In a new Enforcement Policy Statement, the Federal Trade Commission (FTC) decreased the burden for operators with regard to the collection of certain audio voice recordings of children under the age of 13.
The Children’s Online Privacy Protection Act and accompanying Rule require operators of commercial websites or online services directed to children, and operators with actual notice they are collecting personal information from children, to provide to parents notice of their information practices and to obtain verifiable parental consent before collecting a child’s personal information.
In 2013, the FTC amended the COPPA Rule to add several new types of data to the definition of “personal information,” including an audio file that contains a child’s voice. Over the past four years, several companies have asked the FTC whether the practice of collecting audio files that contain a child’s voice, immediately converting them to text and then deleting the audio files triggers COPPA’s requirements.
Recognizing “the value of using voice as a replacement for written words in performing search and other functions on internet-connected devices,” particularly for children who have not yet learned to write and for the disabled, the FTC agreed to create a limited exemption to the COPPA mandates.
“[W]hen a covered operator collects an audio file containing a child’s voice solely as a replacement for written words, such as to perform a search or fulfill a verbal instruction or request, but maintains the file for a brief time necessary for that purpose, the FTC would not take an enforcement action against the operator on the basis that the operator collected the audio file without first obtaining verifiable parental consent,” according to the Enforcement Policy Statement, noting that in this situation “there is little risk the audio file will be used to contact an individual child.”
The FTC placed four important limitations on this non-enforcement policy. The exemption does not apply when the operator requests information via voice that otherwise would be considered personal information under the Rule (such as a name) and operators must still provide clear notice of their collection and use of the audio files, as well as the deletion policy.
“Otherwise, parents may have no way to know prior to download or purchase whether audio files are being collected, and if they later learn that audio files are being collected, they would have no reason to know that the files are being collected only for a limited purpose and immediately destroyed,” the FTC explained.
In addition, the operator may not make any other use of the audio file before it is destroyed, with the FTC prohibiting activities such as behavioral targeting or profiling; identification through voice recognition; or posting, selling or otherwise sharing the file with third parties. As a final limitation, the FTC noted that the exemption does not affect the operator’s COPPA compliance requirements in any other respect.
To read the FTC’s Enforcement Policy Statement, click here.
Why it matters: The new enforcement exemption for certain audio files lightens the burden on operators covered by the requirements of COPPA, but remains subject to several limitations. Importantly, operators must continue to provide clear notice of the collection and use of the files, as well as the deletion policy, and operators may not use the audio files for any other purpose.