Enforcement Policy Statement Regarding the Applicability of the COPPA Rule to the Collection and Use of Voice Recordings, 58076-58077 [2017-26509]
Download as PDF
58076
Federal Register / Vol. 82, No. 235 / Friday, December 8, 2017 / Rules and Regulations
FEDERAL TRADE COMMISSION
16 CFR Part 312
Enforcement Policy Statement
Regarding the Applicability of the
COPPA Rule to the Collection and Use
of Voice Recordings
Federal Trade Commission.
Commission policy statement.
AGENCY:
ACTION:
The Federal Trade
Commission has issued an Enforcement
Policy Statement regarding the
applicability of the Children’s Online
Privacy Protection Act (‘‘COPPA’’) Rule
to the collection of voice recordings.
The Statement describes certain
circumstances in which the Commission
will not bring an enforcement action
against an operator on the basis of the
operator having collected an audio file
containing a child’s voice without first
obtaining verifiable parental consent.
DATES: The Commission announced the
issuance of the Statement on October
23, 2017.
FOR FURTHER INFORMATION CONTACT:
Kristin Cohen (202–326–2276) and
Peder Magee (202–326–3538), Bureau of
Consumer Protection, 600 Pennsylvania
Avenue NW., Washington, DC 20580.
SUPPLEMENTARY INFORMATION:
sradovich on DSK3GMQ082PROD with RULES3
SUMMARY:
Enforcement Policy Statement
Regarding the Applicability of the
COPPA Rule to the Collection and Use
of Voice Recordings
On November 3, 1999, the Federal
Trade Commission (‘‘FTC’’ or
‘‘Commission’’) issued its Children’s
Online Privacy Protection Rule
(‘‘COPPA Rule’’ or ‘‘Rule’’). The Rule
implements the Children’s Online
Privacy Protection Act, 15 U.S.C. 6501–
6505, and requires, among other things,
operators of commercial Web sites or
online services directed to children, and
operators with actual knowledge they
are collecting personal information from
children, to provide notice of their
information practices to parents and to
obtain verifiable parental consent before
collecting a child’s personal
information. The Rule defined
‘‘personal information’’ to include data
such as name, address, and social
security number.
In 2013, the FTC amended the COPPA
Rule and added several new types of
data to the definition of personal
information, including a photograph,
video, or audio file that contains a
child’s image or voice.1 Discussing the
1 The prior definition included photographs only
when combined with additional information that
would allow physical or online contacting of the
child.
VerDate Sep<11>2014
20:58 Dec 07, 2017
Jkt 244001
2013 amendments, the Commission
explained that ‘‘the very personal
nature’’ of such files supported the
Commission’s finding that they met the
standard for personal information set
forth in the COPPA statute because they
‘‘permit the physical or online
contacting of a specific individual.’’ 78
FR 3972, 3982 (Jan. 17, 2013). Therefore,
under the amended Rule, a covered
operator must provide notice and obtain
verifiable parental consent before it
collects any of these types of personal
information from a child. The
Commission’s rationale in amending the
Rule was to keep pace with changes to
technology, children’s increased use of
mobile devices, and the development of
new business models that did not exist
when the Commission issued the Rule
in 1999.
Since amending the Rule, the
Commission has received inquiries from
a number of companies about whether
the practice of collecting audio files that
contain a child’s voice, immediately
converting the audio to text, and
deleting the file containing the voice
recording triggers COPPA’s
requirements. In particular, these
companies have requested that
collection of audio files in connection
with a search or similar function be
exempted from COPPA’s verifiable
parental consent requirement when the
audio file is briefly maintained in order
to fulfill the request and then deleted
almost instantaneously.
In relevant part, the Rule defines
‘‘collects or collection’’ to mean the
gathering of any personal information
from a child by any means, including
but not limited to:
• Requesting, prompting, or
encouraging a child to submit personal
information online;
• Enabling a child to make personal
information publicly available in
identifiable form. An operator shall not
be considered to have collected personal
information under this paragraph if it
takes reasonable steps to delete all or
virtually all personal information from a
child’s postings before they are made
public and also to delete such
information from its records.2
The Commission views the collection
from a child of an audio file when the
voice is being used solely as a
replacement for written words, such as
to convert voice to text in order to
perform a search, as falling into the first
prong of the definition of ‘‘collection’’
because the operator is ‘‘requesting,
prompting, or encouraging’’ the child to
2 The third prong of the definition relates to
passive tracking of a child online and is not
relevant to this discussion.
PO 00000
Frm 00002
Fmt 4701
Sfmt 4700
submit personal information. Because
this practice falls into the first category
of ‘‘collection,’’ the Rule does not
provide a mechanism for the operator to
avoid being deemed to have collected
the personal information by deleting it.
In other words, as soon as the operator
gathers the audio file, it has collected it
for purposes of the COPPA Rule
regardless of how long the operator
maintains possession of it. The second
prong of the definition is meant to
address the inadvertent collection of
personal information, such as
information that might be collected
incidentally in an open text field, which
is why the Rule specifically allows an
operator to be deemed not to have
collected the personal information if it
takes reasonable measures to delete the
information.
