II. RECLAIMING PRIVACY
[6] Privacy is a long-established right.15 However, in comparison, consumer protection rights are relatively new. 16 President Woodrow Wilson created the Federal Trade Commission (FTC) in 1914 to prevent unfair competition.17 Operating within this framework, additional legislation broadened the FTC’s regulatory power to protect the privacy rights of consumers by prohibiting deceptive practices involving consumers’ personal information.18
A. History of COPPA
[7] Toward the end of the twentieth century, as more children began accessing the internet, Congress enacted the Children’s Online Privacy Protection Act (COPPA).19 COPPA requires the FTC to issue and enforce regulations concerning online privacy for children under the age of thirteen.20 COPPA’s strives to provide parental control over information collected from their children online.21 COPPA applies to operators of commercial websites for kids and websites that act with an “actual knowledge” that they are collecting, using, or disclosing “personal information”22 from children under the age of thirteen.23 Operators must post a clear privacy policy, obtain verifiable parental consent, provide parents access to delete their child’s information, and maintain the confidentiality of collected information.24 After the retained personal information has fulfilled its intended purpose, operators must destroy the information to prevent unauthorized access.25
15 See *Samuel D. Warren & Louis D. Brandeis, *The Right to Privacy, 4 HARV. L. REV. 193, 204–05 (1890) (“If the fiction of property in a narrow sense must be preserved, it is still true that the end accomplished by the gossip-monger is attained by the use of that which is another’s, the facts relating to his private life, which he has seen fit to keep private.”).
16 See Mark E. Budnitz, The Development of Consumer Protection Law, the Institutionalization of Consumerism, and Future Prospects and Perils, 26 GA.ST. UNIV. L. REV. 1147, 1149 (2012) (discussing the lack and inadequacy of consumer protection laws); Comment, Translating Sympathy for Deceived Consumers into Effective Programs for Protection, 114 UNIV.PA. L. REV. 395, 395–96 (1966) (“With the tremendous expansion of consumer credit since World War II and the accompanying ‘nefarious, unscrupulous and improper practices [that] exist in certain areas of consumer credit,’ an acute necessity for protecting consumers has arisen.”) (footnote omitted).
17 Our History, FED. TRADE COMM’N, https://www.ftc.gov/about-ftc/our-history [https://perma.cc/K6AW-X2SB].
18 About the FTC, FED. TRADE COMM’N, https://www.ftc.gov/about-ftc [https://perma.cc/56F6-VVV9].
19 Children’s Online Privacy Protection Act, 15 U.S.C. § 6502; Complying with COPPA: Frequently Asked Questions, FED. TRADE COMM’N § A(1) (July 2020), https://www.ftc.gov/tips-advice/business-center/guidance/complying-coppa-frequentlyasked-questions-0 [https://perma.cc/9C9K-BN5V [hereinafter COPPA FAQs].
20 Id.
21 COPPA FAQs, supra note 19, § 11; see 16 C.F.R. § 312.5(a) (2020).
22 Id. § 312.2 (2020) (including identifiable information such as an individual’s name and address as well as “persistent identifiers” such as cookies, Internet Protocol (IP) addresses, or a device’s serial number).
23 COPPA FAQs, supra note 19, § A(1); 16 C.F.R. § 312.3.
24 COPPA FAQs, supra note 19, § A(1).
25 Id.
[8] COPPA does not apply to information collected about children, only from children.26 However, the FTC fully expects operators to confidentially secure any information obtained from parents in the course of obtaining parental consent.27 Regarding teenage users, the FTC further explains:
In enacting [COPPA], Congress determined to apply the statute’s protections only to children under 13, recognizing that younger children are particularly vulnerable to overreaching by marketers and may not understand the safety and privacy issues created by the online collection of personal information. Although COPPA does not apply to teenagers, the FTC is concerned about teen privacy and does believe that strong, more flexible, protections may be appropriate for this age group.28
26 Id. § A(8); see 16 C.F.R. §§ 312.2–312.3 (emphasizing that the information must come from the child in order to fall under the statutory requirements).
