82_FR_58311 82 FR 58076 - Enforcement Policy Statement Regarding the Applicability of the COPPA Rule to the Collection and Use of Voice Recordings

82 FR 58076 - Enforcement Policy Statement Regarding the Applicability of the COPPA Rule to the Collection and Use of Voice Recordings

FEDERAL TRADE COMMISSION

Federal Register Volume 82, Issue 235 (December 8, 2017)

Page Range58076-58077
FR Document2017-26509

The Federal Trade Commission has issued an Enforcement Policy Statement regarding the applicability of the Children's Online Privacy Protection Act (``COPPA'') Rule to the collection of voice recordings. The Statement describes certain circumstances in which the Commission will not bring an enforcement action against an operator on the basis of the operator having collected an audio file containing a child's voice without first obtaining verifiable parental consent.

Federal Register, Volume 82 Issue 235 (Friday, December 8, 2017)
[Federal Register Volume 82, Number 235 (Friday, December 8, 2017)]
[Rules and Regulations]
[Pages 58076-58077]
From the Federal Register Online  [www.thefederalregister.org]
[FR Doc No: 2017-26509]



[[Page 58075]]

Vol. 82

Friday,

No. 235

December 8, 2017

Part III





 Federal Trade Commission





-----------------------------------------------------------------------





16 CFR Part 312





 Enforcement Policy Statement Regarding the Applicability of the COPPA 
Rule to the Collection and Use of Voice Recordings; Policy Statement; 
Rule

Federal Register / Vol. 82, No. 235 / Friday, December 8, 2017 / 
Rules and Regulations

[[Page 58076]]


-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION

16 CFR Part 312


Enforcement Policy Statement Regarding the Applicability of the 
COPPA Rule to the Collection and Use of Voice Recordings

AGENCY: Federal Trade Commission.

ACTION: Commission policy statement.

-----------------------------------------------------------------------

SUMMARY: The Federal Trade Commission has issued an Enforcement Policy 
Statement regarding the applicability of the Children's Online Privacy 
Protection Act (``COPPA'') Rule to the collection of voice recordings. 
The Statement describes certain circumstances in which the Commission 
will not bring an enforcement action against an operator on the basis 
of the operator having collected an audio file containing a child's 
voice without first obtaining verifiable parental consent.

DATES: The Commission announced the issuance of the Statement on 
October 23, 2017.

FOR FURTHER INFORMATION CONTACT: Kristin Cohen (202-326-2276) and Peder 
Magee (202-326-3538), Bureau of Consumer Protection, 600 Pennsylvania 
Avenue NW., Washington, DC 20580.

SUPPLEMENTARY INFORMATION: 

Enforcement Policy Statement Regarding the Applicability of the COPPA 
Rule to the Collection and Use of Voice Recordings

    On November 3, 1999, the Federal Trade Commission (``FTC'' or 
``Commission'') issued its Children's Online Privacy Protection Rule 
(``COPPA Rule'' or ``Rule''). The Rule implements the Children's Online 
Privacy Protection Act, 15 U.S.C. 6501-6505, and requires, among other 
things, operators of commercial Web sites or online services directed 
to children, and operators with actual knowledge they are collecting 
personal information from children, to provide notice of their 
information practices to parents and to obtain verifiable parental 
consent before collecting a child's personal information. The Rule 
defined ``personal information'' to include data such as name, address, 
and social security number.
    In 2013, the FTC amended the COPPA Rule and added several new types 
of data to the definition of personal information, including a 
photograph, video, or audio file that contains a child's image or 
voice.\1\ Discussing the 2013 amendments, the Commission explained that 
``the very personal nature'' of such files supported the Commission's 
finding that they met the standard for personal information set forth 
in the COPPA statute because they ``permit the physical or online 
contacting of a specific individual.'' 78 FR 3972, 3982 (Jan. 17, 
2013). Therefore, under the amended Rule, a covered operator must 
provide notice and obtain verifiable parental consent before it 
collects any of these types of personal information from a child. The 
Commission's rationale in amending the Rule was to keep pace with 
changes to technology, children's increased use of mobile devices, and 
the development of new business models that did not exist when the 
Commission issued the Rule in 1999.
---------------------------------------------------------------------------

    \1\ The prior definition included photographs only when combined 
with additional information that would allow physical or online 
contacting of the child.
---------------------------------------------------------------------------

