While the (federal) law of the land restricts data collection and the use of personal information from minors under the age of 13, plenty of privacy activists would advocate extending those restrictions to all minors under the age of 18. New Jersey is no exception, and is the latest state to consider legislation to restrict data collection and the use of personal information of all New Jersey minors.

Assemblywoman Valerie Vainieri Huttle (D-37) has introduced the Adolescents' Online Privacy Protection Act (A.B. 3752), which would implement restrictions similar to the federal Children's Online Privacy Protection Act (COPPA) for adolescents 13 to 17 years of age (referred to by the bill simply as "adolescents"). It would require "the operator of any Web site or online service directed at adolescents that collects personal information from adolescents or the operator of a Web site or online service that has actual knowledge that it is collecting personal information from an adolescent: (1) to provide notice on the Web site of what information is collected from adolescents by the operator, how the operator uses that information and the operator's disclosure practices for that information; and (2) to obtain verifiable parental consent for the collection, use and disclosure of personal information from adolescents."

Parental Access Requirements
A.B. 3752 would also require "the operator of any Web site or online service directed at adolescents that collects personal information from adolescents or the operator of a Web site or online service that has actual knowledge that it is collecting personal information from an adolescent to provide, upon request of a parent whose adolescent has provided personal information to that website or online service, upon proper identification of that parent, to the parent: (1) a description of the specific types of personal information collected from the adolescent by that operator; (2) the opportunity at any time to refuse to permit the operator's further use or maintenance in retrievable form, or future online collection of personal information from that adolescent: and (3) notwithstanding any other provision of law, a means that is reasonable under the circumstances for the parent to obtain any personal information collected from that adolescent."

Further, A.B. 3752 would prohibit "the operator of any Web site or online service directed at adolescents that collects personal information from adolescents or the operator of a Web site or online service that has actual knowledge that it is collecting personal information from an adolescent from conditioning an adolescent's participation in a game, the offering of a prize, or another activity on the adolescent's disclosing more personal information than is reasonably necessary to participate in the activity."

Data Security Requirements
A.B. 3752 would require "the operator of any Web site or online service directed at adolescents that collects personal information from adolescents or the operator of a Web site or online service that has actual knowledge that it is collecting personal information from an adolescent to establish and maintain reasonable procedures to protect the confidentiality, security and integrity of personal information collected from adolescents."

Exemptions
The bill states that "verifiable parental consent shall not be required in the case of: (1) online contact information collected from an adolescent that is used only to respond directly on a one-time basis to a specific request from the adolescent and is not used to recontact the adolescent and is not maintained in retrievable form by the operator; (2) a request for the name or online contact information of a parent or adolescent that is used for the sole purpose of obtaining parental consent or providing notice under this section and where that information is not maintained in retrievable form by the operator if parental consent is not obtained after a reasonable time; ... (4) the name of the adolescent and online contact information, to the extent reasonably necessary to protect the safety of an adolescent participant on the site...; or (5) the collection, use or dissemination of personal information by the operator of a Web site or online is necessary to: (a) protect the security and integrity of its Web site; (b) take precautions against liability; (c) respond to judicial process; or (d) provide, to the extent permitted under other provisions of law, information to law enforcement agencies or for an investigation on a matter related to public safety."

Liability Protection for Disclosure to Parents
The bill, however, would provide a safe harbor, for businesses acting in good faith and taking reasonable measures to comply with the requirements of the act. According to the bill "[a]n operator of a Web site or online service shall not be held liable under this act for any disclosure made in good faith and following reasonable procedures in responding to a request for disclosure of personal information... to the parent of an adolescent."

Penalties
Anyone who violates A.B. 3752 would be subject to a penalty of not more than $7,500 for the first offense and not more than $15,000 for the second and each subsequent offense.

Definitions

  • "Disclosure" means "the release of personal information collected in identifiable form by an operator for any purpose, except where such information is provided to a person other than the operator who provides support for the internal operation of the Web site and does not disclose or use that information for any other purpose."
  • "Online contact information" means "an e-mail address or another substantially similar identifier that permits direct contact with a person online."
  • "Operator" means "any person who operates a Web site located on the Internet or an online service which collects or maintains personal information from or about the users of or visitors to that website or online service, or on whose behalf such information is collected or maintained, where that Web site or online service is operated for commercial purposes".
  • "Personal information" includes "first and last name, home and other physical address, e-mail address, social security number, telephone number, and any other identifier the division determines permits the physical or online contacting of a specific individual, or information concerning an adolescent or parents of an adolescent that the Web site collects online from the adolescent and combines with an identifier described above."
  • "Verifiable parental consent" means "any reasonable effort, taking into consideration available technology, including a request for authorization for future collection, use and disclosure described in the notice, to ensure that a parent of an adolescent receives notice of the operator's personal information collection, use and disclosure practices, and authorizes the collection, use and disclosure, as applicable, of personal information and the subsequent use of that information before that information is collected from that adolescent."
  • "Web site or online service directed at adolescents" means "a commercial Web site or online service that is targeted at adolescents or that portion of a commercial Web site or online service that is targeted at adolescents, but a commercial Web site or online service, or portion thereof, shall not be deemed directed at adolescents solely for referring or linking to a commercial Web site or online service directed at adolescents using information tools, including a directory, index, reference, pointer or hypertext link."

Conclusion
MRA already recommends that researchers apply COPPA principles to their interactions with anyone under the age of majority (18 in most states), to the extent practicable and depending on the needs of the research process. However, this legislation would not provide any necessary flexibility in that application. That is why MRA will seek to amend or defeat A.B. 3752 in order to defend research with minors. This legislation demonstrates an emerging trend in privacy legislation and interaction with minors. It is prudent that research professionals take pro-active steps mindful of how future legislative action could impact their research practices.