27 Children’s Online Privacy Protection Rule, 64 Fed. Reg. 59,888, 59,902 (Nov. 3, 1999) (to be codified at 16 C.F.R. pt. 312) (emphasis added).
28 COPPA FAQs, supra note 19, § A(9) (citations omitted).
[9] COPPA does not inhibit a child’s access to certain websites thereby leaving a child’s parent or school responsible for filtering internet access.29 Violators of COPPA can be liable for civil penalties up to $43,280 per violation depending on “the egregiousness of the violations, whether the operator has previously violated [COPPA], the number of children involved, the amount and type of personal information collected, how the information was used, whether it was shared with third parties, and the size of the company.”30 Foreign-based websites must also comply with COPPA as do U.S.-based websites that collect information from foreign children.31
B. Ongoing Privacy Violations
[10] Online privacy violations continue to occur as companies disregard consumer protection laws.32 Although tech companies pay tremendous amounts of money to settle allegations with the FTC, the quasi-punishment these companies may not fit the alleged violation33 Furthermore, unknown and upcoming companies are just as likely to violate privacy protection laws as the “Tech Titans.”34
29 Id. § A(11).
30 Id. § B(2).
31 *Id. *§ B(7).
32 See Ryan Tracy, Big Tech’s Power Comes Under Fire at Congressional Antitrust Hearing, WALL ST. J. (July 29, 2020, 7:29 PM), https://www.wsj.com/articles/tech-ceosdefend-operations-ahead-of-congressional-hearing-11596027626 [https://perma.cc/WB48-4GB3] (“Lawmakers whipsawed between topics, from how the companies moderate social media posts to the tactics they used to gain sizable positions in markets from digital advertising to e-commerce.”).
33 See infra Section IV.c.i.
34 See Tracy, supra note 32 (referring to Amazon, Facebook, Apple, and Google); see infra Section II.b.ii.
1. Facebook’s FTC Settlement
[11] Facebook’s recent settlement with the FTC illuminates the degradation of consumers’ online privacy. Based on allegations that Facebook violated its 2012 FTC privacy order, Facebook assented to an unprecedented $5 billion settlement with the FTC.35 Referring to the settlement, FTC Chairman, Joe Simons, stated that “[t]he relief is designed not only to punish future violations but, more importantly, to change Facebook’s entire privacy culture to decrease the likelihood of continued violations.”36 The Assistant Attorney General for the Department of Justice Civil Division reiterated that “[t]he Department of Justice is committed to protecting consumer data privacy and ensuring that social media companies like Facebook do not mislead individuals about the use of their personal information.”37 The FTC determined that “Facebook repeatedly used deceptive disclosures and settings to undermine users’ privacy preferences” in violation of a previous FTC order.38 Facebook failed to inform its users that third-party apps collected data from Facebook users’ “friends” without receiving proper consent.39 To ensure future compliance, the FTC order established an independent privacy committee of Facebook’s board of directors thereby curtailing CEO Mark Zuckerberg’s adamantine control.40 These amendments are now included in the 2012 FTC privacy order.41
35 FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook, FED. TRADE COMM’N (July 24, 2019) https://www.ftc.gov/news-events/pressreleases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions [https://perma.cc/2YTJ-G684].
36 Id.
37 Id.
38 Id.
39 See id.
40 Id.
41 See FTC Gives Final Approval to Modify FTC’s 2012 Privacy Order with Facebook with Provisions from 2019 Settlement, FED. TRADE COMM’N (Apr. 28, 2020), https://www.ftc.gov/news-events/press-releases/2020/04/ftc-gives-final-approval-modifyftcs-2012-privacy-order-facebook [https://perma.cc/BR9J-HZHT].
