker 1: within those states jurisdiction, So there can be state level
Speaker 1: COPPA cases as well as the federal level ones. And
Speaker 1: then we get to the concept of safe harbor within KAPPA.
Speaker 1: So safe harbor is a general concept in which a
Speaker 1: person or company faces limited legal liability so long as
Speaker 1: that person or company is following certain conditions. And I
Speaker 1: know that's super general, but the concept applies to a
Speaker 1: lot of different situations, so it has to be general.
Speaker 1: So for example, a user generated content platform typically enjoys
Speaker 1: a certain amount of safe Harbor protection because those platforms
Speaker 1: are not responsible for the content that's published by their users.
Speaker 1: Right If I join a content platform as a user
Speaker 1: and I upload stuff that is against their policies, that's
Speaker 1: on me, not on the platform. However, as I mentioned,
Speaker 1: safe harbor typically only applies as long as certain conditions
Speaker 1: continue to be met. So for a user generated content platform,
Speaker 1: one of those conditions could be that the platform has
Speaker 1: to take down an instance of user generated content if
Speaker 1: it's proven that that instance includes copyrighted material that doesn't
Speaker 1: belong to the user. So if I start uploading you know,
Speaker 1: they might be giants tracks, and the platform i'm uploading
Speaker 1: them to get a notice, Hey, this guy is doing
Speaker 1: this without our permission, then that platform would be expected
Speaker 1: to you know, ban me or delete my material or whatever,
Speaker 1: and then it would continue to enjoy the protections of
Speaker 1: safe harbor because it actually took steps to address the issue.
Speaker 1: If platforms don't follow whatever those rules are, and it's
Speaker 1: a case by case kind of thing, then they no
Speaker 1: longer enjoy the safe harbor protection. Well, with Kappa, it's
Speaker 1: possible for industry groups to file for safe Harbor status
Speaker 1: under the FTC, and these groups have to establish a
Speaker 1: set of rules and policies that are at least the
Speaker 1: same or greater than those defined by KAPPA. And if
Speaker 1: they do that, then they can apply for safe Harbor
Speaker 1: status under KAPPA. And then regulation and enforcement kind of
Speaker 1: falls to that industry groups and the organizations that belong
Speaker 1: to industry group. So if a company then becomes a
Speaker 1: member of a particular industry group, and if industry group
Speaker 1: has safe Harbor status, the burden of responsibility really falls
Speaker 1: to that industry group to make sure that all the
Speaker 1: different member organizations are in compliance with that group's policies.
Speaker 1: And I actually have a real world example. I can
Speaker 1: cite of a company that at one point belonged to
Speaker 1: a Safe Harbor group and it later got in trouble
Speaker 1: with the FTC. That company was the game developer Mini Clip,
Speaker 1: which in two thousand nine joined the children's advertising review
Speaker 1: Units Safe Harbor. So, yeah, CARU, it does have a
Speaker 1: Safe Harbor industry group under KAPPA. But in two thousand fifteen,
Speaker 1: CARU terminated Many Clips status as a member of that group.
Speaker 1: I'm not actually sure why that happened. I don't know
Speaker 1: what led to many Clips status terminating under that Safe
Speaker 1: Harbor group, but the FTC pursued a complaint against many
Speaker 1: Clip because, according to the FTC, Many Clip continued to
Speaker 1: display a message on its websites saying that the company
Speaker 1: was part of Caru's Safe Harbor group well into two
Speaker 1: thousand nineteen, which was years after the company had its
Speaker 1: membership terminated, and the FTC's main complaint was that Mini
Speaker 1: Clip was misrepresenting itself. It was presenting a falsehood that
Speaker 1: it was still a member of this Kappa compliant group,
Speaker 1: when in fact that was no longer the case. So
Speaker 1: this showed that Kappa applies not just to the direct
Speaker 1: activities that companies engage in that involved the collection and
Speaker 1: use of personal data that belongs to kids, but also
Speaker 1: how those companies represent themselves or in this case, misrepresent themselves. However,
Speaker 1: plenty of companies have been found guilty of violating Copper
Speaker 1: rules with regard to children's data. For example, back in
Speaker 1: two thousand eight, Sony b MG, the music label, was
Speaker 1: sued by the FTC for collecting information on an estimated
Speaker 1: thirty thousand users below the age of thirteen through its websites.