Nevertheless, the Commission
recognizes the value of using voice as a
replacement for written words in
performing search and other functions
on internet-connected devices. Verbal
commands may be a necessity for
certain consumers, including children
who have not yet learned to write, or the
disabled. In addition, when the operator
only uses the audio file as a replacement
for written words, such as to effectuate
an instruction or request, and only
maintains the file long enough to
complete that purpose and then
immediately deletes it, there is little risk
the audio file will be used to contact an
individual child.
As such, when a covered operator
collects an audio file containing a
child’s voice solely as a replacement for
written words, such as to perform a
search or fulfill a verbal instruction or
request, but only maintains the file for
the brief time necessary for that
purpose, the FTC would not take an
enforcement action against the operator
on the basis that the operator collected
the audio file without first obtaining
verifiable parental consent. Such an
operator, however, must provide the
notice required by the COPPA Rule,
including clear notice of its collection
and use of audio files and its deletion
policy, in its privacy policy.
There are important limitations on
this non-enforcement policy. First, this
non-enforcement policy is not
applicable when the operator requests
information via voice that otherwise
would be considered personal
information under the Rule, such as
name, for example. Second, as noted
above, an operator must provide clear
notice of its collection and use of the
audio files and its deletion policy in its
privacy policy. Otherwise, parents may
have no way to know prior to download
or purchase whether audio files are
E:\FR\FM\08DER3.SGM
08DER3
Federal Register / Vol. 82, No. 235 / Friday, December 8, 2017 / Rules and Regulations
sradovich on DSK3GMQ082PROD with RULES3
being collected, and if they later learn
that audio files are being collected, they
would have no reason to know that the
files are being collected only for a
limited purpose and immediately
destroyed. Third, the operator may not
make any other use of the audio file in
the brief period before the file is
destroyed—for example, for behavioral
VerDate Sep<11>2014
20:58 Dec 07, 2017
Jkt 244001
targeting or profiling purposes, for
identification purposes through voice
recognition, or for posting, selling, or
otherwise sharing the file with third
parties. Finally, this policy does not
affect the operator’s COPPA compliance
requirements in any other respect. For
example, the operator must provide
notice and obtain verifiable parental
PO 00000
Frm 00003
Fmt 4701
Sfmt 9990
58077
consent if types of personal information
other than audio files are also collected.
By direction of the Commission.
Donald S. Clark,
Secretary.
[FR Doc. 2017–26509 Filed 12–7–17; 8:45 am]
BILLING CODE 6750–01–P
E:\FR\FM\08DER3.SGM
08DER3
Agencies
[Federal Register Volume 82, Number 235 (Friday, December 8, 2017)]
[Rules and Regulations]
[Pages 58076-58077]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2017-26509]
[[Page 58075]]
Vol. 82
Friday,
No. 235
December 8, 2017
Part III
Federal Trade Commission
-----------------------------------------------------------------------
16 CFR Part 312
Enforcement Policy Statement Regarding the Applicability of the COPPA
Rule to the Collection and Use of Voice Recordings; Policy Statement;
Rule
Federal Register / Vol. 82, No. 235 / Friday, December 8, 2017 /
Rules and Regulations
[[Page 58076]]
-----------------------------------------------------------------------
FEDERAL TRADE COMMISSION
16 CFR Part 312
Enforcement Policy Statement Regarding the Applicability of the
COPPA Rule to the Collection and Use of Voice Recordings
AGENCY: Federal Trade Commission.
ACTION: Commission policy statement.
-----------------------------------------------------------------------
SUMMARY: The Federal Trade Commission has issued an Enforcement Policy
Statement regarding the applicability of the Children's Online Privacy
Protection Act (``COPPA'') Rule to the collection of voice recordings.
The Statement describes certain circumstances in which the Commission
will not bring an enforcement action against an operator on the basis
of the operator having collected an audio file containing a child's
voice without first obtaining verifiable parental consent.
DATES: The Commission announced the issuance of the Statement on
October 23, 2017.
FOR FURTHER INFORMATION CONTACT: Kristin Cohen (202-326-2276) and Peder
Magee (202-326-3538), Bureau of Consumer Protection, 600 Pennsylvania
Avenue NW., Washington, DC 20580.
SUPPLEMENTARY INFORMATION:
Enforcement Policy Statement Regarding the Applicability of the COPPA
Rule to the Collection and Use of Voice Recordings
On November 3, 1999, the Federal Trade Commission (``FTC'' or
``Commission'') issued its Children's Online Privacy Protection Rule
(``COPPA Rule'' or ``Rule''). The Rule implements the Children's Online
Privacy Protection Act, 15 U.S.C. 6501-6505, and requires, among other
things, operators of commercial Web sites or online services directed
to children, and operators with actual knowledge they are collecting
personal information from children, to provide notice of their
information practices to parents and to obtain verifiable parental
consent before collecting a child's personal information. The Rule
defined ``personal information'' to include data such as name, address,
and social security number.
