Data Privacy Laws Should Be No-Brainer. Why Is Congress 25 Years Behind?

Commentary

In 1998, the Children’s Online Privacy and Protection Act became law. COPPA was designed with the future of the internet in mind. Dotcoms were fast on their way to a fever pitch, and the flags of a tech revolution whipped in the wind. In the back rooms of the Capitol, a Republican-led assembly of tech-minded lawmakers banded together to harness responsible data for emerging software. COPPA required platforms to maintain reasonable procedures for data collection practices from children under 13. The bill foresaw a world where billions of bits, sought and stored with integrity, could become trillions of dollars. COPPA proved prophetic: Six months after it went into effect, in April of 2000, Google Ads launched.

There has not been a federal consumer privacy law passed since.

The 21st century has brought a transformation of data and platforms unimaginable from the looking glass of 1998, when we were still five years from MySpace, nine years from the iPhone, and two decades from TikTok. (I say “we” here imprecisely: This author was not yet born.) Forget fingerprints and Face ID; the most comprehensive list of collectible online data in 1998 looked like names, photos, and Social Security numbers. Now, children must navigate attention-seeking tools powered by artificial intelligence (AI) and targeting them online, deepfakes sowing distrust, and algorithms spurring an unprecedented mental health crisis. Now, half of all teenagers think social media has a mostly negative effect on kids in their age group, even as teens spend large swaths of their waking day scrolling. Our social platforms, with the mining and monetization mechanisms powering them, are vastly more sophisticated than those that COPPA was written to defend against. We’re trying to defend against fighter jets with cannonballs.

Unlike in 1998, we now know that children cannot easily distinguish between ads and non-ad content. They are more likely than adults to overshare and over-trust information they see; that is destructive enough to our kids in the age of anonymous agents, and more dangerous still in the emergent era of autonomous ones. As AI grows, the data it consumes, the content it trains on, and the domains it governs grow in turn. Some parents wouldn’t be wrong to look upon our digital deluge and resolve to address its risks by keeping their children off social media or smartphones altogether—if their children don’t elect to quit first. But that is not a comprehensive solution for the overwhelming majority of the next generation growing up in an online age, whose digital devices and services are inexorably woven into life. Often, the trap of online harms to teens is that the perceived cost of leaving social media is greater than the cost of staying in. More power to parents and children to control how their data is collected, to be required to provide only what is necessary and not what is profitable, will put privacy and liberty first as we prime online life for an oncoming future.

As another revolution reshapes software, Congress can pass the next generation of privacy law. COPPA 2.0, which patches COPPA’s greatest weaknesses in the era of social media, has had exceptional bipartisan support. The bill passed in 2024 in the Senate 91–3 before withering on the election-season vine. COPPA 2.0 stands on several common sense pillars: creating a parent’s right to erase personal information collected from children, establishing data minimization requirements, and closing loopholes that have enabled bad actors to exploit children. The legislation also extends data privacy protections from children under 13 to those under 16, finally extending the same privacy protections for young children to teenagers and reflecting the hard lessons learned regarding the risks social media and targeted advertising pose to minors.

One year ago, when COPPA 2.0 was first introduced, it was folded into the Kid’s Online Safety Act (KOSA), a far wider-reaching bill, which (among other provisions) would impose a duty of care on social media companies to design features protecting minors from harm on their platforms. KOSA addresses a different set of dangers to children’s safety online from COPPA but acts in tandem. Because KOSA seeks to regulate the design and operation of platforms, it attempts to straddle a thin line dividing free speech and regulation, between restriction and release; important as such problems might be, they warrant a delicate approach. COPPA 2.0, meanwhile, carves a humble but significant protection against targeted advertising and data collection. As AI-generated media proliferates on our timelines, comment sections, and advertisements, COPPA 2.0 provides a no-nonsense evolution of children’s privacy to enable industry to connect data, AI, and operations in keeping with the American aspiration of leaving our next generation safer than our previous.

Experts continue to debate the role of privacy rights in virtual public spaces. Indeed, COPPA 1.0 itself was not without its lasting flaws and continued debate. But there are two responses to hard problems: see it as hard and so walk away or see it as hard and so walk toward. The past complexity of data privacy is even more reason to take an affirmative position for its future, especially now, as the next technological revolution arrives. In March, Sens. Ed Markey (D-Mass.) and Bill Cassidy (R-La.) reintroduced COPPA 2.0. This time, COPPA 2.0 stands on its own feet; KOSA has just been reintroduced separately. The calculus now is easy: Congress should use its bipartisan alignment on children’s safety and its gathering energy to unleash AI to pass COPPA 2.0. My generation needs it.

From RealClearWire

Views expressed in this article are the opinions of the author and do not necessarily reflect the views of The Epoch Times.