ICE Briefly Becomes A Stranded Minor: Loses Its Twitter Account For Being Too Young

from the yeah,-but-only-briefly dept

Yesterday afternoon the Twitter account of the US's Immigrations and Customs Enforcement (ICE) briefly disappeared from the internet. Was it... anti-conservative bias? Nope. Was it ICE doing more stupid shit in locking up children and separating them from their parents? Nope. Was it ICE's willingness to seize domain names with no evidence, claiming "counterfeit"? Nope. It was that ICE had changed the "birthday" on its account to make it so that its "age" was less than 13. Thanks to the ridiculousness of the Child Online Privacy Protection Act (COPPA), which has basically served only to have parents teach their kids it's okay to lie online in order to use any internet service, most websites say you can't use the service if you're under 13 years old. ICE changed its "birthdate" to be less than 13, thereby making it... shall we say, something of a "stranded minor" and Twitter automatically, well, "separated it" from its account.

Might be nice for ICE to get a sense of how that feels.

Of course, what this really highlights is the idiocy of COPPA and how nearly every website tries to deal with its requirements. As we noted, Twitter, like many internet sites outright bars kids under 13 to avoid COPPA's rules. Twitter does note in its forms that you need to put in your own date of birth, even if your account is "for your business, event, or even your cat."

But... that's bizarre. For accounts like this, whose birthday matters? Many such accounts are managed by multiple people. Whose birthday gets put in there? The answer is, of course, that a birthday is just made up. And, if you make it up, apparently you need to make up one that is older than 13 to avoid this COPPA-based "separation."

Anyway, ICE figured stuff out and made a little joke about it:

Frankly, I'd rather they focused on actually helping asylum seekers find protection in our country rather than tossing them out, and maybe put some of that effort into reuniting the 666 kids back to the families they've lost track of.

Filed Under: age restrictions, birthday, coppa, ice
Companies: twitter

Bad Ideas: Raising The Arbitrary Age Of Internet Service 'Consent' To 16

from the want-to-piss-off-high-schoolers? dept

We all know various ideas for "protecting privacy online" are floating around Congress, but must all of them be so incredibly bad? Nearly all of them assume a world that doesn't exist. Nearly all of them assume an understanding of "privacy" that is not accurate. The latest dumb idea is to expand COPPA -- the Children's Online Privacy Protection Act -- that was put in place two decades ago and has been a complete joke. COPPA's sole success is in getting everyone to think that anyone under the age of 13 isn't supposed to be online. COPPA's backers have admitted that they used no data in creating and have done no research into the effectiveness of the law. Indeed, actual studies have shown that COPPA's real impact is in having parents teach their kids its okay to lie about their age online in order to access the kinds of useful services they want to use.

The "age of consent" within COPPA is 13 -- and that's why a bunch of sites claim you shouldn't use their site if you're under that age. Because if a site is targeting people under that age, then it has to go through extensive COPPA compliance, which most sites don't want to do. The end result: sites say "don't sign up if you're under 13" and then lots of parents (and kids) lie about ages in order to let kids access those sites. It doesn't actually protect anyone's privacy.

So... along comes Congress and they decide the way to better protect privacy online is to raise that "age of consent" to 16.

The "Preventing Real Online Threats Endangering Children Today Act" is sponsored by Republican Rep. Tim Walberg of Michigan and Democratic Rep. Bobby Rush of Illinois.

The legislation would also require parental consent before companies can collect personal data like names, addresses and selfies from children under 16 years old. That's up from 13 years old under the 1998 Children's Online Privacy Protection Act.

Because we all know that teenagers are always truthful online and, dang, are they going to totally love the idea that they need their parents' permission to use 99% of the internet. That's really going to solve the problems now, right?

Of course not. It's just going to teach more kids to lie about their birth dates when they sign up for internet accounts. Or, alternatively, it will overly punish the few honest kids who refuse to sign up for accounts until they're 16. But, hey, why should Congress care about that when they're "protecting the children."

