WEBVTT
00:00:00.160 --> 00:00:04.160
KAPA, Children's Online Privacy Protection Act.
00:00:04.400 --> 00:00:20.960
Every day, millions of children go online, they play games, they watch videos, they join virtual classrooms and chat with friends, and behind every screen information is being collected, names, email addresses, photos, even their location.
00:00:21.280 --> 00:00:22.879
So who protects them?
00:00:23.120 --> 00:00:28.480
In 1998, Congress passed the Children's Online Privacy Protection Act.
00:00:28.719 --> 00:00:30.399
Most people just call it COPA.
00:00:30.719 --> 00:00:35.280
It is managed and enforced by the Federal Trade Commission, the FTC.
00:00:35.600 --> 00:00:37.119
Here is the core idea.
00:00:37.359 --> 00:00:50.079
If a commercial website or online service wants personal information from a child under 13, it must get permission first, real, verifiable permission from a parent or guardian.
00:00:50.399 --> 00:00:53.679
CAPA also demands clear privacy policies.
00:00:53.840 --> 00:01:00.479
It limits data collection to only what is necessary, and it requires strict data security.
00:01:00.719 --> 00:01:05.840
Let's break down how it works and why it matters more today than ever before.
00:01:06.159 --> 00:01:07.280
Key points.
00:01:07.519 --> 00:01:10.319
First, who does CAPA actually cover?
00:01:10.560 --> 00:01:17.840
It applies to operators of commercial websites, apps, and online services directed at children under 13.
00:01:18.239 --> 00:01:25.840
It also applies to general audience services that have actual knowledge they are collecting data from a child under 13.
00:01:26.319 --> 00:01:29.519
Second, verifiable parental consent.
00:01:29.760 --> 00:01:40.640
Before a company collects a child's name, email, geolocation, photos, videos, or persistent identifiers, it must get a parent's approval.
00:01:40.879 --> 00:01:43.200
Third, the privacy policy.
00:01:43.439 --> 00:01:51.680
Operators must post a clear, comprehensive, and easily accessible policy describing exactly what they do with data.
00:01:51.920 --> 00:01:53.840
Fourth, parental rights.
00:01:54.079 --> 00:02:01.200
Parents can review their child's information, they can revoke consent, and they can demand that the data be deleted.
00:02:01.439 --> 00:02:03.599
Fifth, data security.
00:02:03.840 --> 00:02:12.319
Companies must maintain reasonable procedures to protect the confidentiality, security, and integrity of everything they collect.
00:02:12.639 --> 00:02:14.479
Sixth, safe harbor.
00:02:14.719 --> 00:02:20.319
Industry groups can apply for FTC approval of their own self-regulatory guidelines.
00:02:20.560 --> 00:02:22.400
And finally, penalties.
00:02:22.639 --> 00:02:26.000
Violations can trigger significant civil penalties.
00:02:26.159 --> 00:02:29.439
The FTC enforces this law actively.
00:02:29.840 --> 00:02:32.479
Effects on administration of justice.
00:02:32.800 --> 00:02:43.680
KAPA lives in the Code of Federal Regulations at 16 CFR Part 312, and it has reshaped how justice is administered in the digital space.
00:02:43.840 --> 00:02:49.280
It created a specialized regulatory framework just for online data privacy.
00:02:49.439 --> 00:02:55.280
It drives real litigation and it forces strict data retention and security policies.
00:02:55.520 --> 00:02:56.800
Look at enforcement.
00:02:56.960 --> 00:03:02.400
The Department of Justice and the FTC actively pursue companies that violate the rule.
00:03:02.719 --> 00:03:11.280
Cases against major platforms, including TikTok, have produced multi-million dollar settlements and ongoing court orders requiring compliance.
00:03:11.439 --> 00:03:14.080
Then came the 2025 amendments.
00:03:14.319 --> 00:03:20.560
Updated rules now require operators to implement formal, written information security programs.
00:03:20.719 --> 00:03:24.319
They also limit the indefinite retention of children's data.