2. YouTube and Other Violators
[12] In 2019, YouTube paid $170 million to settle allegations by the FTC that the company illegally collected personal information from children without their parents’ consent.42 Persistent identifiers—or “cookies”—were used to track children who viewed child-directed channels across the internet without first notifying parents and receiving meaningful consent.43 Even though several channel owners directed their content to children—and despite YouTube marketing its popularity with children to prospective corporate clients—YouTube refused to acknowledge that it violated COPPA.44
[13] Channel owners can monetize their channel by allowing YouTube to disseminate “behaviorally targeted advertisements” to their viewers.45 According to the FTC complaint, even though YouTube manually reviewed children’s content in its “YouTube Kids” application, it still collected a child’s personal data to display targeted advertisements on these channels.46 Despite the ubiquity of its underage viewers, YouTube denied its need to comply with COPPA.47 The settlement also required YouTube—and Google as its parent company—to develop, implement, and maintain a system that allows channel owners to notify YouTube of any child-directed content on their channels.48 Though Facebook49 and Google50 are the most notorious violators of privacy laws, the FTC has also settled other allegations of privacy and data violations with Cambridge Analytica,51Twitter,52 Snapchat,53 HyperBeard,54 Unixiz, Inc.,55 and RetinaX Studios.56
42 Google and YouTube Will Pay Record $170 Million for Alleged Violations of Children’s Privacy Law, FED. TRADE COMM’N (Sept. 4, 2019), https://www.ftc.gov/news-events/press-releases/2019/09/google-youtube-will-pay-record-170-millionalleged-violations [https://perma.cc/2LMU-ZWXN].
43See id.
44 See id.
45 Id. (emphasis added); see infra Section III.a (discussing Professor Shoshana Zuboff’s “surveillance capitalism,” considering Google, YouTube’s parent company, as the “pioneer” of the concept, and concluding with an optimistic view regarding the increasing accessibility of exploiting “behavioral future markets”).
46 Google and YouTube Will Pay Record $170 Million for Alleged Violations of Children’s Privacy Law, supra note 42.
47 Id.
48 Id.
49 See supra Section II.b; see also Brent Kendall & Emily Glazer, FTC Considering Deposing Top Facebook Executives in Antitrust Probe, WALL ST. J., (July 17, 2020, 5:57 PM), https://www.wsj.com/articles/ftc-considering-deposing-top-facebook-of [https://perma.cc/5MA2-VKTL] (“Facebook is one of a handful of tech giants in the government’s crosshairs amid concerns they are too powerful and stifle competition.”).
50 See generally J.H. Jennifer Lee et. al., Consumer Protection in the New Economy: Privacy Cases in E-Commerce Transactions or Social Media Activities, 73 CONSUMER FIN. L. Q. REP. 6 (2019) (stating that Google repeatedly violates privacy laws); Raizel Liebler & Keidra Chaney, Google Analytics: Analyzing the Latest Wave of Legal Concerns for Google in the U.S. and the E.U., 7 BUFF. INTELL.PROP. L.J. 135 (2010) (stating that Google repeatedly violates privacy laws).
51 See FTC Grants Final Approval to Settlement with Formal Cambridge Analytica CEO, App Developer over Allegations they Deceived Consumers over Collection of Facebook Data, FED. TRADE COMM’N (Dec. 18, 2019), https://www.ftc.gov/news-events/pressreleases/2019/12/ftc-grants-final-approval-settlement-former-cambridge-analytica [https://perma.cc/DA97-3MW4] (settling with Cambridge Analytica’s CEO).
52 Twitter Settles Charges that it Failed to Protect Consumers’ Personal Information; Company Will Establish Independently Audited Information Security Program, FED. TRADE COMM’N (June 24, 2010), https://www.ftc.gov/news-events/pressreleases/2010/06/twitter-settles-charges-it-failed-protect-consumers-personal [https://perma.cc/AT8H-5F4H].
