The federal Children's Online Privacy Protection Act of 1998 (COPPA) regulates the collection and use of children's information online. The Children's Online Privacy Protection Act requires an operator of a website directed to children under 13 years of age or an operator of a website that has actual knowledge that it is collecting personal information from a child under 13 years of age to provide notice of what information is being collected and how that information is being used. In addition, online operators must obtain verifiable parental consent for the collection, use, or disclosure of personal information from children.
The state Consumer Protection Act (CPA) prohibits unfair methods of competition and unfair or deceptive practices in the conduct of any trade or commerce. A private person or the Attorney General may bring a civil action to enforce the provisions of the CPA. A person or entity found to have violated the CPA is subject to treble damages and attorney's fees.
Restrictions on advertising to minors and requirements related to removal of online content posted by minors are imposed on operators of an Internet website, online service, online application, or mobile application.
Products and services subject to advertising restrictions are specified and include alcohol, tobacco, vapor products, firearms and other dangerous weapons, certain dietary supplements, tanning services, and lottery tickets. "Minor" means a Washington resident under 18 years of age.
Advertising Restrictions on Operators of Websites or Online Services Directed to Minors.
An operator of a website or online service directed to minors may not market or advertise to minors specified products and services. An operator is deemed in compliance if the operator notifies its advertising service that the internet website, online service, online application, or mobile application is directed to minors. If notified by an operator, an advertising service may not market or advertise specified products and services on the operator's website or online service directed to minors.
An operator of a website or online service directed to minors may not knowingly use or disclose, or allow a third party to use or disclose, the personal information of a minor if the use or disclosure is for the purpose of marketing or advertising of the specified products or services.
Advertising Restrictions on Operators of Other Websites or Online Services.
An operator of a website or online service may not market or advertise specified products and services to a minor if:
An operator is deemed in compliance if the operator takes reasonable actions in good faith designed to avoid marketing or advertising under the prohibited circumstances.
An operator that has actual knowledge a minor is using its website or online service may not knowingly use or disclose, or allow a third party to use or disclose, the personal information of a minor if the use or disclosure is for the purpose of marketing or advertising of the specified products or services.
Removal of Content or Information Related to Minors.
An operator of a website or online service directed to minors or an operator that has actual knowledge that a minor is using its website or online service must permit a minor to remove or to request and obtain removal of content or information posted on the operator's website or online service. Notice and clear instructions on how a minor may remove or request and obtain removal of content or information must also be provided.
An operator is deemed in compliance if it renders the content or information posted by a minor not visible to other users of the service and the public, even if the content or information remains on the operator's servers or remains visible because a third party has copied or reposted the content or information posted by the minor.
An operator or a third party is not required to erase or otherwise eliminate content or information if:
Enforcement.
A violation of these provisions is enforceable under the state Consumer Protection Act and subject to a civil penalty of up to $2,500 per violation in actions brought by the Attorney General.
The substitute bill: (1) removes aerosol containers capable of defacing property from the list of products and services for which advertising and marketing restrictions apply; and (2) amends the definition of "operator" to remove three categories of health care-related entities, including covered entities under the federal Health Insurance Portability and Accountability Act, health care providers and health care facilities as defined in Washington's medical records statute, and programs and qualified service organizations under federal substance use disorder regulations.
(In support) This bill aims to make sure that our children are protected when they're online. Kids are online from a young age for education and entertainment purposes, and their digital literacy is essential to their success, but we need to guard against children becoming targets for the advertisement of harmful and age-inappropriate material. Children's data should not be used for refining the targeting for the advertisement of harmful products. Existing federal legislation, the Children's Online Privacy Protection Act (COPPA) was passed in 1998, and since then the ways kids use technology has changed exponentially. While COPPA largely applies to children under 13 years of age, this bill is directed at any minor under 18 years of age, codifying current best practices regarding ad-targeting and deletion rights. The draft is also modeled on a successful policy in effect in California that has had broad industry support for many years. A similar bill was introduced in 2019 and had broad bipartisan support, passing out of the House of Representatives by a vote of 96-1.
(Opposed) None.
(Other) It's questionable whether the current enforcement provisions are strong enough to promote deterrence and create meaningful accountability. Many companies do not adhere to these types of regulations because the fines are small and considered a cost of doing business.
Some businesses may need more time to review and confirm there are no operational compliance issues between these new requirements regulating persons under 18 years of age, and the existing federal law, Children's Online Privacy Protection Act (COPPA), which regulates persons under 13 years of age. This bill may also implicate industries and organizations like newspapers and similar media companies that maintain general interest websites that could attract children because of their content. More work needs to be done to determine how these types of companies are covered by these new requirements and whether some kind of safe harbor is appropriate.
The obligations around removing content may unintentionally create issues for hospitals and health care providers who must comply with federal privacy laws, including the Health Insurance Portability and Accountability Act. Hospitals and clinics often have actual knowledge that a minor is using their electronic health records system, and this bill would require hospitals to give minors notice and the ability to delete information the minor has communicated through the health records system, but generally speaking, medical records are not deleted and complete records must be kept. Consider removing "aerosol containers of paint" from the list of products subject to marketing and advertising restrictions, in light of the fact that many young people who participate in activities such as pinewood derby use this type of product.