00:03:24.560 --> 00:03:28.000
The meaning of verifiable consent has evolved too.
00:03:28.240 --> 00:03:33.520
Companies must use specialized mechanisms, credit card checks, toll-free numbers.
00:03:33.759 --> 00:03:36.800
The burden of proof sits squarely on the business.
00:03:37.039 --> 00:03:39.439
Enforcement is also spreading outward.
00:03:39.680 --> 00:03:47.840
State attorneys general are increasingly authorized to enforce children's privacy laws, adding a whole new layer of litigation risk.
00:03:48.080 --> 00:03:50.479
Not every expansion goes unchallenged.
00:03:50.719 --> 00:04:01.199
Proposals like COSA and KOPA 2.0, which would cover teens or require age gating, are frequently challenged in court as overbroad or unconstitutional.
00:04:01.439 --> 00:04:04.639
That means real legal battles over free speech.
00:04:04.879 --> 00:04:08.560
Meanwhile, the definition of personal information keeps growing.
00:04:08.800 --> 00:04:15.439
It now includes biometric identifiers like fingerprints and face templates and government-issued IDs.
00:04:15.680 --> 00:04:23.600
There is also a new consent method known as text plus, which lets companies start the parental consent process by text message.
00:04:23.839 --> 00:04:25.839
Security standards have tightened.
00:04:26.000 --> 00:04:33.120
Companies must conduct annual risk assessments, they must designate specific employees to manage information security.
00:04:33.360 --> 00:04:46.879
They must implement robust age verification measures so they do not inadvertently collect data from minors, and strict deletion requirements are forcing businesses to rethink data lifecycle management from top to bottom.
00:04:47.199 --> 00:04:48.800
Benefits to children.
00:04:49.040 --> 00:04:52.240
So, what does all of this actually do for a child?
00:04:52.480 --> 00:04:53.279
Quite a lot.
00:04:53.519 --> 00:04:55.120
Start with privacy control.
00:04:55.600 --> 00:05:03.920
KAPA limits the collection of a child's name, address, email, phone number, and persistent identifiers like IP addresses.
00:05:04.160 --> 00:05:05.920
Next, parental oversight.
00:05:06.079 --> 00:05:12.480
Parents must be notified of data practices and they must approve collection before it happens, not after.
00:05:12.720 --> 00:05:14.959
Then there is safety from tracking.
00:05:15.199 --> 00:05:20.800
The law protects children from unauthorized profiling and from being tracked across websites.
00:05:20.959 --> 00:05:26.800
It also reduces unwanted contact by restricting marketers from targeting children directly.
00:05:27.040 --> 00:05:29.759
Security and retention limits matter too.
00:05:30.000 --> 00:05:37.120
Operators must maintain reasonable procedures to protect children's data, and they cannot keep it longer than necessary.
00:05:37.360 --> 00:05:39.600
Finally, safe participation.
00:05:39.839 --> 00:05:47.040
A child cannot be forced to hand over excessive personal information just to play a game or join an online activity.
00:05:47.279 --> 00:05:54.879
Remember, this applies to dedicated children's sites and to general audience sites that knowingly collect children's data.
00:05:55.120 --> 00:05:57.439
Effects on school administration.
00:05:57.680 --> 00:05:59.360
Now, what about schools?
00:05:59.519 --> 00:06:01.040
Here's the key distinction.
00:06:01.360 --> 00:06:09.680
KAPA applies directly to commercial entities, not to public schools, but schools sit right in the middle, acting as intermediaries.
00:06:09.839 --> 00:06:18.240
Under the rule, a school may consent on behalf of parents, but only for educational purposes and only after notifying parents.
00:06:18.399 --> 00:06:21.279
This is called acting as the agent of consent.
00:06:21.439 --> 00:06:30.160
It allows a district to approve tools like Google Apps for Education or an online curriculum without collecting individual sign-offs from every family.
00:06:30.319 --> 00:06:32.879
That flexibility comes with responsibility.
00:06:33.120 --> 00:06:38.240
Schools must vet third-party apps and websites to confirm they meet KAPA standards.