Speaker 1: See Sony b MG had sites that included some social
Speaker 1: networking aspects to them, and that required users to include
Speaker 1: stuff like their names and addresses and email address and
Speaker 1: that kind of thing, you know, the standard stuff that
Speaker 1: you have to fill in when you create an account
Speaker 1: on a social networking site. Now, Sony claimed on these
Speaker 1: sites that they were not meant for people under the
Speaker 1: age of thirteen. It was for thirteen or older, but
Speaker 1: there were no actual measures in place to actually prevent
Speaker 1: kids from signing up. There was no sort of age
Speaker 1: gate process there, and the FTC alleged that not only
Speaker 1: was Sony not preventing it, the company was aware that
Speaker 1: thousands of users were under the age of thirteen. In
Speaker 1: the end, Sony BMG agreed to pay a one million
Speaker 1: dollar settlement to the FTC, and by in the end,
Speaker 1: I mean the day after the FTC filed the lawsuit
Speaker 1: Sony agreed to settle. Sony also agreed to delete all
Speaker 1: personal information related to users under the age of thirteen,
Speaker 1: along with some other measures that were mandated by the
Speaker 1: terms of the settlement. Sony's big issue was that, while
Speaker 1: it proclaimed that the sites were intended for those thirteen
Speaker 1: and older. It really had no measures in place to
Speaker 1: actually enforce that, and kids under that age could register
Speaker 1: and even include their actual age in the process, and
Speaker 1: that meant Sony was knowingly collecting data belonging to people
Speaker 1: under the age of thirteen. That's a big deal. Like,
Speaker 1: if you unknowingly collect the data of people under the
Speaker 1: age of thirteen, you actually have a bit of a
Speaker 1: defense if you can prove that you did so unknowingly.
Speaker 1: But when you knowingly collect it, it's a different kettle
Speaker 1: of fish. When we come back, we'll talk about a
Speaker 1: few other cases in which companies have tried to sidestep
Speaker 1: the issues of Kappa entirely, and also how Kappa really
Speaker 1: freaked out a huge population of YouTube creators back in
Speaker 1: But first let's take another quick break. So when it
Speaker 1: comes to companies trying to avoid dealing with Kappa, we
Speaker 1: got to talk about Facebook. Pretty much. Since the time
Speaker 1: Facebook opened up beyond college students, it has maintained that
Speaker 1: the services for people thirteen or older, and to make
Speaker 1: a Facebook profile, you have to include your name and
Speaker 1: an email address at a birth date, even if you
Speaker 1: don't intend on showing anyone else your birthdate, Facebook uses
Speaker 1: that information to in part to check your age. So
Speaker 1: if you're younger than thirteen, Facebook won't let you make
Speaker 1: a profile. Why because then Facebook would be subjected to
Speaker 1: the rules of Kappa, and as a platform that hosts
Speaker 1: user generated content, that would be really hard for Facebook
Speaker 1: to comply with. And moreover, it would mean that Facebook
Speaker 1: would have to implement some serious restrictions on how it
Speaker 1: gathers information. As I've pointed out many times, because the
Speaker 1: vast majority of Facebook's massive revenue comes from how the
Speaker 1: platform harvests and uses our personal information. So Facebook has
Speaker 1: the age gate approach. If a user fakes their birthday
Speaker 1: to get in, well, that's not really Facebook's fault, is it.