Filed Under: bobby rush, congress, coppa, internet, kids, lying, privacy, tim walberg

FTC's Latest Fine Of YouTube Over COPPA Violations Shows That COPPA And Section 230 Are On A Collision Course

from the this-could-be-an-issue dept

As you probably heard, earlier this week, the FCC fined Google/YouTube for alleged COPPA violations in regards to how it collected data on kids. You can read the details of the complaint and proposed settlement (which still needs to be approved by a judge, but that's mostly a formality). For the most part, people responded to this in the same way that they responded to the FTC's big Facebook fine. Basically everyone hates it -- though for potentially different reasons. Most people hate it because they think it's a slap on the wrist, won't stop such practices and just isn't painful enough for YouTube to care. On the flip side, some people hate it because it will force YouTube to change its offerings for no good reason at all and in a manner that might actually lead to more privacy risks and less content for children.

They might all be right. As I wrote about the Facebook fine and other issues related to privacy, almost every attempt to regulate privacy tends to make things worse, in part, because people keep misunderstanding how privacy works. Also, most of the "complaints" about how this "isn't enough," are really not complaints directed at the FTC, but at Congress, because the FTC can only do so much under its current mandate.

Separately, since this fine focused on COPPA violations, I'll separately note that COPPA has always been a ridiculous law that makes no real sense -- beyond letting politicians and bureaucrats pretend they're "protecting the children" -- while really creating massive unintended consequences that do nothing to protect children or privacy, and do quite a bit to make the internet a worse place.

But... I'm not even going to rehash all of that today. Feel free to dig into the past links yourselves. What's interesting to me is something specific to this settlement, as noted by former FCC and Senate staffer (and current Princeton professor), Jonathan Mayer: the FTC, in this decision, appears to have significantly changed its interpretation of COPPA, and done so in a manner that is going to set up something of a clash with Section 230. What happened is a little bit subtle, so it requires some background.

The key feature of COPPA -- and the one you're probably aware of whether or not you know it -- is that it has specific rules if a site is targeting children under the age of 13. This is why tons of sites say that you need to be over 13 to use them (including us) -- in an attempt to avoid dealing with many of the more insane parts of COPPA compliance. Of course, in practice, this just means that many people lie. Indeed, as danah boyd famously wrote nearly a decade ago, COPPA seems to be training parents to help their kids lie online -- which is kinda dumb.

Of course, the key point under COPPA is not actually the "under 13" users, but rather whether or not a website or online service is "directed to children under 13 years of age." Indeed, in talking about it with various lawyers, we've been told that most sites (including our own) shouldn't even worry about COPPA because it's obvious that such sites aren't "directed to children" as a whole and therefore even if a few kids sneak in, they still wouldn't be violating COPPA. In other words, the way the world has mostly interpreted COPPA is that it's not about how whether any particular piece or pieces of content are aimed at children -- but whether the larger site itself is aimed at children.

This new FTC settlement agreement changes that.

Basically, the FTC has decided that, under COPPA, it no longer needs to view the service as a whole, but can divide it up into discrete chunks, and determine if any of those chunks are targeted at kids. To be fair, this is well within the law. The text of COPPA clearly says in definitional section (10)(A)(ii) that "a website or online service directed to children" includes "that portion of a commercial website or online service that is targeted to children." It's just that, historically, most of the focus has been on the overall website -- or something that is more distinctly a "portion" rather than an individual user's channel.

Except, that under the law, it seems that it should be the channel operator who is held liable for violations of COPPA under that channel, rather than the larger platform. In fact, back in 2013, the last time the FTC announced rules around COPPA it appears to have explicitly stated, that it would apply COPPA to the specific content provider who was directed at children and not at the general platform they used. This text is directly from that FTC rule, which went through years of public review and comment before being agreed upon:

... the Commission never intended the language describing ‘‘on whose behalf’’ to encompass platforms, such as Google Play or the App Store, when such stores merely offer the public access to someone else’s child-directed content. In these instances, the Commission meant the language to cover only those entities that designed and controlled the content...

But that's not what the FTC is doing here. And so it appears that the FTC is changing the definition of things, but without the required comment and rulemaking process. Here, the FTC admits that channels are "operators" but then does a bit of a two-step to say that it's YouTube who is liable.