00:06:38.480 --> 00:06:43.759
Districts typically maintain an approved list of online tools and privacy policies.
00:06:43.920 --> 00:06:48.560
They must ensure vendors never use student data for behavioral advertising.
00:06:48.879 --> 00:06:50.800
Transparency is essential.
00:06:51.040 --> 00:06:57.759
Schools should tell parents which services they use, what data is collected, and what those privacy policies say.
00:06:57.920 --> 00:07:00.079
And there is one important limitation.
00:07:00.399 --> 00:07:07.279
KOPA covers information collected online, it does not cover offline data gathered inside the school building.
00:07:07.600 --> 00:07:10.319
Effects on Advocacy Groups Focus.
00:07:10.639 --> 00:07:13.120
KOPA was written in 1998.
00:07:13.279 --> 00:07:15.519
The internet has changed a little since then.
00:07:15.759 --> 00:07:17.519
Advocacy groups have noticed.
00:07:17.759 --> 00:07:22.319
Their central push is to strengthen the law against modern data surveillance.
00:07:22.480 --> 00:07:25.519
One major goal is extending age protection.
00:07:25.680 --> 00:07:31.199
They want the limit raised beyond 13 because teenagers' data is heavily exploited.
00:07:31.439 --> 00:07:34.000
Another is a targeted advertising ban.
00:07:34.240 --> 00:07:40.879
Advocates want behavioral advertising to children prohibited and the monetization of children's data limited.
00:07:41.120 --> 00:07:43.199
Data minimization is next.
00:07:43.360 --> 00:07:49.199
Stop companies from collecting, selling, or keeping information that is not necessary for the service.
00:07:49.439 --> 00:07:51.439
Then there is modern technology.
00:07:51.600 --> 00:07:59.439
Advocates want KAPA clearly applied to AI-driven big data platforms, to virtual reality, and to smart toys.
00:07:59.600 --> 00:08:09.199
They're also pushing for parental empowerment, giving parents better tools to review and immediately delete data collected through apps, social media, and games.
00:08:09.519 --> 00:08:23.199
Add stricter retention and deletion policies, refined methods of verifiable parental consent, especially for sharing data with third parties, and increased oversight of those self-regulatory safe harbor programs.
00:08:23.519 --> 00:08:24.959
Evolving law.
00:08:25.199 --> 00:08:26.879
So where is this law heading?
00:08:27.120 --> 00:08:35.440
In early 2025, the FTC finalized major updates to the Copper Rule, effective June 23, 2025.
00:08:35.679 --> 00:08:39.360
This was the first significant overhaul since 2013.
00:08:39.679 --> 00:08:41.120
Start with retention.
00:08:41.360 --> 00:08:45.759
Operators can no longer hold children's personal information indefinitely.
00:08:46.000 --> 00:08:49.440
Retention must be limited to what is reasonably necessary.
00:08:49.679 --> 00:08:51.679
Then artificial intelligence.
00:08:51.919 --> 00:09:00.639
Separate, verifiable parental consent is now required before sharing a child's data with third parties for non-integral purposes.
00:09:00.799 --> 00:09:04.080
That specifically includes training AI algorithms.
00:09:04.320 --> 00:09:06.559
Parental rights expanded as well.
00:09:06.720 --> 00:09:14.399
Parents must be able to revoke consent, and refusing to consent cannot be punished by cutting off access to the service.
00:09:14.720 --> 00:09:22.480
The FTC also introduced new verification methods, including photo identification and text plus verification.
00:09:22.720 --> 00:09:23.919
Watch the calendar.
00:09:24.080 --> 00:09:32.879
Although the rule took effect in June 2025, most compliance obligations for businesses land by April 22, 2026.
00:09:33.200 --> 00:09:40.879
Looking further ahead, proposed legislation known as COPPA 2.0 would expand protections to teens under 17.
00:09:41.039 --> 00:09:48.720
It would also broaden the definition of protected personal information to include biometrics and persistent identifiers.
00:09:48.960 --> 00:09:53.919
The law is still growing, and so is the protection it offers every child online.
