The FTC's proposed changes prohibit the use of behavioral marketing techniques that target children. The revisions also would expand the definition of personal information to include the location data that comes from a cellphone or tablet, the device's unique identification number and data-tracking files known as "cookies."
As evidence for what it said was the need for updated rules, the FTC announced last week it was investigating an unspecified number of app developers which may have violated the law by gathering information from kids without their parent's consent. The agency examined 400 apps directed at kids that it purchased from Apple's iTunes store and Google's apps store, Google Play. The majority failed to inform parents about the types of data the app could gather and who could access it, the FTC said. The agency did not name the companies or say how many it was investigating.
The co-founder of Launchpad Toys in San Francisco, Andy Russell, said he adheres to the current law and supports more stringent privacy protections for preteens. Russell has eight employees, but his apps business is financed with venture capital and isn't yet profitable. Spending money to ensure he meets the new privacy requirements means it will take him that much longer to get into the black.
"I can't speak for other developers, but I think there are a lot of people out there who would say: 'You know what, that's OK. I'm just going to fold up shop,'" Russell said.
Under the proposed changes, permission from the parent of a preteen must be verifiable. Russell said that requirement alone could pose a major hurdle. What will qualify as proof that the consent is legitimate? A driver's license number? A form that is signed and faxed by a parent?
"Nobody uses a fax machine anymore," Russell said. "Verification is a wonderful thing. But to date there just hasn't been a good way to do so."
The need to balance the impact of regulations against their value to the public has long caused conflict between the private sector and policymakers in Washington. The topic of this debate, kids' privacy, has forced app developers and industry representatives to walk a fine line to avoid being seen as insensitive to an issue parents care deeply about.
The FTC has estimated that 500 existing operators of websites and online services and 125 newly formed businesses would be covered by the rule changes. The overall expense for legal and technical fees to meet the new requirements will be $2.7 million, the agency said. That works out to $9,420 for a new business, and just over $3,000 for an existing one, according to the agency's figures.
But costs for new and existing operators will probably be the same, said the Association for Competitive Technology's Reed. Building the required privacy standards into an app already in the market is usually more expensive that adding those features from the start, he said.
Reed said the FTC's estimate of 625 covered businesses is off by thousands. The bottom line, he said, is that compliance costs are likely to be much greater than most apps ever earn for their developers. "The average app in the iTunes store makes around $3,000," Reed said. "So we're at a bit of impasse in terms of being able to convince people to put in the hard work for apps that parents actually want."