[iDC] Why Parents Help Children Violate Facebook’s 13+ Rule

[Mark Andrejevic]

Thanks to danah for the thoughtful response,

I think in the end, your study does a good job of demonstrating that the
attempt by COPPA to address issues of maturity/safety online is problematic
in a variety of ways -- including those associated with the examples you
cite in your most recent post.

What seems less convincing, based on your own findings, is the broader
attempt to contest the notion of age-related restrictions of any kind on
information collection. If, as you reasonably argue, legal regulation (or
as you put it, "Protectionism from the State"), is ineffective when it
doesn't accord with social norms, your own study indicates that the
majority of parents (57 percent) say they support restrictions on data
collection (tracking?) even if it means shutting down their children's
access to social networking sites. That seems like a pretty significant
finding. The "rock-solid" education plan you propose would most likely
raise this percentage, based on what we've seen in the research on
attitudes to tracking so far (again, Chris Hoofnagle and Joe Turow's work
is extremely helpful on this).

Empowering people to speak out against what is not right often leads to
legal reforms -- and I wouldn't want to relegate those to the vilified
category of "Protectionism from the State". A while back the FTC was
talking about requiring Web sites to include a "no track" option; That
would certainly give parents (and the rest of us) a choice, but  it would
likely be disparaged by industry as over-reaching by the heavy hand of the
state (and, of course, a threat to the online business model -- which tells
us something about what types of choices the market makes available and
what kinds it shuts down).

General claims like "Parents don't want government playing in-loco parentis
even when it's well-intended" probably aren't as useful as more specific
findings regarding particular practices and preferences. I don't doubt the
statement is true in a broad-brush kind of way, and most parents would
agree with it, but I don't think it means parents would want all
age-specific laws revoked so they could decide on their own whether their
child is "ready" (to drive, vote, join the military, etc.). Interpreting
data like yours means figuring out the most sensible way of reconciling
broad claims about who should take responsibility for children with
specific findings about the type of regulation people actually support.

(as a related aside, it seems worth pointing out that the question "*Who
should have the final say about whether or not your child should be able to
use Web sites and online services?" *has a vaguely polemic feel to it, and
not just because COPPA does not have the final say about access (as you
scrupulously point out in your article). I'm not sure I'd call it a leading
question, but when you ask this question, you pretty much know what kind of
answer you're going to get. Framed differently you would likely get a very
different response "Would you support a law that restricts marketers from
gathering detailed information about everything your child does online?"
for example.)

I'm not trying to argue for COPPA as is. The attempt to reform COPPA is
clearly an important one -- but I think it pushes the argument farther than
the findings warrant to call for the elimination of all age-related forms
of regulation, *even those that the majority of parents would support*. I'd
be open to further arguments about the ways in which age-specific
restrictions might, say, hinder more general forms of protection (or
bolster an commercial model that we would be better off without), but the
tone of your article pushes in a somewhat different direction: if you frame
laws that limit tracking as "state protectionism" that limits free choice
in the marketplace, you put yourself in a tricky position if you are really
trying to argue (in the long run) for more comprehensive restrictions on
tracking.

You raise an important issue about the difficulties of regulating
collection: that, as long as people post information to a Web site, that
site is involved in data collection. I suppose this poses a problem for the
kind of do-not-track legislation proposed by the FTC -- would it mean sites
like Facebook couldn't save users' photos and comments? In this case,
regulations on use certainly make sense -- although I'm not sure why
age-related restrictions on *both* collection and use wouldn't also make
sense ("do not track kids' behavior online by capturing information about
their activity - in addition to what they themselves post" alongside "do
not use the information they post to market to them").

One of the most important findings of your study, at least to my mind, is
the one that you mention in passing in your response: "we couldn't even run
measures on what parents knew because their basic literacy was so low.
 They simply don't understand how targeted marketing works let alone how
data is shared, sold, or used." As you point out, this is borne out by the
research, and suggests that an important part of the online business model
relies on practices about which the public is woefully ill informed and
that it may not support once it learns more about them.







On Mon, Nov 7, 2011 at 7:48 AM, danah boyd <zephoria at zephoria.org> wrote:

