COPPA crowdsourcing. Yeah, really.

We received an interesting suggestion recently. “With how fast technology changes, how about building in a process so companies can see if newer methods meet the requirements of existing rules?” A related recommendation: Crowdsourcing.

“The FTC could publicize an idea and get feedback from people.” We’re fans of innovation, too, which is why the Children’s Online Privacy Protection Rule includes a procedure for companies to ask if methods of getting parental consent not listed in COPPA nonetheless meet the Rule’s standards. As for crowdsourcing, we call it a notice and request for public comment — and we’ve been at it since the Truman Administration. The Federal Trade Commission’s approval of a verifiable parental consent method proposed by Imperium, LLC, illustrates how the agency builds these two ideas into the policy-making process. COPPA requires certain sites to get verifiable parental consent before collecting, using or disclosing personal information from kids under 13. The Rule lists some options for how to do that, but also opens the door for companies to request FTC approval for other ways to get Mom or Dad's OK. It makes sense, doesn’t it? Rather than setting out the process in stone, COPPA was crafted with the assumption that new methods could come along that merit a close look. Imperium recently proposed a parental consent method based on knowledge-based authentication. That’s a way to verify a user by asking challenge questions about "out-of-wallet" information — info that can’t be determined by looking through a person’s wallet and would be tough for someone else to answer correctly. The method may be new as far as COPPA is concerned, but financial institutions and credit bureaus have been using it for years. Now Santa Ana-based iVeriFly has asked the FTC to approve its suggested method of getting parental consent.

You’ll want to read the proposal for details, but here’s what the FTC is asking:

• Is iVeriFly’s proposed method already covered by existing methods in the Rule?
• Does it meet the Rule’s requirement that it’s reasonably calculated to ensure the person giving consent is actually the kid’s parent?
• When it comes to consumers’ information, what are the risks and benefits of the proposal?

[Dec 23]