53 Snapchat Settles FTC Charges That Promises of Disappearing Messages Were False, FED. TRADE COMM’N (May 8, 2014), https://www.ftc.gov/news-events/pressreleases/2014/05/snapchat-settles-ftc-charges-promises-disappearing-messages-were [https://perma.cc/RZ7B-T6WL].
54 Developer of Apps Popular with Children Agrees to Settle FTC Allegations It Illegally Collected Kids’ Data Without Parental Consent, FED. TRADE COMM’N (June 4, 2020), https://www.ftc.gov/news-events/press-releases/2020/06/developer-apps-popularchildren-agrees-settle-ftc-allegations-it [https://perma.cc/DE5N-JP3T].
55 FTC Alleges Operators of Two Commercial Websites Failed to Protect Consumers’ Data, FED. TRADE COMM’N (Apr. 24, 2019), https://www.ftc.gov/news-events/pressreleases/2019/04/ftc-alleges-operators-two-commercial-websites-failed-protect [https://perma.cc/EUN6-LX4Q].
56 FTC Gives Final Approval to Settlement with Stalking Apps Developer, FED. TRADE COMM’N (Mar. 27, 2020), https://www.ftc.gov/news-events/press-releases/2020/03/ftcgives-final-approval-settlement-stalking-apps-developer [https://perma.cc/B3NF-ZYDQ] (noting that the developer of “‘stalking’ apps . . . allowed purchasers to monitor the mobile devices on which they were installed, without the knowledge or permission of the device’s user.”).
3. TikTok
[14] TikTok captures the majority of today’s privacy-concerned headlines.57 TikTok is a social media application that allows users to create and share short videos, often with whimsical dance moves choreographed to popular songs.58 After launching in 2016, TikTok has accumulated more than 2.2 billion users worldwide and is valued at over $100 billion.59 TikTok’s predecessor, Musical.ly, already settled with the FTC regarding previous COPPA violations.60 ByteDance, Ltd., TikTok’s parent company, paid $5.7 million to settle the allegations with the FTC.61 In recent months, U.S. officials have been concerned that TikTok will be obligated to relinquish user data to the Chinese government.62 TikTok collects a plethora of user information including; a user’s location, internet address, copied clipboard text,63 browsing history, messages, and contacts.64 Most recently, a Wall Street Journal analysis found that TikTok collected unique identifiers—“media access control” (MAC) addresses—from millions of users, which allowed the application to track these users online without the user’s ability to opt out.65 As a result of this additional scrutiny, ByteDance, Ltd., is considering changing its corporate structure or establishing a headquarters outside of China.66
57 See Josh Lake, TikTok, Privacy & Security – Should it Be Banned or Sold?, COMPARITECH (Aug. 10, 2020), https://www.comparitech.com/blog/vpn-privacy/tiktokprivacy-security/ [https://perma.cc/Q8WG-CJRW].
58 See Deborah Dsouza, What is TikTok?, INVESTOPEDIA (Feb. 10, 2020), https://www.investopedia.com/what-is-tiktok-4588933 [https://perma.cc/985U-EJBU].
59 Liza Lin & Shan Li, TikTok Weighs Pullback from China - WSJ, MARKETSCREENER (July 10, 2020, 3:48 AM), https://www.marketscreener.com/quote/stock/TWITTER38965267/news/TikTok-Weighs-Pullback-From-China-WSJ-30904810/ [https://perma.cc/BZ9G-GUCB].
60Video Social Networking App Musical.ly Agrees to Settle FTC Allegations That it Violated Children’s Privacy Law, FED. TRADE COMM’N (Feb. 27, 2019), https://www.ftc.gov/news-events/press-releases/2019/02/video-social-networking-appmusically-agrees-settle-ftc [https://perma.cc/V32X-39KC].
61 Patrick Thomas, TikTok Settles with FTC Over Data Collection from Children, WALL ST. J. (Feb. 27, 2019, 4:36 PM), https://www.wsj.com/articles/tiktok-settles-with-ftcover-data-collection-from-children-11551303390 [https://perma.cc/3W47-AJP8].