> [My apologies for my tardiness in responding; this week has been
> challenging.]
>
> I totally agree with you that tracking is indeed a core issue here.  But
> it's also clear that it's not something that parents, children, or adults
> in general understand.  COPPA doesn't educate people about tracking.  It
> basically says, if you're 13 or older, you can be tracked no question. If
> you're under 13, you need your parents' permission to get tracked/to get
> access.
>
> I do not believe that age restrictions do anything to address tracking.
>  Adults are clueless about tracking.  Chris Hoofnagle's work showed this.
>  And we couldn't even run measures on what parents knew because their basic
> literacy was so low.  They simply don't understand how targeted marketing
> works let alone how data is shared, sold, or used.
>
> From my personal position, I believe that we need to 1) create rock-solid
> education programs to address the media literacy problem here; 2) focus on
> devising solutions to minimize how data is is abused that do not focus
> specifically on children.  All populations are vulnerable with this regard
> and it doesn't help kids if clueless parents are making poor decisions on
> their behalf without understanding what's at stake.
>
> Protectionism from the State doesn't tend to do a lot of good.  It
> motivates industry and parents and children to circumvent the restrictions
> by any means possible.  Parents don't want government playing in-loco
> parentis even when it's well-intended.  If we want to help parents and
> children, we need to focus on empowering them directly.  They need to
> understand enough so that they can speak out against what's not right.
>
> I'm a firm believer in Lessig's point that four systems regulate: the
> market, the law, social norms, and architecture (or code). I also believe
> that the most powerful force is social norms.  If you're upset with the
> market and how technology is being employed to help the market, the law
> isn't the appropriate solution if it doesn't align with social norms.  You
> need social norms and the law to be working together.  This requires
> focusing on people, their beliefs, their practices, their attitudes.
>
> As for your suggestion about children opting out from tracking... have you
> read the COPPA requirements?  The mere act of collecting a username, let
> alone a name or any other PII requires parental permission.  The law isn't
> actually just about how the data is used. It's about how the data is
> collected.  Even if companies don't use it for targeted marketing, if they
> collect the data, they have to get parent permission.
>
> One of the most heartbreaking conversations that I had in this whole
> process was with a psychiatrist working at a private hospital.  (Note:
> non-profits are exempt from COPPA but for-profits, including hospitals, are
> not.)  She wanted to create an online hotline-esque program for tweens who
> were engaged in self-destructive behaviors, including anorexia,
> self-injury, suicidal practices, and child abuse.  She was specifically
> concerned about COPPA.  But she was told from her lawyers that she couldn't
> put together an online forum because she would have to get parent
> permission.  How do you ask a parent who is abusing their child to let them
> join a site focused on abuse?  How do you tell an LGBT kid that they need
> parent permission for a site meant to help them figure out how to come out
> to their parents?  She was heartbroken and frustrated.
>
> MacArthur is running into the same problem.  The moment that they do
> anything that's a public-private partnership, they have to abide by COPPA.
>  That means that they have to focus on data collection, regardless of how
> the data is used.
>
> COPPA isn't just about targeted marketing. If it were, the focus would be
> on the usage not the collection.
>
> danah
>
>
> On Nov 3, 2011, at 4:00 AM, Mark Andrejevic wrote:
>
> > Thanks for this heads up about an interesting and provocative study.
> What I find disturbing about it is the fact that the question of tracking
> is downplayed in your survey, even though the issue of tracking is a core
> concern of the policy measures the study purportedly addresses.
> >
> > What emerges from your findings is that most parents think that age
> restrictions have to do with issues of maturity and safety which they can
> address themselves (without the heavy hand of the state, thanks very much)
> through awareness/monitoring of their children's activity (and state
> guidelines). Only two parents in the sample mention privacy -- none, I
> gather, mention tracking and targeting.
> >
> > I'm willing to bet you would have gotten very different results if you
> had specifically addressed the questions of behavioral tracking,
> data-mining, and targeted advertising by, say, asking parents whether age
> restrictions should be set on the ability of companies to collect, save,
> and mine detailed data about children's behavior in order to market to them
> more effectively -- which is, of course, the question at the heart of the
> tracking measures you discuss. It is telling that only 9 percent of
> respondents reported that their children's data were used for marketing and
> advertising -- when, of course, this is the case for 100 percent of those
> parents whose kids are on Facebook. Thank you for noting, in this regard,
> that. "Given how few parents believe their children’s data have been used
> for marketing and advertising, it is likely that: parents are either
> unaware of how these techniques work or they imagine a different aspect of
> marketing when they report their concerns regarding personalized marketing
> and targeted advertising."
> >
> > That lack of awareness is an important qualification to the following
> policy-related finding that parents, "are not looking for mandatory age
> restrictions as the solution to their concerns about safety and privacy."
> The preferred option for protecting children identified by your
> respondents: "getting parents involved in children's online activities,"
> has to be understood against the background of the lack of awareness and
> understanding of tracking practices. Parents who do not understand how
> tracking works and don't know that it's taking place aren't going to be
> able to address the issues it raises through involving themselves in their
> children's activities.
> >
> > I'm also not sure how to square your claim that parents are not in favor
> of mandatory age restrictions with your finding that, with respect to data
> collection, "57 percent would prefer restrictions, even if it means that
