My name is emma morris, and im the Global Policy director. I would like to start by thanking congressman cardenas and his staff for securing the room for us for having this important discussion today. Briefly, by way of background for those not familiar with the safety institute, were an International Nonprofit organization looking to make the online world safer for kids and their families. We are pleased to host the panel today to discuss one of the most important issues facing families and kids privacy on the internet. In the united states, the collection and processing of childrens data has primarily been regulated by the childrens Online Privacy protection act for over 20 years. This law long preceded facebook, snapchat, youtube and hello barbie. Weve seen numerous legislative proposals to change the way childrens information is regulated and at the beginning of the summer, the federal trade Commission Published a request for public comment. With all of this activity in mind, it released a white paper entitled revisiting copper which you should have received today and you can download on our website. We believe that limiting the Data Collected from children and preventing Online Marketing to those under 13 absent verifiable parental consent are admiral aames of copper. However, we are cognizant of the need that Small Businesses especially are able to comply with the law and it was creatingcreating engaging content for children. We want to protect the information rather than to ignore their data and the use of their services. With that in mind, i will hand over to steven bolcom who will moderate the panel today. Great. Thank you very much, emma and thank you to the team led by emma morris to put all of this together, fantastic and in such a short period of time in the summer and thank you for that. As it is pretty obvious, cspan is here and when questions come around just be aware that you could well be taken up on broadcast tv. So, yes, founder and ceo with the family Online Safety institute. I will be moderating the panel, and we are hash tagging it fosi briefs the hill. Y know its not a hash tag, but it is a good hash tag, please use it. This video that cspan is doing right now will be archived at cspan and well also provide a link. I will ask this esteemed panel to introduce themselves and starting with you, mark. If you could tell us who you are, where you work and a tweetlength description of your work in this space . Okay. Im mark icorn and assistant director at the Privacy Division in the ftc and ive been in that job for about ten years, and what the ftc does is protect Consumer Privacy and we enforce kappa, and we do policy work around kappa. So like a couple of years ago we held a work shop on Educational Technology issues and we were working a kappa work shop this october. Thank you very much. Hi, everyone. Stephen, thank you for having me. My name is john falzone and i work at the entertainment board where i run the privacy Certified Program which is an ftcapproved capa Safe Harbor Program and i work with companies primarily in the entertainment and toy spaces to ensure that theyre complying with the law and the regulations and generally doing right by their consumers. Joseph wender, Senior Adviser to senator ed markey. Ed markey when he was Congress Person in the late 1990s was the author of capa and we have been active in the last 20 years since then on pushing all sorts of kids privacy and advancement issues and most recently introduced capa 2. 0 bill which i am sure ill be discussing during this panel. And i am jim hal pert, and i cochair the Global Policy and cybersecurity practices at dla piper, and back in 1998 as a senior associate i helped negotiate and draft some of the language that ed markey wound up sponsoring with conrad burns and Richard Brian that became the capa law and was there at the creation and i think filed seven sets of comments in the 2000 rule making, and so i was there at the creation and helped to provide some context over time regarding capa. Thank you all. Its quite a breadth of experience both past and present and no doubt, well into the future because this issue is not going to go away. Mark, what has let the ftc lot capa rule. Before i answer that. Ill say im speak for myself and not for the commission or for the commissioners. Oh, come on, not all five commissioners. I speak for one of them and im not going say who. [ laughter ] so i am we do this regulatory review process of all our rules and guides every ten years typically, and that is on a routine schedule and with capa, we revised the rule in 2013 pretty substantially to add categories of personal information that werent really collected when the rule was first implemented or when the statute was first passed and sort of to expand the rule in other ways to, you know, cover persistent identifiers and third parties that are collecting information from sites when they have actual knowledge that theyre directed to kids. So, you know, we hear about capa a lot and there are a number of statutes that we enforce and theres a lot more just sort of discussion and talk about capa than many of the others and theres also, theres been a lot of changing technologies. For example, i mentioned the ed tech work shop that we held at the time that the statute was passed and there was no mention in the statute whatsoever of schools, and it sort of raised this issue of, well, if somebodys using, you know, an Online Service context can the parent excuse me, can the teacher provide consent or not. Those kinds of issues. So weve sort of addressed those and the statement of aces and purpose for the rule, but weve never really addressed them more directly in the rule itself and when we held the work shop a couple of years ago on these issues its clear that this industry is really accelerating. There is a huge amount going on there, and we thought about sort of making sure that we address that issue