YouTube hosts numerous channels that are “directed to children” under the COPPA Rule. Pursuant to Section 312.2 of the COPPA Rule, the determination of whether a website or online service is directed to children depends on factors such as the subject matter, visual content, language, and use of animated characters or child-oriented activities and incentives. An assessment of these factors demonstrates that numerous channels on YouTube have content directed to children under the age of 13, including those described below in Paragraphs 29-40. Many of these channels self-identify as being for children as they specifically state, for example in the “About” section of their YouTube channel webpage or in communications with Defendants, that they are intended for children. In addition, many of the channels include other indicia of child-directed content, such as the use of animated characters and/or depictions of children playing with toys and engaging in other child-oriented activities. Moreover, Defendants’ automated system selected content from each of the channels described in Paragraphs 29-40 to appear in YouTube Kids, and in many cases, Defendants manually curated content from these channels to feature on the YouTube Kids home canvas.

Indeed, part of the evidence that the FTC relies on is the fact that YouTube "rates" certain channels for kids.

In addition to marketing YouTube as a top destination for kids, Defendants have a content rating system that categorizes content into age groups and includes categories for children under 13 years old. In order to align with content policies for advertising, Defendants rate all videos uploaded to YouTube, as well as the channels as a whole. Defendants assign each channel and video a rating of Y (generally intended for ages 0-7); G (intended for any age); PG (generally intended for ages 10+); Teen (generally intended for ages 13+); MA (generally intended for ages 16+); and X (generally intended for ages 18+). Defendants assign these ratings through both automated and manual review. Previously, Defendants also used a classification for certain videos shown on YouTube as “Made for Kids.”

That's a key point that the FTC uses to argue that YouTube knows that its site is "directed at" children. But here's the problem with that. Section 230 of the Communications Decency Act, specifically the often forgotten (or ignored) (c)(2) is explicit that no provider shall be held liable for any moderation actions, including "any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable." One way to do that is... through content labeling policies, such as those that YouTube used and described by the FTC.

So here, YouTube is being found partially liable because of its content ratings, which is being shown as evidence that it's covered by COPPA. But, CDA 230 makes it clear that there can't be any such liability from such a rating system.

This won't get challenged in court (here) since Google/YouTube have agreed to settle, but it certainly does present a big potential future battle. And, frankly, given the way that some courts have been willing to twist and bend CDA 230 lately, combined with the general "for the children!" rhetoric, I have very little confidence that CDA 230 would win.

Filed Under: cda 230, coppa, ftc, moderation, privacy, section 230
Companies: google, youtube

Newly Revealed Documents Show Facebook Gleefully Refusing To Refund Money To Kids Who Ran Up Huge Bills On Mommy's Credit Card

from the coppa-coppa-coppa dept

Because Facebook wasn't looking awful enough already, some newly unsealed documents from a lawsuit going back a few years are now making the company look even worse, and certainly not doing the company any favors in its efforts to rehabilitate its reputation. Unfortunately, so far, Reveal, a project of the Center for Investigative Reporting, seems to only be revealing snippets of what's in the documents, rather than the full documents (come on guys...), but what they're sharing doesn't look great.

Specifically, a judge has unsealed previously sealed records from a 2012 class action lawsuit that was settled in 2016, concerning Facebook profiting off of children. The origins of the lawsuit involved a child who got his mother's credit card to play a game on Facebook, without realizing that the more he played, the more of his mother's money he was spending -- compounded by Facebook then refusing to refund the charges. The latest revelations show that Facebook employees knew that they made this information confusing, in a way that people (kids and adults alike) might not realize they were still spending money off of a credit card, and also having joking conversations about people trying to get their money back. Indeed, the snippet Reveal has released has Facebook employees referring to one teenager as "a whale" -- a term used in casinos to refer to big spenders.

In one of the unsealed documents, two Facebook employees deny a refund request from a child whom they refer to as a “whale” – a term coined by the casino industry to describe profligate spenders. The child had entered a credit card number to play a game, and in about two weeks racked up thousands of dollars in charges, according to an excerpt of messages between two employees at the social media giant.

Gillian: Would you refund this whale ticket? User is disputing ALL charges…
Michael: What’s the users total lifetime spend?
Gillian: It’s $6,545 – but card was just added on Sept. 2. They are disputing all of it I believe. That user looks underage as well. Well, maybe not under 13.
Michael: Is the user writing in a parent, or is this user a 13ish year old
Gillian: It’s a 13ish yr old. says its 15. looks a bit younger. she* not its. Lol.
Michael: ... I wouldn’t refund
Gillian: Oh that’s fine. cool. agreed. just double checking

Fine. Cool. Agreed. Or not. Not cool at all. And that's even if you argue (as some have on Twitter) that the "whale" comment is actually a typo for "whole" (and argument multiple people who worked in the space dispute, noting that "whale"/casino terminology was common in online games).

