What this year’s COPPA update means for marketers, with privacy expert Debbie Reynolds

“It is a big deal. And I think because there’s been so much other activity in the news, people haven’t really paid attention to it,” Debbie Reynolds, a privacy expert and founder, CEO and chief data privacy officer at Debbie Reynolds Consulting, said on the latest Digiday Podcast episode.

The primary reason the COPPA update warrants attention is that it requires companies to receive verifiable parental consent before they can target ads to children. Clear cut as that requirement may appear to be, complying with it may be more complicated.

“Part of the confusion around privacy and the challenge companies will have with the update of COPPA is trying to figure out how to do things like how do you get verifiable quote-unquote parental consent beyond just having someone click a button to say, ‘Hey, yeah, my parents said, “Yes,”’” said Reynolds.

Case in point: Will ad-supported streaming services start asking for parents to share copies of their driver’s licenses before their families can sit down to watch a show? And will parents be willing to do that?

“Anything that you give to these companies, they’re collecting, they’re storing. And then that brings up, do I trust this company enough to give them my ID, especially seeing the rash of data breaches,” Reynolds said. “It’s just going to be challenging going forward to see how companies really try to handle this issue.”

Here are a few highlights from the conversation, which have been edited for length and clarity.

Are age gates sufficient?

I just did a talk with TikTok yesterday, and I told them that I think in the future it’s going to be more around actual knowledge. The fact that these companies collect so much data about people, maybe you have [an age] gate to start, but as you’re going through these experiences, they may be getting clues about what your actual age is.

The issue with face-based age verification

We’re seeing some companies, like I think Instagram, they’re trying to do like facial selfies to try to discern whether a person is of a certain age. And it’s extremely hard for kids between 13 and 18 [years old] — sometimes you can’t tell how old a kid is really.

Kids’ privacy gains international attention

The U.S. is one of the Five Eyes countries [an intelligence alliance that also includes Australia, Canada, New Zealand and the United Kingdom], and a lot of the Five Eyes countries over the last several years have been really targeting child privacy.

The potential for more stringent kids’ privacy restrictions

In Australia recently, they made an update to their privacy law banning children under 16 from social media. That was a huge shock to a lot of these companies that do gaming and social media. They’re concerned that other countries, like the U.S., the U.K., New Zealand, will do similar types of regulations.