properly and getting public ideas on how to do that, and ill to highlight one more issue or one more change. Obviously uses voice assistance and when the Commission Revised the rule in 2013, we had the coverage of audio collected from a kid so that raises questions about well, if you have a Voice Assistant that, you know, is directed to kids for some reason and youre basically just using it to do voiceactivated search essentially then we realize that would raise issues. So we issued a discretionary enforcement policy that basically says if you use it for something quick like that and you just immediately delete it, were not going to be bringing a case involving that. So thats another issue where you know, get the publics input and how to address that and also are there other issues about Voice Assistant and are there other issues with smart tvs and that kind of thing that we want to address. And talk a little bit about the process. Were coming up to the end of august. What happens next . When are you guys going to actually deliver your thoughts on this . Right, it will aub while because theyre not due until no noef peard and we have the work shop october 7th and well get a lot of input there, as well and once we get those comments well sit down and, you know, go through what we got and review the input and figure out where to go from there and just to make clear what this is and theres a process for a rule making where we put out particular, you know, basically regulatory language that we propose. This is one step before that. Were still sort of at the information gathering phase so one thing that could come out of this is the next step that could end up making a regulatory propepr proposal based on what we hear. Okay. How are you currently working with companies that create content . Just taking a step back from the looking at capa. How are you currently working with everyone from the disneys to the mom and pop shops creating an educational app, for instance . . Well, one of the things we do is we have a capa hotline where companies can reach out to us and sort of pose an issue to us or ask a question about the rule we see this as trying to facilitate compliance with the rule as opposed to catching someone in violation so thats one avenue. We also have consumer and education put out and the faqs on capa where we make the rules as clear as possible and those are some of the ways that we do that. Okay. John, for those of us who are not familiar with safe harbors or the esrb, lets do a little bit of a level set. What is a safe harbor . Sure. So first of all, safe harbors were created as part of the legislation that was passed been the safe harbor regime is intended to be independent provide independent oversight and enforcement of the act, but on a selfregulatory basis. In other words, its not mandatory for any company to be a part of a safe harbor. Companies choose whether or not they want to work with Safe Harbor Programs. The erbs is one of the oldest safe harbors, but there are seven companies that provide Safe Harbor Services and so the companies that work with us have chosen to become parts of our program. They pay depending on the program some sort of fee for our services and then our job is to make sure that those companies are first and foremost, complying with capa and the amended capa rule and the guidance that the ftc puts out. Many of our programs go beyond capa and from the safe harbor standpoint thats the primary objective. So every day, my team is in websites and in apps that our members are putting out and theyre looking through them just as any user would, doing the user experience. Theyre doing back end scans to see whats happening on the back end that the user can see, making sure that one, the practices of that member are in line with what capa requires and two, that the policies that theyve put out, in other words, the disclosures that theyre making are reflecting those practices and accurate to their consumers. Talk a little bit about how you guys promote the creation of content for kids particularly the under 13 market when has bedevilled a lot of creators. Talk about that. Its an incredibly difficult market. To be frank, most of our members dont really get into that market. The majority of their websites. Why is that, john . Because its difficult to monetize and stay compliant with the law. So we are lucky that some of the companies we work with have strategies for monetization that go beyond, you know, advertising and apps or inapp purchases and those are the some of our members especially in the toy industry its not fessly abonec about that for them because theyre looking for brands that keep kids engaged and it is a difficult market to be in and to make money in, but it it is one where it you have the right long term view, you can be very successful in it. So our job is we start working with our members as early as we can in the process. If they have something that is under 13 and in a true sense or is going to be hitting someone in a significant way and maybe directed to an older audience. We start working with them as early as we can in the Development Process to start flagging issues that might be coming. Look, the companies that work with us. They know what capa is, right . And theyre trying to do the right thing by working with us, but they dont always necessarily know what that right thing is, and then youve got companies that are just coming to us when theyve when theyve Just Launched or are planning to launch something and those Companies Often think that they know everything and theyre compliant with everything and it can be complicated and so theres a lot of issues that you have to work through. You can work through pem. One the of the complicated issues you have when talking about actual versus constructive knowledge. For the uninitiated what is this, between consensual and the knowledge. Capa is triggered when the Online Service is directed to