While you might just chalk this up to a conversation among perhaps lower level Facebook employees with screwed up incentives, Reveal notes that other documents make it clear that people within Facebook knew that their confusing UI was contributing to a problem:

Facebook employees began voicing their concerns that people were being charged without their knowledge. The social media company decided to analyze one of the most popular games of the time, Angry Birds, and discovered the average age of people playing it on Facebook was 5 years old, according to newly revealed information.

“In nearly all cases the parents knew their child was playing Angry Birds, but didn’t think the child would be allowed to buy anything without their password or authorization first,” according to an internal Facebook memo. The memo noted that on other platforms, such as Apple’s iPhone, people were required to reauthorize additional purchases, such as by re-entering a password.

A Facebook employee noted that children were likely to be confused by the in-game purchases because it “doesn’t necessarily look like real money to a minor.”

The documents also note that Facebook didn't send receipts for these purchases, meaning that parents wouldn't know about them until way later when the credit card bill shows up. Oh yeah, also "links on the company’s website to dispute charges frequently failed to work."

While one might try to argue that this is something that happened many years ago, when Facebook wasn't that careful about things, the company's reaction to these documents finally being revealed isn't great either:

In response to a request for an interview, Facebook provided a one-sentence statement: “We appreciate the court’s careful review of these materials.”

That's... not going to cut it. In the past year, almost every internet company I talk to is simply seething about Facebook and how it's basically destroying everything with the hamfisted way it deals with... almost everything. The company's ongoing and never-ending "apology tour" isn't changing anything, and if the company can't figure out that it has to take real ownership of its many problems, past and present, it's never going to fix them, nor rebuild trust. Responding with that sort of PR speak, rather than saying "we royally fucked up, but that was many years ago, and here are all the concrete steps we've taken to fix this" is just incompetent. The company has been in the limelight for so long yet it still doesn't seem to fathom how to deal honestly with a press that is calling out its many faults. While it is true that plenty of press coverage of Facebook in the past year has been misleading or unfair, the unwillingness of the company to take its real problems seriously, is a huge issue not just for Facebook, but for every other internet company as well.

Filed Under: coppa, credit cards, kids, online games, refunds, whale
Companies: facebook

Verizon Dinged Again For Privacy Violations, This Time For Slinging Personalized Ads To Kids

from the what-privacy-law? dept

Oh Verizon. For years we've noted how the company's consumer privacy practices are utterly abysmal. Like that time in 2016 when Verizon was fined a relative pittance by the FCC for modifying user wireless packets so it could covertly track users around the internet (beyond cookie, clickstream, or even deep packet inspection data). This being Verizon, it didn't bother to tell anybody that this was happening. As a result, it took two years for security researchers to even notice what the company was up to, and another six months of media yelling before the company was willing to even let consumers opt out of the data collection.

Fast forward to this week, and Verizon has been busted once again on the privacy front, this time for slinging behavioral advertisements at kids in violation of the Children’s Online Privacy Protection Act (COPPA). According to an announcement by acting New York Attorney General Barbara Underwood, Verizon's Oath operations (the mash up of its Yahoo and AOL acquisitions) routinely auctioned off ad space and placed ads on websites the company knew targeted kids -- without parental consent. As a result, Verizon's being hit with the biggest fine in the history of COPPA:

"The Attorney General’s Office found that AOL conducted billions of auctions for ad space on hundreds of websites the company knew were directed to children under the age of 13. Through these auctions, AOL collected, used, and disclosed personal information from the websites’ users in violation of COPPA, enabling advertisers to track and serve targeted ads to young children. The company has agreed to adopt comprehensive reforms to protect children from improper tracking and pay a record $4.95 million in penalties, the largest penalty ever in a COPPA enforcement matter in U.S. history."

But much like the company's fine for its earlier scandal, the fine itself is likely a small fraction of the money made during the time AOL spent intentionally turning a blind eye as behavior ads were aimed at kids and kid-frequented websites. The AG's report notes that until late last year (presumably as a result of realizing the AG inquiry existed), AOL's systems ignored any information that it received from an ad exchange indicating that the ad space was subject to COPPA, so the website routinely ignored the law in general. It's worth noting that the full settlement has not yet been released.