> children in general will be banned from social network sites." (It's
> suggestive that you frame this finding by noting that, "Even when the focus
> is on data collection, parents are not uniformly in favor of restrictions
> on what information social network sites can collect about children."
> Another way to frame it would be to note that "A significant majority of
> parents favor some type of age-based restriction on what information social
> network sites can collect about their children"). I couldn't find a table
> for that, so I'd be curious to know how that question was framed. It seems
> to me to be a significant finding -- given the fact that a majority of
> parents claim to be willing to sacrifice access in order to protect their
> children from certain types of tracking. What if the option were that
> children could have access to such sites without being tracked? My guess is
> that you'd see an even larger majority of parents saying they would prefer
> access with restrictions on tracking, even if that meant government
> regulation.
> >
> > When it comes to data-collection regulations, I think it is important to
> qualify your conclusion that, "Our data show that the majority of parents
> think it is acceptable for their children to violate access restrictions if
> they feel as though doing so furthers their children’s educational
> objectives, enables family communication, or enhances their children’s
> social interactions" with the observation that most of the parents who feel
> this way seem to have a lack of awareness or understanding of the data
> collection regimes that the legislation (which leads to access
> restrictions) is meant to address. To my mind this qualification (combined
> with the finding that a majority of parents do support some type of
> age-based restriction on data collection) significantly weakens the case
> against the regulations you target.
> >
> > While I'd agree with your conclusion that "universal privacy
> protections" are in order...I would also express concern about the framing
> and the practical import of your article. You make a case against the
> consequences of a law that is not doing what it is supposed to do (thanks
> largely to the way the industry has responded), but to my mind a much less
> effective case against the actual goal (of protecting children from the
> sophisticated forms of manipulation being developed by data driven
> marketers). Nor do you make it clear that parents are opposed to this kind
> of protection, at least in the case of tracking, monitoring, and targeting.
> Then you use the industry response to indict the law. We might equally
> critique Facebook which chooses to respond by restricting access
> ineffectively (and thereby getting to have its "underage" data too), rather
> than providing parents with information and options. Couldn't Facebook
> easily bypass the onerous process of parental notification and consent by
> providing an opt-out provision: children who indicate that they are under a
> certain age would be allowed access, but exempted from tracking. It seems
> that many of the issues you raise including parental preference for
> restrictions on data collection could be addressed by making the law
> stronger (preventing Facebook from tracking anyone under 13) rather than
> scrapping it.
> >
> > There is something cynical about the asymmetry in verification
> requirements: there must be verifiable parental consent for those under 13
> to acquiesce to tracking, but sites are not required to get verifiable
> proof that those who say they are over 13 really are. In other words, the
> workaround adopted by Web sites like Facebook is clearly structured to
> encourage lying -- and thereby to encourage tracking of "underage" users.
> Is it really complying with COPPA to allow claims to be over 13 to be made
> without verification?
> >
> > Could we agree that what is going on, if we step back and sum it up is
> that Facebook is phenomenally popular among young people and an important
> part of their social lives. However, it is also a commercial site whose
> economic model relies on detailed monitoring, data mining, and target
> marketing. We have, as a society, placed ourselves in a position in which
> an important infrastructure for young people's self-expression and
> sociality relies on submitting them to the most sophisticated techniques
> for surveillance and marketing yet developed (remember when we used to
> worry about advertising in the schools?). In order to placate ourselves we
> have developed a law that, while purporting to protect children from -- or
> at least inform their parents about -- these techniques, actually allows
> the tracking and targeting to take place "unofficially."
> >
> > You point out that the law is ineffective and that parents who
> admittedly don't know how tracking works don't support government mandated
> age requirements -- except for the significant majority of parents who
> support age-based restrictions on data collection even at the expense of
> loss of access by their children to important resources for sociality,
> family communication and education (am I misreading this finding? -- it
> seems like it runs counter to much of your argument). If the goal is
> universal privacy protection, I'm not sure why it wouldn't make more sense
> to provide workable protection for groups that have historically been
> easier to shield from the most aggressive forms of marketing and work from
> there, rather than to say the law should be scrapped because industry
> didn't respond to it appropriately and parents don't seem to want age-based
> restrictions (except for the majority who think they are appropriate when
> it comes to data collection). Indeed, the tone of the article, with its
> framing of regulation as an impingement upon personal freedom and parental
> authority undermines the concluding gesture toward universal -- and thus
> stronger -- privacy protections -- unless these end up being a matter of
> industry self-regulation. That would certainly fit well with the industry
> agenda, but I'm not sure it accurately reflects public preference (I know,
> I know, get funding for my own study...actually, there's one underway).
> >
> > If you're submitting this paper to the FTC in this form, I'd certainly
> be interested in addressing the arguments you make here in public comments
> to the FTC.
> >
> >
>
> ------
>
> "taken out of context, i must seem so strange" -- ani
> http://www.zephoria.org/thoughts/
> http://www.danah.org/
> @zephoria
>
>
>
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.thing.net/pipermail/idc/attachments/20111110/37914ca2/attachment-0001.htm