62 John D. McKinnon & Shan Li, TikTok Could Be Tougher Target for Trump Administration, WALL ST. J. (July 26, 2020), https://www.wsj.com/articles/tiktok-couldbe-tougher-target-for-trump-administration-11595755800 [https://perma.cc/52LB-7Y58] (“U.S. officials say they are concerned that TikTok, owned by Beijing-based ByteDance Ltd., could pass on the data it collects from Americans streaming videos to China’s authoritarian government. TikTok has said it would never do so. U.S. officials also are increasingly concerned about the risk of misinformation and Chinese propaganda being spread on the app.”); See Liza Lin & Eva Xiao, TikTok Maker Seeks to Strike Balance as China, U.S. Step Up Geopolitical Pressure, WALL ST. J. (July 7, 2020), https://www.wsj.com/articles/tiktok-to-pull-out-of-hong-kong-after-china-imposednational-security-law-11594096439 [https://perma.cc/L2ZU-8LS7] (“The pressures TikTok faces reflect the continued fracturing of the internet along geopolitical lines amid rising tensions between the U.S. and China.”); Robert McMillan & Liza Lin, TikTok User Data: What Does the App Collect and Why Are U.S. Authorities Concerned?, WALL ST. J. (July 7, 2020), https://www.wsj.com/articles/tiktok-user-data-what-does-the-appcollect-and-why-are-u-s-authorities-concerned-11594157084 [https://perma.cc/RB6J4K3E] (“U.S. officials are concerned that the Chinese government is potentially building a vast database of information that could be used for espionage—identifying U.S. government employees who might be susceptible to blackmail, for example . . . .”).
63 But cf. Sean Kim, Protecting privacy on TikTok, TIKTOK NEWSROOM (July 22, 2020), https://newsroom.tiktok.com/en-us/protecting-privacy-on-tiktok [https://perma.cc/S3HHG46H] (“Starting with the new update, TikTok will only allow a third-party app to access a users [sic] clipboard when an action is expressly initiated by a user, such as sharing to Snapchat or Instagram Stories.”).
64 Privacy Policy, TIKTOK (Jan. 1, 2020) https://www.tiktok.com/legal/privacypolicy?lang=en#privacy-us [https://perma.cc/5F5R-286P] ; see Yang Liu et al., Case Study: A Chinese Social Video App TikTok Violates Children’s Privacy Laws in the United States, 23 No. 9 J. INTERNET L. 1, 16 (2020).
65 Kevin Poulsen & Robert McMillan, TikTok Tracked User Data Using Tactic Banned by Google, WALL ST. J. (Aug. 11, 2020), https://www.wsj.com/articles/tiktok-trackeduser-data-using-tactic-banned-by-google-11597176738 [https://perma.cc/HU7J-SECU] (“The MAC address is useful to advertising-driven apps because it can’t be reset or altered, allowing app makers and third-party analytics firms to build profiles of consumer behavior that persist through any privacy measure short of the owner getting a new phone. The [FTC] has said MAC addresses are considered personally identifiable information under the Children’s Online Privacy Protection Act.”).
66 Lin & Li, supra note 59 (“Officials in several countries have expressed concerns with the large volumes of user data TikTok collects . . . Any change to the corporate structure has to be significant enough to separate TikTok from any entanglements with mainland China, and has to cut off mainland Chinese staff from accessing user data . . . .”).
[15] Children, tweens, and teenagers commonly use TikTok.67 Unfortunately, this has made children increasingly vulnerable to sexual predators.68 U.S. Senators have urged the FTC to further investigate TikTok for violating its 2019 settlement by retaining children’s data.69 Parental complaints have also prompted the FTC to reopen its investigation, alleging that TikTok was aware that children under the age of 13 were signing up for, and using, the application without parental approval and oversight70 (despite TikTok limiting its platform to people 13 years of age or older).71 As data collection escalates, privacy rights should not become the norm. Now is the time to reclaim the right to privacy by preventing companies from monetizing children’s online data.