There's no indication from the NY AG (I've reached out for more detail) how long this was going on, but it's fairly obvious the income AOL made from ignoring COPPA (there were 1.3 billion auctions of display ad space) outweighs any penalty it's facing, however historic. COPPA is one of the few privacy regulations currently in place, and even then, Verizon/AOL/Oath's decision to just ignore the law speaks pretty broadly as to how even the privacy laws we do have are inconsistently enforced. Especially when we're talking about deep-pocketed telecom giants, who have openly flirted with the idea of charging users even more money for privacy without regulators so much as batting an eye.

As we sit down and begin the long, difficult conversation about what a real internet-era privacy law should look like, the lion's share of the focus remains (quite justly given the Cambridge Analytica scandal) on Facebook. But it can't be understated how the telecom industry has historically been even worse -- especially given they're effectively bone-grafted to the nation's intelligence surveillance apparatus. That these are the companies that will have the biggest impact on the crafting of privacy laws should terrify anyone interested in getting meaningful privacy legislation right.

Filed Under: barbara underwood, coppa, new york, parental consent, privacy, targeting kids
Companies: aol, oath, verizon, yahoo

Ad Software Dev Doesn't Like Being Called Out For Privacy Violations ; Sends Threatening Letter To Researchers Who Exposed It

from the fixing-it-in-post dept

The Children's Online Privacy Protection Act (COPPA), passed in 1998, governs the sort of data that can be collected from children under the age of 13. That's why kids have to age themselves prematurely to create accounts on some social media networks. It's a law kids under the age of 13 subvert every day, but it's in place to protect kids from online services and restricts information collected by apps and online services that cater to children.

Unfortunately, there are a lot of app developers ignoring this law. A recently-published research paper shows a host of violations and questionable practices that smartphone/tablet app developers are engaged in. Serge Egelman, one of the paper's co-authors, notes that thousands of apps are violating this law every day. In just one example, an advertising SDK (software development kit) made by ironSource is harvesting personal data from 466 child-directed apps.

It's not as though this is a simple oversight. In an earlier blog post detailing COPPA violations, Egelman points out Android developers must take a series of affirmative steps to market apps directed at children. There's a long list of stipulations that must be met before Google will allow apps to become part of its Designed For Families program.

Apps using ironSource's SDK are being marketed to kids, making the presence of a targeted advertising tool not merely questionable, but possibly illegal. As Egelman's blog post notes, it certainly violates ironSource's own terms of service. This is taken from its privacy policy, as archived late last year.

The Services are not directed to children under the age of 13 and children under the age of 13 should not use any portion of the Services. ironSource also does not knowingly collect or maintain personal information collected online from children under the age of 13, to the extent prohibited by the Children’s Online Privacy Protection Act.

"Services" is explained further in the Privacy Policy.

This Privacy Policy (the “Privacy Policy”) describes how ironSource Ltd. and its subsidiaries (collectively “ironSource” or “we”, “us”, “our”) uses end users [sic] (“you” or “your”) information when you view ads served by platforms and services operated by ironSource Mobile Ltd. on third party websites or mobile apps (the “Services”).

This would appear to indicate children under the age of 13 should not see ads served by ironSource. The easiest way to do that would be not to use the targeted ad SDK, as Egelman points out. But the research shows the opposite occurs repeatedly, with developers adding ironSource's ad software to their apps before shoving into the "Family" section of the Play Store.

This research paper -- and the attendant blog posts -- weren't published until this year. Shortly after publication, ironSource apparently chose to express its irritation with being named and shamed as an accomplice in COPPA violations. But the story is stranger than it first appears. IronSource apparently obtained a leaked copy of the report prior to its official publication. The angry letter it sent Egelman's research partner, Irwin Reyes, claims their report is "inaccurate and misleading." But if it is, it's only because ironSource performed a legalese switcheroo after receiving the leaked paper.

To our surprise, between first receiving a leaked draft of our paper in February and sending this letter in April—presumably while they waited for the paper to appear online, for plausible deniability, so that they would not have to explain how they came into possession of a stolen draft—ironSource updated their privacy policy to remove the clause about children not using their services. The current policy, dated March 4, 2018 (i.e., after they were aware of the paper), now simply says that they have no knowledge of receiving data from children.

