For two decades children’s agenda aloofness in the United States has been adapted by a civic law: the Children’s Online Aloofness Protection Act. The law limits how companies can aggregate data on accouchement under 13 years old.

If website operators don’t appropriately adhere to the rules categorical in the act, they could face massive fines. In September, the Federal Trade Commission appear a record-breaking amends adjoin YouTube, in which the Google-owned account agreed to pay $170 million to settle declared COPPA violations.

But the law has also faced criticism, with some assembly and advocates arguing that it doesn’t go far enough. Here’s what it does and does not do.

What COPPA does

COPPA, which went into effect in 2000, requires websites and casework that want to aggregate claimed advice about accouchement under 13—including real names, screen names, or acquaintance information—to post aloofness behavior and get affectionate accord before accepting the data.

In 2013, the FTC broadcast the rules to crave sites or casework to get affectionate permission before accession geolocation information, photos, video, and any “persistent identifiers,” like cookies. To meet the requirement, some casework may have a parent sign a accord form or call a phone number, but many simply ask for age at sign-up and stop users who say they are under 13 from joining.

The law includes fines for companies that fail to comply. In one notable early case, from 2003, Mrs. Fields Accolade and Hershey’s Foods paid civil penalties of $100,000 and $85,000, respectively, to settle allegations that portions of their websites break calm data on children.

A few years later, the fines were already escalating: The social networking account Xanga paid $1 million in 2006 to settle FTC accuse that it had created more than 1.7 million Xanga accounts for users who provided advice advertence they were under 13 years old.

Last year, in addition record for the time, Musical.ly—which has since become TikTok—agreed to pay $5.7 million to settle declared violations of COPPA. That record was anon eclipsed by the $170 million YouTube penalty.  (YouTube has since afflicted its rules apropos children’s content, disabling some appearance and attached data accumulating for videos aimed at kids.)

What COPPA doesn’t do

The law applies to websites that are aimed at accouchement under 13, but that accepted is somewhat vague: If a account uses activated characters in ads, for example, or the service’s accountable matter is article acutely ambrosial to kids, like toys, it might fall under COPPA.

General-interest sites are also amenable for acknowledging with COPPA if they have “actual knowledge” that they’re accession data on kids under 13. The standard, critics argue, is far from onerous: A website may ask for age at sign-up but isn’t appropriate to verify it. Popular casework like YouTube and Facebook ask for age at sign-up, but there’s little endlessly users from lying. Instead, casework say they abolish users’ accounts if moderators actuate the user is under age.

One 2006 animadversion to the FTC, cited in a report on COPPA, noted “there is no believable way, short of locking a child in a closet and not absolution him out until adulthood, to actually anticipate a child from examination age inappropriate websites.”

The FTC itself has also been criticized for the acumen that it’s overly lax in administration the law—advocacy groups have argued that even massive penalties, like the 2019 YouTube fine, don’t go far enough to deter companies from actionable COPPA. The Electronic Aloofness Advice Center, for example, has said “the FTC has not abundantly activated COPPA in recent years, declining to act on complaints in a timely way.” The agency has also been broadly criticized as being under-resourced.

While press releases might trumpet the size of fines, those penalties are still only a cartage ticket for some major companies. YouTube’s $170 actor fine, for example, amounted to just a tiny atom of the company’s 2019 acquirement of $15 billion, which in turn was only about 10 percent of all-embracing Google revenue.

“We think there should be stronger administration of COPPA,” Ariel Fox Johnson, senior admonition for policy and aloofness at Common Sense Media, said. She said the “actual knowledge” accepted could be bargain to “constructive knowledge.” Under that standard, website operators wouldn’t have to be anon abreast that kids are on their service—the FTC would have to prove only that, had companies done their due diligence, they would have known they were accession data on children.

Where will COPPA go next?

As countries like the United Kingdom pass their own youth aloofness laws, admiral have taken a closer look at COPPA. Last year, the FTC appear that it was gluttonous animadversion on abeyant changes to its COPPA administration practices. “In light of rapid abstruse changes that impact the online children’s marketplace, we must ensure COPPA charcoal effective,” FTC administrator Joe Simons said in a July statement. The review has raised apropos that the agency will cave to burden from the tech industry to weaken the law.

Congress has also advised changes. A bill from Rep. Kathy Castor (D-FL) would create new protections for teenagers amid the ages of 13 and 17 and expand COPPA to absolutely accommodate protections for data like biometric, health, and educational information. The bill would also give the FTC power to pursue higher banking penalties.

A altered plan, alien last year by Sen. Edward J. Markey (D-MA) and Sen. Josh Hawley (R-MO), would create what they’ve pitched as a “COPPA 2.0”—an update to the law that would expand the ages covered by the law, acute casework to get user accord before tracking teens amid 13 and 15 years old. Under the bill, the FTC would also create a analysis committed to analytical youth aloofness issues.

“Right now you turn 13, and you’re advised like a 35-year-old online,” Johnson said. The bill would also set a absolute ban on targeted announcement toward accouchement under 13.

“If we can agree on anything,” Markey said in a account announcement his and Hawley’s legislation at the time, “it should be that accouchement deserve strong and able protections online.”

Read next: Call of Duty: Warzone now shows bulletin of abutment for Black Lives Matter

Corona coverage

Read our daily advantage on how the tech industry is responding to the coronavirus and subscribe to our weekly newsletter Coronavirus in Context.