In 2013, the FTC amended the COPPA Rule and added several new types
of data to the definition of personal information, including a
photograph, video, or audio file that contains a child's image or
voice.\1\ Discussing the 2013 amendments, the Commission explained that
``the very personal nature'' of such files supported the Commission's
finding that they met the standard for personal information set forth
in the COPPA statute because they ``permit the physical or online
contacting of a specific individual.'' 78 FR 3972, 3982 (Jan. 17,
2013). Therefore, under the amended Rule, a covered operator must
provide notice and obtain verifiable parental consent before it
collects any of these types of personal information from a child. The
Commission's rationale in amending the Rule was to keep pace with
changes to technology, children's increased use of mobile devices, and
the development of new business models that did not exist when the
Commission issued the Rule in 1999.
---------------------------------------------------------------------------
\1\ The prior definition included photographs only when combined
with additional information that would allow physical or online
contacting of the child.
---------------------------------------------------------------------------
Since amending the Rule, the Commission has received inquiries from
a number of companies about whether the practice of collecting audio
files that contain a child's voice, immediately converting the audio to
text, and deleting the file containing the voice recording triggers
COPPA's requirements. In particular, these companies have requested
that collection of audio files in connection with a search or similar
function be exempted from COPPA's verifiable parental consent
requirement when the audio file is briefly maintained in order to
fulfill the request and then deleted almost instantaneously.
In relevant part, the Rule defines ``collects or collection'' to
mean the gathering of any personal information from a child by any
means, including but not limited to:
Requesting, prompting, or encouraging a child to submit
personal information online;
Enabling a child to make personal information publicly
available in identifiable form. An operator shall not be considered to
have collected personal information under this paragraph if it takes
reasonable steps to delete all or virtually all personal information
from a child's postings before they are made public and also to delete
such information from its records.\2\
---------------------------------------------------------------------------
\2\ The third prong of the definition relates to passive
tracking of a child online and is not relevant to this discussion.
---------------------------------------------------------------------------
The Commission views the collection from a child of an audio file
when the voice is being used solely as a replacement for written words,
such as to convert voice to text in order to perform a search, as
falling into the first prong of the definition of ``collection''
because the operator is ``requesting, prompting, or encouraging'' the
child to submit personal information. Because this practice falls into
the first category of ``collection,'' the Rule does not provide a
mechanism for the operator to avoid being deemed to have collected the
personal information by deleting it. In other words, as soon as the
operator gathers the audio file, it has collected it for purposes of
the COPPA Rule regardless of how long the operator maintains possession
of it. The second prong of the definition is meant to address the
inadvertent collection of personal information, such as information
that might be collected incidentally in an open text field, which is
why the Rule specifically allows an operator to be deemed not to have
collected the personal information if it takes reasonable measures to
delete the information.
Nevertheless, the Commission recognizes the value of using voice as
a replacement for written words in performing search and other
functions on internet-connected devices. Verbal commands may be a
necessity for certain consumers, including children who have not yet
learned to write, or the disabled. In addition, when the operator only
uses the audio file as a replacement for written words, such as to
effectuate an instruction or request, and only maintains the file long
enough to complete that purpose and then immediately deletes it, there
is little risk the audio file will be used to contact an individual
child.
As such, when a covered operator collects an audio file containing
a child's voice solely as a replacement for written words, such as to
perform a search or fulfill a verbal instruction or request, but only
maintains the file for the brief time necessary for that purpose, the
FTC would not take an enforcement action against the operator on the
basis that the operator collected the audio file without first
obtaining verifiable parental consent. Such an operator, however, must
provide the notice required by the COPPA Rule, including clear notice
of its collection and use of audio files and its deletion policy, in
its privacy policy.
There are important limitations on this non-enforcement policy.
First, this non-enforcement policy is not applicable when the operator
requests information via voice that otherwise would be considered
personal information under the Rule, such as name, for example. Second,
as noted above, an operator must provide clear notice of its collection
and use of the audio files and its deletion policy in its privacy
policy. Otherwise, parents may have no way to know prior to download or
purchase whether audio files are
[[Page 58077]]
being collected, and if they later learn that audio files are being
collected, they would have no reason to know that the files are being
collected only for a limited purpose and immediately destroyed. Third,
the operator may not make any other use of the audio file in the brief
period before the file is destroyed--for example, for behavioral
targeting or profiling purposes, for identification purposes through
voice recognition, or for posting, selling, or otherwise sharing the
file with third parties. Finally, this policy does not affect the
operator's COPPA compliance requirements in any other respect. For
example, the operator must provide notice and obtain verifiable
parental consent if types of personal information other than audio
files are also collected.
By direction of the Commission.
Donald S. Clark,
Secretary.
[FR Doc. 2017-26509 Filed 12-7-17; 8:45 am]
BILLING CODE 6750-01-P