children under 13 years old or the operator of the Online Service has actual knowledge that the user is under 13 years old. So thats capa in its current state and the way that it works. Actual knowledge is what it sounds like from the legal standpoint and the company has to actually know that that user is under 13 years old. The most typical way that a company would know that is that the user has identified as under 13 years old. A lot of websites or apps con take a registered process and so a user may identify as under 13. Weve all seen those popups that come up, right . A user might identify as under 13 and then automatically at that point capa is triggered, regardless of what the site is. It could be a that could be a site that is intended for parents, but if they collect the users age, then capa would be triggered in that circumstance. Constructive knowledge would be a situation where the operator should have known that the user was under 13 from a legal standpoint, so that could be based off of any number of factors of information that they might have available to them. It sort of broadens the scope, as you can imagine. Thank you. Joseph, what was your reaction and even as important, your boss reaction to the ftcs announcement in july that capa would be reviewed much earlier than had been expected . Sure. Our reaction was cautious optimism. He was very supportive when the rules were reviewed back in 2013, and he clearly sees that the landscape has changed in the six years preceding and things like biometric and things like genetics and Voice Assistant and all of the things that mark discussed. It is clear theyre much more prevalent in the ecosystem today and that the commission should be taking a look at that, so thats good. I say cautious optimism because we dont know what the outcome will be. If in the end the rules are strengthened thats a really good thing, but you always have to be wary of potential bad players or others coming in and attempting to weaken the rules. So until we see what the final product of the process is i dont want to i cant say if were going to be happy or sad, but i dont want to prejudge the process because its good that theyre certainly starting in it. I had the priviledge of testifying to the Senate Judiciary only a month or so ago on the topic of protecting innocents in a Digital World and the hearing the ftc came under a barrage of criticisms and presumably you watched that and do you share that criticism or to put it in a more positive space, what more could the ftc do in this space . I think particularly in the kids privacy space the jury is still out because as Everybody Knows in this room, there is a case pending about or pending about youtube, and whether they violated and what the fine is going to be and what the continuing or new obligations are going to be placed on google and that settlement and agreement has not yet been released and its not yet been announced. So i think what they do in that particular case will be indicative of the position the commission is taking with regards to how serious they are about enforcing capa, so i dont want to i dont want to say yet. Well see what they do. Im sure, you can talk about senator markeys own proposals which politico mentioned three of them this morning. Were busy. Off you go. In sweetlength descriptions. The trifecta of bills if you approximately,y and wanted to what that bill would be able to do, in short, is to be consistent with both california and gdpr, to create and smell out your acronym gdpr. You spell it out. No. The Data Protection information. Thank you, jim. What it would do is create as Everybody Knows kappa is only 12 and under and senator markey like many others believe that 13, 14, 15yearolds need special special protection, necessarily, but it would extend the bill for 13, 14 and 15yearolds and it would change the standard from actual to constructive. It would ban targeted ads for kids and it does create an eraser button consist went the law in california that allows parents and children to erase information that they themselves have posted so as to not violate the first amendment. The other two bills are the camera act which is the children immediate Research Advancement act which is directing nih to do a fiveyear study on the impact of technology on children. I mean, its obvious that things are totally glued to these things now. So what is the socioor the cognitive impact of this incredible increase in technology has been introduce the about. That bill is soaking to, to address the practices by many websites to glo websites to and the other functions to sort of suck kids in and ensure that they stop watching. I have a 3yearold. It works very well on him and he will not stop watching the device unless i rip it out of his hand and that bill which well be introducing some time in september or october will address what we do about that issue. In our experience, parents are equally glued to these. Oh, its a problem. This room is pretty well, its doing pretty well and ive been looking around independent is a testament of how good this panel is. There arent that many people on the phone right now. We do want you to tweet from time to time. Mostly your attention up here, please. Last question at this point. So do you think capa should be modified or are we looking for a total rewrite of the law . Modification. So youre not going to throw capa out . No. We think as was evidenced in the capa 2. 0 bill, were seeking changes and mod if i cautions to the, and we are not looking for a complete rerite of capa. As evidence the starting with my boss bill it could be improved upon because the bill looks differently than it did when it was passed in 1988. This is a perfect segue to you. When we were all much younger, 20 years ago, how has the world changed, would you say . Well, 20 years ago i had a 1yearold child who is now just driving up this afternoon to enter his senior year of colleg