Last Wednesday, a group of app developers, lawyers, representatives from Federal Trade Commission and California Attorney General Kamala Harris held a small conference in an office three floors below Twitter headquarters in San Francisco. They were there to discuss privacy laws.
But as the conversation turned to apps for young people — specifically those under 13 years old — a surprising consensus emerged: steer clear, at least for now.
The call for caution came in response to a new amendment to Children's Online Privacy Protection Act (COPPA), which, starting July 1st, will dramatically expand the definition of "personal information." COPPA's prohibition on the collection of personal information from minors is why many social networking sites set a lower age limit of 13. But the new rules call into question more than just social networks — developers worry that a wide range of games, video and audio apps, and entertainment apps targeted at young people could run afoul of COPPA 2.0.
The FTC wanted to make sure COPPA applied to apps, not just websites, so it broadened "personal information" to include geo-location, photos, videos, audio files, IP addresses and mobile device IDs — i.e. the data automatically collected and used by many common mobile apps (when you install an app in iOS or Android, for example, it will often ask for access to your camera roll, GPS, contacts and the like). Apps that collect any such data will need a system to notify parents and get their "verifiable" consent. They also have to prove that they are only collecting the data that is "reasonably necessary" for the immediate function of the service.
The simplest solution, of course, is to install an age screen saying no one under thirteen can download the app, as many social networks already do (in addition, most app stores have age controls built in). But if your primary audience is under 13, that's potentially crippling.
The amendment also broadens COPPA to apps that "target" kids, even if adults or teens are the primary audience. Determining factors include the presence of animated characters, child-oriented music, the presence of child celebrities or celebrities who appeal to children, as well as child-oriented language. This presents a complicated problem for apps that ostensibly market to teens but attract a younger audience — in the same way that 17 magazine's audience is mostly younger than 17, many popular teen-marketed apps, such as Keek, are attractive to much younger users.
The rules also extend to third-party plugins and ad networks, meaning that if an app or website is determined to be targeted at people under 13, every technology that it uses — say, Google AdWords, or analytics software, or a YouTube plugin — must be COPPA-compliant as well. Apps that presently integrate Facebook or Twitter in any way could be susceptible to the new rules, which may require costly redesigns.
"We are very concerned about the implementation of this rule as it applies to the use of third party plug-in technologies," says Morgan Reed, executive director of industry group Association for Competitive Technology, an advocate group for over 5,000 small and mid-size app developers. "While giant, vertically-integrated companies don't need third party plug-ins, these tools are critical for startups and small app companies." Software developers complain that COPPA compliance is already costly, burdensome, and some fear could hurt install rates, and that this will make it worse.
COPPA's intentions are mostly noble, of course: while an adult can reasonably consent to submitting private information to a website such as Facebook, a child might not be able to make an informed decision, or even understand the nature of the transaction. But the demand for fully COPPA-compliant third parties is seen as discouraging creation of positive, educational apps for kids. "There is already a paucity of child directed websites because it is hard to get parental consent," says Reed. A number of his clients have put app projects on hold because of the expansion of COPPA, in particular due to the cost of getting the apps vetted by a lawyer. "If you push too hard the developers will just pursue other ideas," says Reed.
"The FTC worked very hard to get the balance right," says Peder Magee, senior staff attorney at the FTC. "We had public workshops, a lengthy notice and public comment period, and took into account the concerns of various stakeholders in crafting it, so it reflects changes in new data collection practices and consumer privacy, especially for sensitive audiences of children."
Perhaps most importantly, the ways in which the new rules will be interpreted and enforced are vague and poorly understood. The FTC is still writing FAQs for developers, and larger app developers are working with lawyers to better understand the effects these new rules will have on their products.
But smaller independent developers may just have to put things on hold.