    Since amending the Rule, the Commission has received inquiries from 
a number of companies about whether the practice of collecting audio 
files that contain a child's voice, immediately converting the audio to 
text, and deleting the file containing the voice recording triggers 
COPPA's requirements. In particular, these companies have requested 
that collection of audio files in connection with a search or similar 
function be exempted from COPPA's verifiable parental consent 
requirement when the audio file is briefly maintained in order to 
fulfill the request and then deleted almost instantaneously.
    In relevant part, the Rule defines ``collects or collection'' to 
mean the gathering of any personal information from a child by any 
means, including but not limited to:
     Requesting, prompting, or encouraging a child to submit 
personal information online;
     Enabling a child to make personal information publicly 
available in identifiable form. An operator shall not be considered to 
have collected personal information under this paragraph if it takes 
reasonable steps to delete all or virtually all personal information 
from a child's postings before they are made public and also to delete 
such information from its records.\2\
---------------------------------------------------------------------------

    \2\ The third prong of the definition relates to passive 
tracking of a child online and is not relevant to this discussion.
---------------------------------------------------------------------------

    The Commission views the collection from a child of an audio file 
when the voice is being used solely as a replacement for written words, 
such as to convert voice to text in order to perform a search, as 
falling into the first prong of the definition of ``collection'' 
because the operator is ``requesting, prompting, or encouraging'' the 
child to submit personal information. Because this practice falls into 
the first category of ``collection,'' the Rule does not provide a 
mechanism for the operator to avoid being deemed to have collected the 
personal information by deleting it. In other words, as soon as the 
operator gathers the audio file, it has collected it for purposes of 
the COPPA Rule regardless of how long the operator maintains possession 
of it. The second prong of the definition is meant to address the 
inadvertent collection of personal information, such as information 
that might be collected incidentally in an open text field, which is 
why the Rule specifically allows an operator to be deemed not to have 
collected the personal information if it takes reasonable measures to 
delete the information.
    Nevertheless, the Commission recognizes the value of using voice as 
a replacement for written words in performing search and other 
functions on internet-connected devices. Verbal commands may be a 
necessity for certain consumers, including children who have not yet 
learned to write, or the disabled. In addition, when the operator only 
uses the audio file as a replacement for written words, such as to 
effectuate an instruction or request, and only maintains the file long 
enough to complete that purpose and then immediately deletes it, there 
is little risk the audio file will be used to contact an individual 
child.
    As such, when a covered operator collects an audio file containing 
a child's voice solely as a replacement for written words, such as to 
perform a search or fulfill a verbal instruction or request, but only 
maintains the file for the brief time necessary for that purpose, the 
FTC would not take an enforcement action against the operator on the 
basis that the operator collected the audio file without first 
obtaining verifiable parental consent. Such an operator, however, must 
provide the notice required by the COPPA Rule, including clear notice 
of its collection and use of audio files and its deletion policy, in 
its privacy policy.
    There are important limitations on this non-enforcement policy. 
First, this non-enforcement policy is not applicable when the operator 
requests information via voice that otherwise would be considered 
personal information under the Rule, such as name, for example. Second, 
as noted above, an operator must provide clear notice of its collection 
and use of the audio files and its deletion policy in its privacy 
policy. Otherwise, parents may have no way to know prior to download or 
purchase whether audio files are

[[Page 58077]]

being collected, and if they later learn that audio files are being 
collected, they would have no reason to know that the files are being 
collected only for a limited purpose and immediately destroyed. Third, 
the operator may not make any other use of the audio file in the brief 
period before the file is destroyed--for example, for behavioral 
targeting or profiling purposes, for identification purposes through 
voice recognition, or for posting, selling, or otherwise sharing the 
file with third parties. Finally, this policy does not affect the 
operator's COPPA compliance requirements in any other respect. For 
example, the operator must provide notice and obtain verifiable 
parental consent if types of personal information other than audio 
files are also collected.

    By direction of the Commission.
Donald S. Clark,
Secretary.
[FR Doc. 2017-26509 Filed 12-7-17; 8:45 am]
 BILLING CODE 6750-01-P