67 See generally House Republicans press TikTok on use of kids’ data, ties to Beijing, *REUTERS (May 21, 2020), https://www.reuters.com/article/us-tiktok-privacy-childrenrepublicans-idUSKBN22X26P [https://perma.cc/N897-K35K] (noting that two U.S. House of Representative Republicans, “wrote a letter to the founder of the popular video sharing app TikTok on Thursday, asking about potentially illegal use of data about children . . . .”); Stephanie Thurrott, *What is TikTok? And is it safe? A guide for clueless parents, NBC NEWS (Oct. 21, 2019), https://www.nbcnews.com/better/lifestyle/whattiktok-guide-clueless-parents-ncna1066466 [https://perma.cc/3UFQ-FBTX] (describing the interest that children have in TikTok); Video Social Networking App Musical.ly Agrees to Settle FTC Allegations That it Violated Children’s Privacy Law, supra note 60 (“The operators of the Musical.ly app were aware that a significant percentage of users were younger than 13 and received thousands of complaints from parents that their children under 13 had created Musical.ly accounts, according to the FTC’s complaint.”); Yang Liu et al., Case Study: A Chinese Social Video App TikTok Violates Children’s Privacy Laws in the United States, 23 No. 9 J. INTERNET L. 1, 16 (2020) (acknowledging that younger individuals, especially in America, use TikTok).
68 See, e.g., Fresno Man Admits Sexual Exploitation of at Least 50 Children Through Multiple Social Media Apps, DEPT. OF JUSTICE (May 15, 2020), https://www.justice.gov/usao-edca/pr/fresno-man-admits-sexual-exploitation-least-50- children-through-multiple-social-media [https://perma.cc/YE3Z-AMX9] (“Blanco used Snapchat, Kik, Musical.ly (Tik Tok), and other applications to communicate with minor females for the purpose of having those minors create and transmit to him image of themselves engaged in sexually explicit conduct.”).
69 See Henry Kenyon, Senators urge FTC to investigate reports of privacy violations by TikTok, CQ ROLL CALL, June 1, 2020, at 1, 2020 WL 2832616 (“A bipartisan group of senators urged the Federal Trade Commission to investigate Tik Tok on grounds the video sharing social media platform violated young users’ privacy and failed to abide by a 2019 settlement with the Commission.”).
70 See Kim Lyons, TikTok hit with complaint from child privacy advocates who say it’s still flouting the law, THE VERGE, (May 14, 2020), https://www.theverge.com/2020/5/14/21258502/tiktok-complaint-child-privacy-ftc [https://perma.cc/57XS-H3FZ] (“TikTok paid a $5.7 million fine to the FTC in February 2019 over allegations that an earlier version of its app, . . . allow[ed] users younger than 13 to sign up without parental consent.”); Compare Privacy Policy for Younger Users, TIKTOK (Jan. 2020), https://www.tiktok.com/legal/privacy-policy-for-younger-users?lang=en [https://perma.cc/T2EZ-LS45] (making no reference to parental consent), with Terms of Service, TIKTOK (Feb. 2019), https://www.tiktok.com/legal/terms-of-use?lang=en [https://perma.cc/UVS7-RH2Q] (“If you are under age 18, you may only use the Services with the consent of your parent or legal guardian.”).
71 Terms of Service, TIKTOK (Feb.2019), https://www.tiktok.com/legal/terms-ofuse?lang=en, [https://perma.cc/9JTD-VA72] (showing that the terms of service state that users must be 13 years of age or older).
Table of Contents
- I. INTRODUCTION
- II. RECLAIMING PRIVACY
- III. CONTEXTUALIZING THE PROBLEM OF PRIVACY
- IV. PROPOSED ADJUSTMENTS
- V. CONCLUSION