The letter involves ironSource blundering far across the line between clever and stupid.

Ms. Litay, who claims to be a lawyer, claims that our paper is incorrect because it cites a clause that was removed after the paper was written! This requires significant mental gymnastics (or a significant amount of chutzpah and the misguided belief that the recipients of her letter do not know that the web is archival).

Even with the hastily-applied patch job, ironSource's COPPA "compliance" deserves scare quotes. ironSource is claiming it has "no knowledge" of personal data being collected from children under the age of 13. But this can't possibly be true, even with its reworded privacy policy.

Looking at just our dataset for all the apps transmitting personal information to ironSource, several developers’ names include words like “child,” “baby,” or “kids.”

Behind all of this is a company displeased its questionable and possibly illegal business practices have become the subject of an unflattering research paper. The letter [PDF] ends with a veiled lawsuit threat, claiming the researchers fully-substantiated claims "may result in substantial financial damage" to ironSource.

Egelman's response [PDF] pulls no punches. It calls out ironSource for its lie about its privacy policy's wording.

IronSource’s privacy policy (or rather, the privacy policy of Supersonic, ironSource’s subsidiary), at the time that we accessed it (September of 2017, as documented in the article and since deleted from ironSource’s website), stated the following:

"The Services are not directed to children under the age of 13 and children under the age of 13 should not use any portion of the Services."

Your allegations appear to be based upon your interpretation of the term “Services,” which you claim is defined as being those services that ironSource offers to app developers, and presumably not what is collected from end-users. That is, your letter is claiming that these statements mean that you do not allow developers under 13 to sign up on your website to use your SDK, and not that the SDK should only be used in non-child-directed apps. This may be a reasonable interpretation of the privacy policy and terms of service as they are currently written.

But that's not how they were written before the paper was published -- and before ironSource obtained a copy. Before then, the terms of service stated children under 13 should not use "this portion" of the services, referring to ironSource's targeted ad SDK. If the SDK was bundled with apps targeting kids, information was harvested by the SDK in violation of federal law.

As to the thinly-veiled legal threat closing out ironSource's ridiculous C&D, Egelman says, "Bring it on."

As you know, the verbatim quotation in our paper of Supersonic’s privacy policy as it existed at the time the paper was written, and our reasonable interpretation of that privacy policy are protected speech. You can appreciate, I hope, our concern about your implied threat of a commercial defamation lawsuit, and our perspective that any such action would be a Strategic Lawsuit Against Public Participation (SLAPP), prohibited by California’s anti-SLAPP statute (Ca. Code of Civ. Proc., §§425.16 et seq.). Your concern about ironSource’s financial interests and reputation is not likely to be well served by unfounded threats to academic researchers acting in the public interest.

Rather than let the research paper filter its way into the collection consciousness with possibly minimal reputational damage, ironSource has chosen to draw more attention to it by attempting to silence its authors. Now, it looks like a company that threatens critics when not violating federal privacy laws. Retconning its privacy policies before calling researchers liars is just prime stupidity. The internet is forever. So is ironSource's self-inflicted damage.

Filed Under: advertising, apps, coppa, irwin reyes, privacy, researchers, serge egelman, threats
Companies: ironsource

Another Lawsuit Highlights How Many 'Smart' Toys Violate Privacy, Aren't Secure

from the Barbie-is-a-rat dept

So we've talked a bit about the privacy implications of smart toys, and the fact that people aren't exactly thrilled that Barbie now tracks your childrens' behavior and then uploads that data to the cloud. Like most internet-of-not-so-smart things, these toys often come with flimsy security and only a passing interest in privacy. As such we've increasingly seen events like the Vtech hack, where hackers obtained the names, email addresses, passwords, and home addresses of 4,833,678 parents, and the first names, genders and birthdays of more than 200,000 kids.

Unsurprisingly, the collection of kids' babbling while in the company of smart toys continues to ruffle feathers. This week, a coalition of consumer advocates including the Consumer's Union filed suit against Genesis Toys, the maker of two such toys, the My Friend Cayla doll and the i-Que Intelligent Robot. According to the full lawsuit (pdf), the toy maker is violating COPPA (the Childrens’ Online Privacy Protection Act of 1998) by failing to adequately inform parents' that their kids conversations and personal data collected by the toys are being shipped off to servers and third-party companies.