Speaker 1: That's just someone being dishonest, and Facebook isn't knowingly collecting
Speaker 1: the data of a child. The company would still be
Speaker 1: collecting that data, mind you, but as long as there
Speaker 1: was no indication that the profile actually belonged to a child,
Speaker 1: the company would have the defense that, according to the
Speaker 1: information submitted to Facebook, that user was over the age
Speaker 1: of thirteen and so by positioning itself as a company
Speaker 1: that has a social networking site intended for thirteen and older,
Speaker 1: Facebook isn't subject to Kappa The system isn't perfect by
Speaker 1: any stretch of the imagination, but it's hard to argue
Speaker 1: that Facebook is just using smoke and mirrors to seem
Speaker 1: as if it's complying. It might be easy to circumvent
Speaker 1: the rules, but there are rules. At various points. Since
Speaker 1: Kappa became law, lawmakers have considered expanding the rules and
Speaker 1: upping the age to eighteen years old. Some lawmakers have
Speaker 1: asked why thirteen has been this arbitrary age, which kind
Speaker 1: of dates back to the old CARU guidelines, and so
Speaker 1: far the government has not increased the age limit on Kappa,
Speaker 1: which is a good thing for platforms like Facebook because
Speaker 1: a change like that would have a massive effect on
Speaker 1: that social network, as well as on countless other sites.
Speaker 1: And then we come to YouTube. Yikes, alright, so YouTube
Speaker 1: has had more than a rough recent history when it
Speaker 1: comes to content and kids. First of all, YouTube has
Speaker 1: a policy that's pretty much the same as facebooks. You
Speaker 1: are not supposed to create a YouTube profile unless you're
Speaker 1: at least thirteen years old, and like Facebook, Google age
Speaker 1: gates this. Of course, someone might lie about when their
Speaker 1: birthday was, or a parent might set up an account
Speaker 1: and fudge a birthday so that their kid can watch
Speaker 1: stuff on YouTube. It's also entirely possible to just go
Speaker 1: to YouTube without being on a profile at all and
Speaker 1: just watch content on YouTube as an anonymous user. So
Speaker 1: while YouTube age gates profiles, the platform doesn't actually age
Speaker 1: gate the general content on YouTube itself, at least not
Speaker 1: to that extent. And what's more, YouTube slash Google. When
Speaker 1: I use YouTube as a company name, you can probably
Speaker 1: substitute Google or even Alphabet in there, because it's all
Speaker 1: one big, dysfunctional family. Anyway, YouTube knows all about this,
Speaker 1: which I mean no surprise that company is in the
Speaker 1: business of collecting and understanding our data better than we do.
Speaker 1: So in meetings with like big companies like Hasbro and Mattel,
Speaker 1: you know, big toy companies, YouTube has bragged about how
Speaker 1: it is a platform that is incredibly popular with children,
Speaker 1: like kids between the ages of two and twelve and
Speaker 1: stuff like that, so they're well aware that young kids
Speaker 1: are watching YouTube. And then there's YouTube Kids, which is
Speaker 1: the actual app that's supposed to filter content by age
Speaker 1: group so that you can select using the app which
Speaker 1: videos should be shown to your kid, as in, like
Speaker 1: which videos that are appropriate to certain ages are allowed
Speaker 1: to be shown to your kid. Uh. The ages I
Speaker 1: think are five, eight, and thirteen, and it just depends
Speaker 1: on which one you set when you set up the account.
Speaker 1: Like the standard version of YouTube, YouTube Kids generates revenue
Speaker 1: through ads, and Google got into trouble with this with
Speaker 1: the Campaign for a Commercial Free Childhood and the Center
Speaker 1: for Digital Democracy. They both argued that the way that
Speaker 1: ads were being presented to children on YouTube Kids made
Speaker 1: it seem like the ads were part of the content itself,
Speaker 1: which was considered to be misleading and in violation of Kappa.