00:00:00.160 --> 00:00:04.160
KAPA, Children's Online Privacy Protection Act.
00:00:04.400 --> 00:00:20.960
Every day, millions of children go online, they play games, they watch videos, they join virtual classrooms and chat with friends, and behind every screen information is being collected, names, email addresses, photos, even their location.
00:00:21.280 --> 00:00:22.879
So who protects them?
00:00:23.120 --> 00:00:28.480
In 1998, Congress passed the Children's Online Privacy Protection Act.
00:00:28.719 --> 00:00:30.399
Most people just call it COPA.
00:00:30.719 --> 00:00:35.280
It is managed and enforced by the Federal Trade Commission, the FTC.
00:00:35.600 --> 00:00:37.119
Here is the core idea.
00:00:37.359 --> 00:00:50.079
If a commercial website or online service wants personal information from a child under 13, it must get permission first, real, verifiable permission from a parent or guardian.
00:00:50.399 --> 00:00:53.679
CAPA also demands clear privacy policies.
00:00:53.840 --> 00:01:00.479
It limits data collection to only what is necessary, and it requires strict data security.
00:01:00.719 --> 00:01:05.840
Let's break down how it works and why it matters more today than ever before.
00:01:06.159 --> 00:01:07.280
Key points.
00:01:07.519 --> 00:01:10.319
First, who does CAPA actually cover?
00:01:10.560 --> 00:01:17.840
It applies to operators of commercial websites, apps, and online services directed at children under 13.
00:01:18.239 --> 00:01:25.840
It also applies to general audience services that have actual knowledge they are collecting data from a child under 13.
00:01:26.319 --> 00:01:29.519
Second, verifiable parental consent.
00:01:29.760 --> 00:01:40.640
Before a company collects a child's name, email, geolocation, photos, videos, or persistent identifiers, it must get a parent's approval.
00:01:40.879 --> 00:01:43.200
Third, the privacy policy.
00:01:43.439 --> 00:01:51.680
Operators must post a clear, comprehensive, and easily accessible policy describing exactly what they do with data.
00:01:51.920 --> 00:01:53.840
Fourth, parental rights.
00:01:54.079 --> 00:02:01.200
Parents can review their child's information, they can revoke consent, and they can demand that the data be deleted.
00:02:01.439 --> 00:02:03.599
Fifth, data security.
00:02:03.840 --> 00:02:12.319
Companies must maintain reasonable procedures to protect the confidentiality, security, and integrity of everything they collect.
00:02:12.639 --> 00:02:14.479
Sixth, safe harbor.
00:02:14.719 --> 00:02:20.319
Industry groups can apply for FTC approval of their own self-regulatory guidelines.
00:02:20.560 --> 00:02:22.400
And finally, penalties.
00:02:22.639 --> 00:02:26.000
Violations can trigger significant civil penalties.
00:02:26.159 --> 00:02:29.439
The FTC enforces this law actively.
00:02:29.840 --> 00:02:32.479
Effects on administration of justice.
00:02:32.800 --> 00:02:43.680
KAPA lives in the Code of Federal Regulations at 16 CFR Part 312, and it has reshaped how justice is administered in the digital space.
00:02:43.840 --> 00:02:49.280
It created a specialized regulatory framework just for online data privacy.
00:02:49.439 --> 00:02:55.280
It drives real litigation and it forces strict data retention and security policies.
00:02:55.520 --> 00:02:56.800
Look at enforcement.
00:02:56.960 --> 00:03:02.400
The Department of Justice and the FTC actively pursue companies that violate the rule.
00:03:02.719 --> 00:03:11.280
Cases against major platforms, including TikTok, have produced multi-million dollar settlements and ongoing court orders requiring compliance.
00:03:11.439 --> 00:03:14.080
Then came the 2025 amendments.
00:03:14.319 --> 00:03:20.560
Updated rules now require operators to implement formal, written information security programs.
00:03:20.719 --> 00:03:24.319
They also limit the indefinite retention of children's data.
00:03:24.560 --> 00:03:28.000
The meaning of verifiable consent has evolved too.