Among the problems cited in the complaint is that the privacy policies governing the collection of kids' data aren't clear, aren't prominently displayed, and often change without notice. Parents aren't properly informed that data is being culled from the toys and sent off to companies like Nuance Communications, most commonly known for its Dragon voice recognition software, but a company that also has prominent roles in healthcare dictation and as a defense contractor. Both toys by proxy are governed by Nuance's privacy policy, which among other things says:

"We may use the information that we collect for our internal purposes to develop, tune, enhance, and improve our products and services, and for advertising and marketing consistent with this Privacy Policy." It continues, “If you are under 18 or otherwise would be required to have parent or guardian consent to share information with Nuance, you should not send any information about yourself to us."

With the toys being marketed to "ages 4 and up" and being mostly used by kids under age 18, the lawsuit states the companies selling and collecting this toy data are violating COPPA. Under COPPA, companies gathering kids data have to provide notice to, and obtain consent from parents regarding data collection. They also have to provide parents tools to access, review and delete this data if wanted, as well as the parental ability to dictate that the data can be collected, but not shared with third parties. The complaint suggests neither Nuance or Genesis Toys are doing any of this.

And again, privacy is just part of the equation. There's also the fact that these toys just aren't all that secure. A report by the Norwegian Consumer Council (pdf) found that a lot of the data being transmitted by these toys is done so via vanilla, unencrypted HTTP connections that could be subject to man in the middle attacks. Reconfiguring the devices to create in-home surveillance tools was also "very easy and requires little technical know-how," according to the report.So again, much like all internet of things devices, companies were so excited to integrate internet connectivity, they effectively forgot about user privacy and security. Are we perhaps noticing a ongoing theme yet?

Filed Under: coppa, i-que intelligent robot, iot, my friend cayla, privacy, security, smart toys
Companies: genesis toys, nuance

FTC Goes After Yelp Because Yelp Has The Audacity To Let Kids Use Its App

from the wait,-what's-the-problem-exactly? dept

For years now, we've discussed the ridiculousness of the COPPA law (the Children's Online Privacy Protection Act). The rallying cry of "protect the children!" quite frequently leads to very poor policy decisions, and COPPA (and the enforcement around it) is a perfect example of that. While there might possibly be good intentions behind the law, the practical reality is that it's a joke. It effectively places a much larger burden on any site that allows anyone under 13 to use the site. While, in practice, it's supposed to only apply to sites that are targeted to kids, in an attempt to avoid that, many sites put a blanket ban on those under 13. In our own terms of service we explicitly tell anyone under 13 not to register with our site. Our lawyers more or less insisted that we had to do this, and plenty of other sites do the same. So the end result is that kids under 13, who often should be using the internet, are told that they can't use large parts of the internet -- including sites that are useful to their education. But of course many of them still use the internet. They just lie about it. In fact, one researcher found that the only practical effect of the law is that it leads parents to teach their kids that it's okay to lie. Even worse, the FTC seems entirely unconcerned about the real impact of the law -- but prefers to insist that it's really protecting children, despite no actual evidence to support this. In fact, the FTC has even pushed to expand the law.

The FTC has now gone after its latest COPPA "violator": Yelp. According to the complaint filed against the company Yelp had the audacity to let kids under 13 register for its service via the company's iOS and Android apps. And then? Well, I assume that the very small number of kids who did so, used the app to *gasp* find reviews on restaurants and such things. The FTC complaint doesn't present any evidence of any actual harm here. Just the fact that it let a small number of kids register, and then didn't meet all the checkbox requirements of "protecting the children."

I'm honestly curious if the "consumer protection division" at the FTC thinks that kids would be better off if they were blocked from using Yelp entirely, or if they just think,"Aha, gotcha!" when they file these kinds of lawsuits?