                                               58076             Federal Register / Vol. 82, No. 235 / Friday, December 8, 2017 / Rules and Regulations

                                               FEDERAL TRADE COMMISSION                                2013 amendments, the Commission                       submit personal information. Because
                                                                                                       explained that ‘‘the very personal                    this practice falls into the first category
                                               16 CFR Part 312                                         nature’’ of such files supported the                  of ‘‘collection,’’ the Rule does not
                                                                                                       Commission’s finding that they met the                provide a mechanism for the operator to
                                               Enforcement Policy Statement                            standard for personal information set                 avoid being deemed to have collected
                                               Regarding the Applicability of the                      forth in the COPPA statute because they               the personal information by deleting it.
                                               COPPA Rule to the Collection and Use                    ‘‘permit the physical or online                       In other words, as soon as the operator
                                               of Voice Recordings                                     contacting of a specific individual.’’ 78             gathers the audio file, it has collected it
                                               AGENCY:    Federal Trade Commission.                    FR 3972, 3982 (Jan. 17, 2013). Therefore,             for purposes of the COPPA Rule
                                               ACTION:   Commission policy statement.                  under the amended Rule, a covered                     regardless of how long the operator
                                                                                                       operator must provide notice and obtain               maintains possession of it. The second
                                               SUMMARY:   The Federal Trade                            verifiable parental consent before it                 prong of the definition is meant to
                                               Commission has issued an Enforcement                    collects any of these types of personal               address the inadvertent collection of
                                               Policy Statement regarding the                          information from a child. The                         personal information, such as
                                               applicability of the Children’s Online                  Commission’s rationale in amending the                information that might be collected
                                               Privacy Protection Act (‘‘COPPA’’) Rule                 Rule was to keep pace with changes to                 incidentally in an open text field, which
                                               to the collection of voice recordings.                  technology, children’s increased use of               is why the Rule specifically allows an
                                               The Statement describes certain                         mobile devices, and the development of                operator to be deemed not to have
                                               circumstances in which the Commission                   new business models that did not exist                collected the personal information if it
                                               will not bring an enforcement action                    when the Commission issued the Rule                   takes reasonable measures to delete the
                                               against an operator on the basis of the                 in 1999.                                              information.
                                               operator having collected an audio file                    Since amending the Rule, the                          Nevertheless, the Commission
                                               containing a child’s voice without first                Commission has received inquiries from                recognizes the value of using voice as a
                                               obtaining verifiable parental consent.                  a number of companies about whether                   replacement for written words in
                                               DATES: The Commission announced the                     the practice of collecting audio files that           performing search and other functions
                                               issuance of the Statement on October                    contain a child’s voice, immediately                  on internet-connected devices. Verbal
                                               23, 2017.                                               converting the audio to text, and                     commands may be a necessity for
                                               FOR FURTHER INFORMATION CONTACT:                        deleting the file containing the voice                certain consumers, including children
                                               Kristin Cohen (202–326–2276) and                        recording triggers COPPA’s                            who have not yet learned to write, or the
                                               Peder Magee (202–326–3538), Bureau of                   requirements. In particular, these                    disabled. In addition, when the operator
                                               Consumer Protection, 600 Pennsylvania                   companies have requested that                         only uses the audio file as a replacement
                                               Avenue NW., Washington, DC 20580.                       collection of audio files in connection               for written words, such as to effectuate
                                                                                                       with a search or similar function be                  an instruction or request, and only
                                               SUPPLEMENTARY INFORMATION:
                                                                                                       exempted from COPPA’s verifiable                      maintains the file long enough to
                                               Enforcement Policy Statement                            parental consent requirement when the                 complete that purpose and then
                                               Regarding the Applicability of the                      audio file is briefly maintained in order             immediately deletes it, there is little risk
                                               COPPA Rule to the Collection and Use                    to fulfill the request and then deleted               the audio file will be used to contact an
                                               of Voice Recordings                                     almost instantaneously.                               individual child.
                                                                                                          In relevant part, the Rule defines                    As such, when a covered operator
                                                  On November 3, 1999, the Federal
                                                                                                       ‘‘collects or collection’’ to mean the                collects an audio file containing a
                                               Trade Commission (‘‘FTC’’ or
                                                                                                       gathering of any personal information                 child’s voice solely as a replacement for
                                               ‘‘Commission’’) issued its Children’s
                                                                                                       from a child by any means, including                  written words, such as to perform a
                                               Online Privacy Protection Rule
                                                                                                       but not limited to:                                   search or fulfill a verbal instruction or
                                               (‘‘COPPA Rule’’ or ‘‘Rule’’). The Rule
                                                                                                          • Requesting, prompting, or                        request, but only maintains the file for
                                               implements the Children’s Online
                                                                                                       encouraging a child to submit personal                the brief time necessary for that
                                               Privacy Protection Act, 15 U.S.C. 6501–
                                                                                                       information online;                                   purpose, the FTC would not take an
                                               6505, and requires, among other things,
                                                                                                          • Enabling a child to make personal                enforcement action against the operator
                                               operators of commercial Web sites or
                                                                                                       information publicly available in                     on the basis that the operator collected
                                               online services directed to children, and                                                                     the audio file without first obtaining
                                               operators with actual knowledge they                    identifiable form. An operator shall not
                                                                                                       be considered to have collected personal              verifiable parental consent. Such an
                                               are collecting personal information from                                                                      operator, however, must provide the
                                               children, to provide notice of their                    information under this paragraph if it
                                                                                                       takes reasonable steps to delete all or               notice required by the COPPA Rule,
                                               information practices to parents and to                                                                       including clear notice of its collection
                                               obtain verifiable parental consent before               virtually all personal information from a
                                                                                                       child’s postings before they are made                 and use of audio files and its deletion
                                               collecting a child’s personal                                                                                 policy, in its privacy policy.
                                               information. The Rule defined                           public and also to delete such
                                                                                                                                                                There are important limitations on
                                               ‘‘personal information’’ to include data                information from its records.2
                                                                                                          The Commission views the collection                this non-enforcement policy. First, this
                                               such as name, address, and social                                                                             non-enforcement policy is not
                                               security number.                                        from a child of an audio file when the
                                                                                                       voice is being used solely as a                       applicable when the operator requests
                                                  In 2013, the FTC amended the COPPA                                                                         information via voice that otherwise
                                               Rule and added several new types of                     replacement for written words, such as
                                                                                                                                                             would be considered personal
                                               data to the definition of personal                      to convert voice to text in order to
                                                                                                                                                             information under the Rule, such as
sradovich on DSK3GMQ082PROD with RULES3




