By Smriti Chandrashekar
On October 23, 2017, the U.S. Federal Trade Commission (“FTC”) issued guidance on the online collection of certain audio voice recordings from children under the age of 13. The guidance, in the form of an “enforcement policy statement” discusses the application of the Children’s Online Privacy Protection Act (“COPPA”) to such recordings.
In 2013, the FTC amended the COPPA Rule to expand the definition of “personal information” to include, a photograph, video, or audio file that contains a child’s image or voice. The latest guidance provides a path to avoid enforcement of the COPPA Rule for online services that collect audio files containing a child’s voice and convert such audio files to text for the performance of a specific instruction or request.
COPPA requires operators of websites or online services directed at children or that have actual knowledge that a user is a child to obtain verifiable parental consent before collection of a voice recording. While confirming that the COPPA Rule is triggered by such activities, the FTC in its analysis notes that these voice-enabled features may be essential for children with disabilities and for children who have not yet learned to write. The FTC also concludes that these audio files when processed in accordance with FTC guidance, pose little risk to identifying and contacting an individual child.
Based on these potential benefits and low risk to children, the FTC outlines a safe harbor that would protect operators against an enforcement action for not obtaining parental consent before collecting an audio file with child’s voice. The FTC will not take an action to enforce COPPA when operators take the following actions:
a. collect audio files with children’s voice recordings solely to replace written words, for example to perform a search or fulfill a verbal instruction or request;
b. not use such audio files for purposes beyond performing that instruction or request (e.g., behavioral targeting or profiling, identification through voice recognition, or posting, selling, or otherwise sharing the file with third parties);
c. maintain such audio files only for the limited time necessary to perform that instruction or request and then immediately delete such files; and
d. provide a clear notice in the privacy policy disclosing collection and use of audio files containing voice recordings and the operator’s policy for deleting such audio files.
The FTC made it clear that this enforcement exception policy does not affect the need for operators to provide notice and verifiable parental consent in cases where other personal information is collected from children in addition to, or in connection with, audio files such as where an operator requests information through such audio files that would be otherwise considered to be “personal information,” for example, the name of the child.
The Commission issued this policy statement after receiving inquiries from numerous companies about whether such practices of collecting audio files that contain a child’s voice recording triggers COPPA’s requirements. Popular voice-controlled intelligent personal assistant services, such as Amazon Echo and Microsoft’s Cortana, will likely benefit from this exception. The Commission voted 2-0 to approve the new policy statement. The FTC’s press release is available here.