The Federal Trade Commission will allow Internet-connected devices, including children's toys and personal assistants, to record and store the voice of a child under 13 without seeking parental permission so long as it is only for the replacement of written words with voice commands in performing search and other functions on those Internet-connected devices and then destroyed ASAP.
That came Monday (Oct. 23) in an official FTC clarification that was permissible, but that in any other 'net-related use of a child's voice, that is considered sensitive information that requires parental permission, as does the collection of names, addresses or Social Security numbers.
The new guidance clarifies the Children's Online Privacy Protection Rule Update of 2013, when the FTC made photos, videos and audio filed with a child's image or voice part of the personal information category that required parental supervision. That had raised questions about whether that applied to voice commands since the way COPPA was written once
the information was collected it was deemed personal and required parental permission. There was not nuance for voice command info immediately destroyed.
The FTC has now added that nuance, saying "verbal commands may be a necessity for certain consumers, including children who have not yet learned to write, or the disabled." The FTC said there was "little risk"--it did not say no risk--of the file being used to try and contact the child.
"The FTC will not take an enforcement action against an operator for not obtaining parental consent before collecting the audio file with a child’s voice when it is collected solely as a replacement of written words, such as to perform a search or to fulfill a verbal instruction or request – as long as it is held for a brief time and only for that purpose," the FTC advised.
The vote to approve the new guidance was 2-0--the FTC us currently down three commissioners, but does not require a quorum to vote on items, or approve them if it is unanimous.
Parental consent would still be required if the Web site is requesting audio that is otherwise considered personal, like a name or Social Security number, and it must still provide notice of its authorized collection and use of audio files in its privacy policy.
"The FTC has sent another warning shot to kids marketers that they must immediately erase the data when gathered from kids," said Jeff Chester, executive director of the Center for Digital Democracy, one of the earliest and loudest voices for strong children's online privacy protections. "They can use a child’s voice command to make a product respond, but cannot use that information for marketing purposes. However, the FTC is still lagging when it comes to ensuring that Internet of Things products targeting children, such as connected toys like Cayla, have adequate privacy and marketing safeguards. While this new announcement is a potential stop in the right direction, the FTC must issue guidance that limits the ability of digital marketers to unfairly capture a child’s personal data."
“The FTC’s decision makes sense as voice commands become more present in children’s toys," said House COPPA author Sen. Ed Markey (D-Mass.). "But the Commission will need to be vigilant to ensure that companies follow directions and immediately discard any recorded information and do not use it for marketing purposes.”
(Photo via Jeff Kubina's Flickr. Image taken on June 20, 2017 and used per Creative Commons 2.0 license. The photo was cropped to fit 16x9 aspect ratio.)