00:03:28.240 --> 00:03:33.520
Companies must use specialized mechanisms, credit card checks, toll-free numbers.
00:03:33.759 --> 00:03:36.800
The burden of proof sits squarely on the business.
00:03:37.039 --> 00:03:39.439
Enforcement is also spreading outward.
00:03:39.680 --> 00:03:47.840
State attorneys general are increasingly authorized to enforce children's privacy laws, adding a whole new layer of litigation risk.
00:03:48.080 --> 00:03:50.479
Not every expansion goes unchallenged.
00:03:50.719 --> 00:04:01.199
Proposals like COSA and KOPA 2.0, which would cover teens or require age gating, are frequently challenged in court as overbroad or unconstitutional.
00:04:01.439 --> 00:04:04.639
That means real legal battles over free speech.
00:04:04.879 --> 00:04:08.560
Meanwhile, the definition of personal information keeps growing.
00:04:08.800 --> 00:04:15.439
It now includes biometric identifiers like fingerprints and face templates and government-issued IDs.
00:04:15.680 --> 00:04:23.600
There is also a new consent method known as text plus, which lets companies start the parental consent process by text message.
00:04:23.839 --> 00:04:25.839
Security standards have tightened.
00:04:26.000 --> 00:04:33.120
Companies must conduct annual risk assessments, they must designate specific employees to manage information security.
00:04:33.360 --> 00:04:46.879
They must implement robust age verification measures so they do not inadvertently collect data from minors, and strict deletion requirements are forcing businesses to rethink data lifecycle management from top to bottom.
00:04:47.199 --> 00:04:48.800
Benefits to children.
00:04:49.040 --> 00:04:52.240
So, what does all of this actually do for a child?
00:04:52.480 --> 00:04:53.279
Quite a lot.
00:04:53.519 --> 00:04:55.120
Start with privacy control.
00:04:55.600 --> 00:05:03.920
KAPA limits the collection of a child's name, address, email, phone number, and persistent identifiers like IP addresses.
00:05:04.160 --> 00:05:05.920
Next, parental oversight.
00:05:06.079 --> 00:05:12.480
Parents must be notified of data practices and they must approve collection before it happens, not after.
00:05:12.720 --> 00:05:14.959
Then there is safety from tracking.
00:05:15.199 --> 00:05:20.800
The law protects children from unauthorized profiling and from being tracked across websites.
00:05:20.959 --> 00:05:26.800
It also reduces unwanted contact by restricting marketers from targeting children directly.
00:05:27.040 --> 00:05:29.759
Security and retention limits matter too.
00:05:30.000 --> 00:05:37.120
Operators must maintain reasonable procedures to protect children's data, and they cannot keep it longer than necessary.
00:05:37.360 --> 00:05:39.600
Finally, safe participation.
00:05:39.839 --> 00:05:47.040
A child cannot be forced to hand over excessive personal information just to play a game or join an online activity.
00:05:47.279 --> 00:05:54.879
Remember, this applies to dedicated children's sites and to general audience sites that knowingly collect children's data.
00:05:55.120 --> 00:05:57.439
Effects on school administration.
00:05:57.680 --> 00:05:59.360
Now, what about schools?
00:05:59.519 --> 00:06:01.040
Here's the key distinction.
00:06:01.360 --> 00:06:09.680
KAPA applies directly to commercial entities, not to public schools, but schools sit right in the middle, acting as intermediaries.
00:06:09.839 --> 00:06:18.240
Under the rule, a school may consent on behalf of parents, but only for educational purposes and only after notifying parents.
00:06:18.399 --> 00:06:21.279
This is called acting as the agent of consent.
00:06:21.439 --> 00:06:30.160
It allows a district to approve tools like Google Apps for Education or an online curriculum without collecting individual sign-offs from every family.
00:06:30.319 --> 00:06:32.879
That flexibility comes with responsibility.
00:06:33.120 --> 00:06:38.240
Schools must vet third-party apps and websites to confirm they meet KAPA standards.