Speaker 1: So Google subsequently made those ads stand out a little
Speaker 1: bit more from the content itself in order to make
Speaker 1: a more clear divider between what was an ad and
Speaker 1: what was content. And my guess is you've heard the
Speaker 1: stories about weird and disturbing videos popping up both on
Speaker 1: YouTube and ultimately on YouTube Kids that was specifically targeting children.
Speaker 1: These videos usually involve recognizable characters, ones that clearly have
Speaker 1: not been licensed, but characters like Elsa from Frozen or
Speaker 1: Spider Man from Marvel, and they're engaging in all sorts
Speaker 1: of weird and sometimes upsetting activities. Sometimes it's live action
Speaker 1: people dressed in costumes. Sometimes it's crude animation. Often the
Speaker 1: videos are completely wordless and just set to music, which
Speaker 1: means there's no language barrier there. So they can have
Speaker 1: a pretty wide appeal globally, and they frequently involve activities
Speaker 1: that kids find fascinating. You know, stuff that happens in
Speaker 1: the world that kids think is really unusual or strange,
Speaker 1: like pregnancy or toilet's or you know, all sorts of
Speaker 1: things of that nature. Getting a shot from the doctor.
Speaker 1: That's a big one too. It's definitely not high cinema,
Speaker 1: but it's the kind of stuff that kids really fixate
Speaker 1: on to different degrees and for different reasons. So through
Speaker 1: a combination of using meta keywords and other means, these
Speaker 1: videos would perform really well in in YouTube algorithms and
Speaker 1: often make the transition to YouTube kids, even if arguably
Speaker 1: the content was not appropriate, and then kids would stumble
Speaker 1: across them, and that in turn would upset parents who
Speaker 1: found out that their kids were watching these things, and
Speaker 1: that ultimately made the news. Now, this issue had been
Speaker 1: going on for years, really, but it really came to
Speaker 1: light in twenty seventeen. That's when it it made headlines
Speaker 1: in the United States and it brought a pretty harsh
Speaker 1: spotlight on YouTube as a result, so the company began
Speaker 1: banning thousands of these garbage content channels, but now found
Speaker 1: itself under some serious scrutiny. And that scrutiny included people
Speaker 1: who were concerned that videos that seemed like they might
Speaker 1: be aimed at kids were in fact not kid friendly,
Speaker 1: and that because YouTube's revenue model depends heavily on advertising,
Speaker 1: it's also meant that kids might be seeing ads that
Speaker 1: weren't really appropriate or didn't comply with CARU guidelines, and
Speaker 1: also that YouTube might be collecting information about kids without
Speaker 1: parental consent. In September twenty nineteen, the FTC and the
Speaker 1: New York Attorney General reached a settlement with YouTube regarding
Speaker 1: an allegation that the company had been collecting personal information
Speaker 1: in the form of persistent identifiers used to track specific
Speaker 1: users as they navigate through the site and beyond, and
Speaker 1: that that included children under the age of thirteen and moreover,
Speaker 1: that YouTube did not first notify parents about this and
Speaker 1: get the parents consent, which thus was a violation of Kappa.
Speaker 1: That settlement meant that YouTube would have to pay one
Speaker 1: hundred seventy million dollars in fines, which was the largest
Speaker 1: amount for a Kappa case at that point. The FDC
Speaker 1: chairman said, quote, YouTube touted its popularity with children to
Speaker 1: perspective corporate clients, yet when it came to complying with Kappa,
Speaker 1: the company refused to acknowledge that portions of its platform
Speaker 1: were clearly directed to kids. There's no excuse for YouTube's
Speaker 1: violations of the law. End quote. The complaints stated that
Speaker 1: YouTube positions itself as a general audience site, but in
Speaker 1: fact has many channels clearly geared toward younger audiences. For example,
Speaker 1: videos of people unboxing toys that are meant for little
Speaker 1: kids seems to fall pretty neatly into that category. And
Speaker 1: so YouTube, as a platform that knowingly played host to
Speaker 1: child directed channels, had a responsibility to make certain those
Speaker 1: channels and then, more importantly, the advertising on those channels
Speaker 1: complied with Copper rules. Well, there's nothing like a big
Speaker 1: old fine to incentivize a company to changing its policies,
Speaker 1: and that's what YouTube did. Creators now have to indicate
Speaker 1: whether their channels are child directed or not. They can
Speaker 1: also label specific videos on a case by case basis
Speaker 1: as to whether or not that video is directed toward children.
