Although The Children and Teens’ Online Protection Act – also known as “COPPA 2.0” – is not yet law, either it or a version of it seems likely to become law in the near future. One of the law’s hallmarks is to expand privacy protections currently afforded to children under 13 to children under 17. Interestingly, however, COPPA 2.0 as currently drafted also expands the law’s reach to additional types of online platforms, including “mobile applications.” “Mobile applications” are software programs that run on the operating system of a cell phone, tablet, or similar wireless portable computing device which “includes a service or application offered via a connected device.”
This expansion is likely to bring many types of autonomous and connected vehicles, which frequently interface with users through a mobile application, into the scope of the potential law, raising new questions about how businesses in the sector can and should prepare for COPPA 2.0.
Broadening the protected class of users to under 17 would sweep in an entirely new population of young drivers and consumers of connected and autonomous vehicle app services. Regulated businesses must be prepared with mechanisms to obtain clear, affirmative consent from such users before collecting any personal information from them. Further, such consent cannot be obtained through subversive design techniques known as “dark patterns,” on which the FTC has focused increased attention in recent years.
Among other things, COPPA 2.0 would prohibit covered businesses from processing the personal information of users under 17 for purposes associated with targeted advertising and would also require users under 17 to be able to request the deletion of information that they have provided through the application or which is made available to others through the service. These new prohibitions and rights require the implementation of data handling processes and privacy controls – such as segmentation of data which may not be used under any circumstances for targeted advertising – which businesses may not have currently implemented or planned for.
Although the foregoing is not an exhaustive examination of how COPPA 2.0, or another bill like it, would impact the rapidly developing connected and autonomous vehicle industry, it is enough to make clear that businesses in the sector must be prepared for the change that is coming their way sooner rather than later. Remaining apprised of the latest iteration of COPPA 2.0 and similar bills will help relevant businesses know what to expect and efficiently plan for compliance.