00:06:38.480 --> 00:06:43.759
Districts typically maintain an approved list of online tools and privacy policies.
00:06:43.920 --> 00:06:48.560
They must ensure vendors never use student data for behavioral advertising.
00:06:48.879 --> 00:06:50.800
Transparency is essential.
00:06:51.040 --> 00:06:57.759
Schools should tell parents which services they use, what data is collected, and what those privacy policies say.
00:06:57.920 --> 00:07:00.079
And there is one important limitation.
00:07:00.399 --> 00:07:07.279
KOPA covers information collected online, it does not cover offline data gathered inside the school building.
00:07:07.600 --> 00:07:10.319
Effects on Advocacy Groups Focus.
00:07:10.639 --> 00:07:13.120
KOPA was written in 1998.
00:07:13.279 --> 00:07:15.519
The internet has changed a little since then.
00:07:15.759 --> 00:07:17.519
Advocacy groups have noticed.
00:07:17.759 --> 00:07:22.319
Their central push is to strengthen the law against modern data surveillance.
00:07:22.480 --> 00:07:25.519
One major goal is extending age protection.
00:07:25.680 --> 00:07:31.199
They want the limit raised beyond 13 because teenagers' data is heavily exploited.
00:07:31.439 --> 00:07:34.000
Another is a targeted advertising ban.
00:07:34.240 --> 00:07:40.879
Advocates want behavioral advertising to children prohibited and the monetization of children's data limited.
00:07:41.120 --> 00:07:43.199
Data minimization is next.
00:07:43.360 --> 00:07:49.199
Stop companies from collecting, selling, or keeping information that is not necessary for the service.
00:07:49.439 --> 00:07:51.439
Then there is modern technology.
00:07:51.600 --> 00:07:59.439
Advocates want KAPA clearly applied to AI-driven big data platforms, to virtual reality, and to smart toys.
00:07:59.600 --> 00:08:09.199
They're also pushing for parental empowerment, giving parents better tools to review and immediately delete data collected through apps, social media, and games.
00:08:09.519 --> 00:08:23.199
Add stricter retention and deletion policies, refined methods of verifiable parental consent, especially for sharing data with third parties, and increased oversight of those self-regulatory safe harbor programs.
00:08:23.519 --> 00:08:24.959
Evolving law.
00:08:25.199 --> 00:08:26.879
So where is this law heading?
00:08:27.120 --> 00:08:35.440
In early 2025, the FTC finalized major updates to the Copper Rule, effective June 23, 2025.
00:08:35.679 --> 00:08:39.360
This was the first significant overhaul since 2013.
00:08:39.679 --> 00:08:41.120
Start with retention.
00:08:41.360 --> 00:08:45.759
Operators can no longer hold children's personal information indefinitely.
00:08:46.000 --> 00:08:49.440
Retention must be limited to what is reasonably necessary.
00:08:49.679 --> 00:08:51.679
Then artificial intelligence.
00:08:51.919 --> 00:09:00.639
Separate, verifiable parental consent is now required before sharing a child's data with third parties for non-integral purposes.
00:09:00.799 --> 00:09:04.080
That specifically includes training AI algorithms.
00:09:04.320 --> 00:09:06.559
Parental rights expanded as well.
00:09:06.720 --> 00:09:14.399
Parents must be able to revoke consent, and refusing to consent cannot be punished by cutting off access to the service.
00:09:14.720 --> 00:09:22.480
The FTC also introduced new verification methods, including photo identification and text plus verification.
00:09:22.720 --> 00:09:23.919
Watch the calendar.
00:09:24.080 --> 00:09:32.879
Although the rule took effect in June 2025, most compliance obligations for businesses land by April 22, 2026.
00:09:33.200 --> 00:09:40.879
Looking further ahead, proposed legislation known as COPPA 2.0 would expand protections to teens under 17.
00:09:41.039 --> 00:09:48.720
It would also broaden the definition of protected personal information to include biometrics and persistent identifiers.
00:09:48.960 --> 00:09:53.919
The law is still growing, and so is the protection it offers every child online.