Speaker 1: Any video determined to be child directed, either because the
Speaker 1: user made that indication or YouTube figured it out or
Speaker 1: decided that was the case. Anyone that did that would
Speaker 1: not be allowed to include certain ways of collecting personal
Speaker 1: information from viewers. Now, most creators don't actually collect information
Speaker 1: from their viewers at all, and at least not to
Speaker 1: this level. Most of the creators who are YouTube partners
Speaker 1: and who are running ads on their videos are relying
Speaker 1: on YouTube's algorithms to serve up advertising. They don't usually
Speaker 1: actually have a say in what kind of ads are
Speaker 1: going to play against their videos. And because of YouTube's
Speaker 1: dynamic ad program, two different people in two different parts
Speaker 1: of the world who watched the exact same video with
Speaker 1: the same number of ad breaks could see very different ads.
Speaker 1: But for videos that can't collect personal information, and that
Speaker 1: selection of ads gets whittled down quite a lot. So
Speaker 1: that meant that creators who had child directed channels would
Speaker 1: find it more difficult to monetize their work and they
Speaker 1: would see a lower return on investment, and for some
Speaker 1: creators that could be severe enough to make it unprofitable
Speaker 1: and thus unsupportable to continue making videos on YouTube. Creators
Speaker 1: complained to YouTube, saying that it was difficult to determine
Speaker 1: whether or not content was really child directed or not.
Speaker 1: Maybe it was just family friendly but not specifically child directed. So,
Speaker 1: for example, videos of Let's Plays, in which content creators
Speaker 1: play video games and often provide commentary and so on,
Speaker 1: they kind of fall into that gray area because there
Speaker 1: is still that perception that video games are for kids,
Speaker 1: even though most of the population playing games these days
Speaker 1: are older than thirteen, and most games contain content that's
Speaker 1: not really kid friendly. I'm pretty sure no one would
Speaker 1: claim like Grand Theft Auto is appropriate content for small kids,
Speaker 1: or that the Resident Evil franchise is great for a
Speaker 1: six year old. But because there's this social association of
Speaker 1: video games with children, it could be difficult to argue
Speaker 1: that videos featuring gameplay are not actually child directed. And
Speaker 1: since the FTC's decision meant that creators could be held
Speaker 1: liable for future violations of Kappa, and because these creators
Speaker 1: are dependent upon ad revenue as part of their income,
Speaker 1: that gets to be a big problem. If kids are
Speaker 1: watching the videos, then that means the kids are also
Speaker 1: being served advertisements, and if that's happening, it means that
Speaker 1: there's a chance those kids are having some form of
Speaker 1: personal identification shared with those advertising parties without parental consent,
Speaker 1: and thus we get back to the violation of Kappa.
