Notice and Consent - Children's Online Privacy Protection Act

After reading Nissenbaum's article on how to approach the tricky subject of online privacy, I was curious about the debate surrounding the current method she describes, of 'notice and consent'.  I was especially interested in the fact that she points out multiple times how this method is ineffective in really protecting users's privacy, especially considering the tension between providing them with a legal notice that is both understandable and readable AND thorough enough to really supply the information necessary for them to make an informed choice.

When I searched 'notice and consent online privacy', I was interested to see that the first page of results had 5 mentions of something called the 'Children's Online Privacy Protection Act', or COPPA.  According to the act's website, informing website operators of how to comply, the act seeks to protect the online privacy of children 13 and younger by detailing "what a Web site operator must include in a privacy policy, when and how to seek verifiable consent from a parent and what responsibilities an operator has to protect children's privacy and safety online".  The law requires that websites include a notice of its information collecting practices, and specifies how the link to this notice be displayed on the website, as well as the specific information that it must contain.  The requirements for the notice SEEM to be straightforward, including requirements such as "The notice must be clearly written and understandable; it should not include any unrelated or confusing materials", and:

• The kinds of personal information collected from children (for example, name, address, email address, hobbies, etc.) and how the information is collected -- directly from the child or passively, say, through cookies.
• How the operator uses the personal information. For example, is it for marketing back to the child? Notifying contest winners? Allowing the child to make the information publicly available through a chat room?
• Whether the operator discloses information collected from children to third parties. If so, the operator also must disclose the kinds of businesses in which the third parties are engaged; the general purposes for which the information is used; and whether the third parties have agreed to maintain the confidentiality and security of the information.

However, the law has actually earned a fair amount of criticism, because of the way website operators have reacted.  There are many sites that have simply banned children under 13 from signing up.  The argument is that this potentially limits their rights to self expression and freedom of speech.  According to one criticsism, "another persistent concern was whether or not such regulations would serve to restrict children‘s ability to use the Internet as an educational and functional tool.  A child‘s ability to freely explore online could be 

hampered by the need to obtain parental consent every time a website asked for personal information or preferences.  For example, resources like homework help, live chats, games, and educational materials tailored to personal preferences might be removed for a site seeking to achieve COPPA compliance" (Matecki, 383).  The argument continues that children will either a) simply move on to another site in the time that it takes to obtain parental consent or b) falsify information on their age, which might actually lead to personal information about them being misused.  Nissenbaum's article argues that notice and consent is not that proper way to protect online privacy, and apparently COPPA validates her argument.

"COPPA - Children's Online Privacy Protection." COPPA - Children's Online Privacy Protection. Federal Trade Commisson, 28 Oct. 1998. Web. 13 Apr. 2014. http://www.coppa.org/comply.htm

Matecki, Lauren A. "Update: COPPA Is Ineffective Legislation! Next Steps for Protecting Youth Privacy Rights in the Social Networking Era." Northwestern Journal of Law & Social Policy 5.2 (2010): 369-402. Web. 13 Apr. 2014.