                                               information, including a photograph,                    perform a search, as falling into the first
                                                                                                                                                             name, for example. Second, as noted
                                               video, or audio file that contains a                    prong of the definition of ‘‘collection’’
                                                                                                                                                             above, an operator must provide clear
                                               child’s image or voice.1 Discussing the                 because the operator is ‘‘requesting,
                                                                                                                                                             notice of its collection and use of the
                                                                                                       prompting, or encouraging’’ the child to
                                                 1 The prior definition included photographs only
                                                                                                                                                             audio files and its deletion policy in its
                                               when combined with additional information that            2 The third prong of the definition relates to      privacy policy. Otherwise, parents may
                                               would allow physical or online contacting of the        passive tracking of a child online and is not         have no way to know prior to download
                                               child.                                                  relevant to this discussion.                          or purchase whether audio files are


                                          VerDate Sep<11>2014   20:58 Dec 07, 2017   Jkt 244001   PO 00000   Frm 00002   Fmt 4701   Sfmt 4700   E:\FR\FM\08DER3.SGM   08DER3


                                                                 Federal Register / Vol. 82, No. 235 / Friday, December 8, 2017 / Rules and Regulations                                              58077

                                               being collected, and if they later learn                targeting or profiling purposes, for                  consent if types of personal information
                                               that audio files are being collected, they              identification purposes through voice                 other than audio files are also collected.
                                               would have no reason to know that the                   recognition, or for posting, selling, or                By direction of the Commission.
                                               files are being collected only for a                    otherwise sharing the file with third
                                               limited purpose and immediately                         parties. Finally, this policy does not                Donald S. Clark,
                                               destroyed. Third, the operator may not                  affect the operator’s COPPA compliance                Secretary.
                                               make any other use of the audio file in                 requirements in any other respect. For                [FR Doc. 2017–26509 Filed 12–7–17; 8:45 am]
                                               the brief period before the file is                     example, the operator must provide                    BILLING CODE 6750–01–P
                                               destroyed—for example, for behavioral                   notice and obtain verifiable parental
sradovich on DSK3GMQ082PROD with RULES3




                                          VerDate Sep<11>2014   20:58 Dec 07, 2017   Jkt 244001   PO 00000   Frm 00003   Fmt 4701   Sfmt 9990   E:\FR\FM\08DER3.SGM   08DER3



Document Created: 2017-12-08 01:43:31
Document Modified: 2017-12-08 01:43:31
CategoryRegulatory Information
CollectionFederal Register
sudoc ClassAE 2.7:
GS 4.107:
AE 2.106:
PublisherOffice of the Federal Register, National Archives and Records Administration
SectionRules and Regulations
ActionCommission policy statement.
DatesThe Commission announced the issuance of the Statement on October 23, 2017.
ContactKristin Cohen (202-326-2276) and Peder Magee (202-326-3538), Bureau of Consumer Protection, 600 Pennsylvania Avenue NW., Washington, DC 20580.
FR Citation82 FR 58076 

2025 Federal Register | Disclaimer | Privacy Policy
USC | CFR | eCFR