Speaker 1: It doesn't matter that the creators themselves wouldn't have access
Speaker 1: to that personal information. Just by serving as the conduit
Speaker 1: through which kids data could be hoovered up by an advertiser,
Speaker 1: the creator would be on the hook. That means that
Speaker 1: that content creator on YouTube could potentially have to pay
Speaker 1: up to forty two thousand dollars per video that violates
Speaker 1: the rules, which is a big ouch. In January twenty
Speaker 1: YouTube put the new rules in place, and videos that
Speaker 1: were either selected as being child directed or that were
Speaker 1: subsequently determined to be child directed would have their various
Speaker 1: features turned off. For example, comments would get turned off
Speaker 1: for those videos because the comment section could serve as
Speaker 1: a means for someone to collect data about members of
Speaker 1: the audience. So these videos would no longer have personalized
Speaker 1: ads because of course, those ads depend upon tracking personal data,
Speaker 1: so you can't have a personalized ad if that's not allowed,
Speaker 1: so child directed videos can't use that. So instead the
Speaker 1: ads would be contextually appropriate based upon the content of
Speaker 1: the video. Other monetization features, which include stuff like a
Speaker 1: merchandise option, those would also be turned off because those
Speaker 1: require users to handover information in order to interact with
Speaker 1: those features, so those were not allowed. Playlists, the mini
Speaker 1: player notifications, all of these features would be turned off
Speaker 1: as well. That also means that these videos would be
Speaker 1: adversely affected when it comes to YouTube's recommendation engine. Videos
Speaker 1: that get a lot of engagement tend to go up
Speaker 1: on those lists, but the child directed stuff by default,
Speaker 1: has a lot of those different features that affect metrics
Speaker 1: turned off, so that leaves the creators with a disadvantage.
Speaker 1: Their content is less likely to be seen and discovered,
Speaker 1: which in turn means lower revenues for those content creators.
Speaker 1: And that's kind of where we are now. It's it's
Speaker 1: a rough place because on the one hand, you certainly
Speaker 1: see the FTCs point in that you don't want children
Speaker 1: to be exploited. You don't want companies to be collecting
Speaker 1: data about kids when there's no real accountability there. You
Speaker 1: definitely want the parents to be involved in all of this,
Speaker 1: and it's very easy for parents to be left out
Speaker 1: of the loop, even well intentioned and you know, attentive
Speaker 1: parents can be left out of the loop. So there
Speaker 1: does need to be some sort of measures in place,
Speaker 1: and it's not necessarily I can't really blame YouTube for
Speaker 1: passing these rules. I know a lot of YouTube creators
Speaker 1: were really upset when YouTube made these announcements, but the
Speaker 1: company has an obligation as well, and ultimately is trying
Speaker 1: to protect content creators because those are the people who
Speaker 1: are going to be held responsible if they're found in
Speaker 1: violation of KAPPA. I also feel for the content creators though,
Speaker 1: because a lot of them are creating content that they
Speaker 1: never intended to be directed towards children, and yet sometimes
Speaker 1: children end up kind of, you know, latching on to
Speaker 1: that content. Well, what does the creator supposed to do
Speaker 1: about that? Because they're in the business of making stuff
Speaker 1: that they're trying to entertain people with. They're not necessary
Speaker 1: early intending it for kids, but kids are coming to
Speaker 1: watch it. That really puts them in a in a
Speaker 1: tight spot too. So it's tough. Like, there's no easy
Speaker 1: answer to this. Uh, there are a lot of competing
Speaker 1: motivations and and obligations going on here, and there's not
Speaker 1: really a simple way forward. So while we are in
Speaker 1: a in a bit of a mess. I'm not certain
Speaker 1: that there's really a neat way of doing this. If
Speaker 1: you think otherwise, I'm curious to hear your thoughts. You
Speaker 1: can reach out to me on Twitter. The handle for
Speaker 1: the show is text Stuff hs W. I'm sure I'll
Speaker 1: do more episodes that relate to privacy and technology and
Speaker 1: the ways that those are in conflict with one another,
Speaker 1: and what we can expect from that and what maybe
Speaker 1: we should do about it. I'm sure I'll do a
Speaker 1: lot more of those in the future, but I suspect
Speaker 1: that next week we're going to be covering some totally
Speaker 1: different topics, So stay tuned for that and I'll tell
Speaker 1: to again really soon. Y Text Stuff is an I
Speaker 1: Heart Radio production. For more podcasts from my Heart Radio,
Speaker 1: visit the i Heart Radio app, Apple Podcasts, or wherever
Speaker 1: you listen to your favorite shows.