Filed Under: apps, coppa, ftc, protect the children, under 13
Companies: yelp

Yes, The DOJ Thinks It's A Crime When A 12 Year Old Reads The NY Times

from the reform-the-cfaa-now dept

We've been talking a lot lately about the need for serious reform of the Computer Fraud and Abuse Act (CFAA), which was initially supposed to be a law about malicious hacking, but has been used repeatedly by the DOJ and others to attack something so simple as a minor terms of service violation as a potential felony. While certain courts have rejected the DOJ's interpretation, that has not stopped the DOJ from claiming that its interpretation can be applied in other circuits. Even more bizarre is that, rather than fixing the law, Congress's most recent actions have suggested an interest in expanding the law even further, increasing the punishment levels for those the DOJ decides to go after.

The EFF has pointed out just how ridiculous it is to argue that violating a terms of service is a potential felony, noting how that even makes children who read online news sites potential felons for violating terms of service. This is, in part, due to another bad law that we've spoken about, the Children's Online Privacy Protection Act, or COPPA. The issue here is that online sites have stricter rules if they're seen as targeting children under the age of 13. To avoid this potential liability, many websites simply inserted a clause into their terms of service saying that you can only read the site if you're over 13 (some sites say 18 and others say between 13 and 18 need a parent's approval). While this is somewhat lazy lawyering on the part of those sites (to ban outright), those are their terms of service. And violating such terms violates the CFAA under the DOJ's interpretation.

The EFF notes that such age exclusion provisions are pretty common, and sites like the NY Times and NBC News bar children under 13 entirely.

This means that inquisitive 12-year-olds who visit NBCNews.com to learn about current events would be, by default, misrepresenting their ages. Again, this could be criminal under the DOJ's interpretation of the CFAA.

We’d like to say that we’re being facetious, but, unfortunately, the Justice Department has already demonstrated its willingness to pursue CFAA to absurd extremes. Luckily, the Ninth Circuit rejected the government’s arguments, concluding that, under such an ruling, millions of unsuspecting citizens would suddenly find themselves on the wrong side of the law. As Judge Alex Kozinski so aptly wrote: "Under the government’s proposed interpretation of the CFAA...describing yourself as 'tall, dark and handsome,' when you’re actually short and homely, will earn you a handsome orange jumpsuit."

And it’s no excuse to say that the vast majority of these cases will never be prosecuted. As the Ninth Circuit explained, “Ubiquitous, seldom-prosecuted crimes invite arbitrary and discriminatory enforcement.” Instead of pursuing only suspects of actual crimes, it opens the door for prosecutors to go after people because the government doesn’t like them.

Unfortunately, there’s no sign the Justice Department has given up on this interpretation outside the Ninth and Fourth Circuits, which is why the Professor Tim Wu in the New Yorker recently called the CFAA “the most outrageous criminal law you’ve never heard of.”

Then the Atlantic Wire helpfully jumped in and highlighted many other publications and their online terms of service, showing that young readers of many of today's most popular news sites are potentially breaking the law every time they do so under the DOJ's clearly stated position on the CFAA.

The EFF followed it up by pointing out that, until just recently, if you were a 17-year-old girl (or younger!) reading the magazine Seventeen online, you were almost certainly breaking the law under the DOJ's interpretation of the CFAA, since its terms restricted visitors to those 18 and older.

Rather than "trusting" the DOJ not to abuse this kind of thing, wouldn't we all be better off fixing it?

Filed Under: age restrictions, cfaa, coppa, terms of service

Facebook Apparently Doesn't Believe Anyone Over 100 Could Use The Service, 104 Year Old Has To Lie

from the for-the-encouragement-of-lying dept

There are plenty of stories about children under the age of 13 having to lie (often with the assistance of their parents) to get on Facebook. This is due to the ridiculous COPPA law that the FTC supports strongly, despite it doing close to nothing to actually "protect children." But what's the excuse for people lying at the other end of the scale? A 104 years old woman is forced to be perpetually 99 years old because Facebook apparently refuses ages higher than that. It makes you wonder if they just never thought someone with three digits in their age would use the service and only set up the database to handle two digits. Oddly, rather than defaulting down to 99 years old when Marguerite Joseph tried to enter her birth year of 1908, the system automatically took 20 years off her life and said she was born in 1928. Either way, just as parents are helping children lie about their age at the youth end of the spectrum, in this case, it's Marguerite's granddaughter who's the accomplice here, since Marguerite is legally blind, but still likes to keep in touch with people via Facebook.

Filed Under: age, coppa, services, social networks
Companies: facebook