Ep.23 | Protecting Children’s Privacy Online (Guest: Denise Tayloe)

Show Transcript

Hello and welcome to episode 23 of Privacy Lawls where I Donata Stroink-Skillrud speak with amazing privacy professionals and we have some laughs along the way as well. Today I’ll be speaking with Denise Tayloe about children’s privacy. Denise is a recognized leader and authority and consent and identity management and a subject matter expert in minor’s online privacy.

With over 20 years experience in the field as an innovator, she authorized and has been granted three. Patents to device level age assurance for the protection of vulnerable populations. She co-founded Privacy Vaults Online, Inc. Doing business as Prevo in 2001, inspired by the opportunities and challenges of implementing the Children’s Online Privacy Protection Act.

So Denise, thanks so much for joining me today. Thank you for having me. So what inspired you to work in children’s privacy? Well, I’ll start with, I’m a recovering CPA accounting [00:01:00] finance type, and my brother had started a company in the late nineties, late 1999. I remember him knocking on the door saying, okay, I’ve got this family business.

I need your help. It’s called the internet. I said, I heard about it. I have an email. But he was creating this really cool platform called Info Nuts, where everybody’s nutty about information and it was directed to kids. It was market research, product development, where they would bring their nutty ideas and inventions and collaborate with others and companies seeded the collaboration.

And then we watched them turn those ideas into products and services. And we rewarded them with Ucks and then watched how they spent that within the community. And we tripped over the Children’s Online Privacy Protection Act. It, you know, was something that we needed to, uh, learn how to deal with and make sure that we complied with in that business.

But those were early days. And as the internet bubble burst, uh, [00:02:00] my sort of CPA hat came back on and said, how are we going to make something of everything we’ve learned? Uh, and we decided to create. Privo. Um, the original concept there was this law was requiring the need for parental consent. Let’s, uh, let’s think about data.

The way we think of our money. We’re gonna need a way to bank our information, verify who we are, associate our loved ones, and manage the collection, use and disclosure of our data. Hence, uh, that’s where Privacy Vaults online or Privo came from. That’s such a cool idea. I feel like kids have. So much creativity and they think of stuff that adults would never even consider.

And I mean, the children’s market is a huge, huge, huge market. Mm-hmm. Mm-hmm. It is. It’s been somewhat marginalized, I would say though, over the years. Um, I think that the. The worries of how to comply has [00:03:00] caused companies to sort of marginalize kids’ experience and mm-hmm. Kids have had to go places they shouldn’t necessarily go in order to have the you know, the entertainment value or the engagement value that they would like.

But I, I see that changing after all these years. I see a new horizon coming and it’s got. Good and bad associated with it. So hopefully we’ve all learned enough over the last couple decades that we can get it right when it comes to kids’ privacy and safety. Yeah, I hope so. So somebody who works in privacy and owns their own business, do you have any tips for other privacy professionals who want to start businesses themselves?

Well, certainly I would say listen to the whole podcast because I think you’re gonna have a lot of great questions and people will pick up a little bit on privacy in general when you think about privacy for kids. But ultimately, you know, have a great idea, be prepared and don’t try to go it alone. Even [00:04:00] if you’re a privacy professional, there’s all sorts of other things that running a business needs and you can’t do it on your own.

Absolutely. My husband and I started termed together and it’s nice to have somebody to bounce ideas off of and, and commiserate with. And he does the sales and marketing and partnership side and I do the other stuff. So it’s, it’s nice to have somebody with you you know, working in children’s privacy.

You know, children obviously don’t. Necessarily have the same understanding about things that adults do. How do you make sure that your tools are accessible to children and understood by children and their parents? You know, uh, I’ll just start with, uh, lots of iteration testing, listening, iterations, what you think people will read and understand or realize that most don’t read a whole lot.

They really want to get to the end of the process. So you’ve got to, uh, sit and look at all the different vantage points along the [00:05:00] way. And then also don’t discount. The kids are pretty smart, they’re savvy. You know, so don’t underestimate. What they can pick up along the way. So when I think of children’s privacy, the first thing that pops into my head is the song by Bo Burnham.

And this came out during COVI, uh, during his series, uh, called Inside. And it, the song says, uh, mommy let you use her iPad. You were barely two. And I won’t sing it, but uh, technology has definitely come a long way since I was two. When do kids start using technology nowadays? Oh, I think, uh, you know, two is probably, um, an age you’ll see a lot of that, although there’s quite a bit of, you know.

We have years to look back now, right? At screen time and what it really means, but they get started young. So let’s try to put it in context. First of all, like 92% of us children have an online presence [00:06:00] before they turn to, so that’s just a fact. They’re using the internet and technology as they evolve and grow.

The technologies are evolving from them, from sort of simple exploration to complex social and other sorts of engagement, but you know, ages and stages. So I thought I would. And let’s, I’m thinking of this question in sort of those brackets, right? First looking at early childhood, uh, let’s call that ages three to seven.

You know, they’re often using technology in a highly supervised setting. I. Right. And that might include watching videos with their parents or their siblings and playing educational games and touchscreen apps. And we find that they can get around the screen faster than, you know. I, I, I watch my mom if she listens, she says, I’m like, don’t press so hard.

The kids just know to swipe, swipe and, you know Yeah. How to get it done. Um. Their actions are typically [00:07:00] passive and guided by parents and teachers. And the content is designed mostly to be age appropriate for them. But, you know, we know that kids get their parents’ devices, so some, some content just comes along faster than maybe they’re ready for it.

And then I, I go to that next stage of tweeners, right? The, uh, middle childhood ages eight to 12, and. At this stage, I’d say they’re becoming much more curious independent. Uh, they’re more literate so they can read and write. And as that’s happening, maybe they write things they shouldn’t. Maybe they’re, you know reading and dismissing and moving, moving on.

But they start browsing the web and they’re using online learning platforms. Of course, after COVID, we see a lot of that multiplayer games. Which is different than single player. Uh, you’ll see messaging with friends and family, and then while you know, they’re still under that [00:08:00] parental oversight, they’re beginning to form their own digital habits and explore their online identities.

And often without fully understanding the privacy risks of all of that. So noting a few maybe key statistics, we said 92% by the time they’re two, but almost half of tweens have a smartphone. More than 80% of children have fibbed about their age to get access to content or activities that seem. Reasonable to them, but may involve creating a global fake ID for 10,000 other services to access.

Right. And uh, and also I, I would say that, you know, the sad news is that the average age of initial porn consumption is 11. Wow. They just can’t help it. Even, even if they have no device of their own they have no interest. They’re riding the school bus and they may be just sort [00:09:00] of. Forced onto them.

It’s a form of bullying in one sense, right? That they see things they’re not quite ready for. Wow. And then I would say we move on to the teens if we make it that far. You know, 13 to 18 year olds are very different than the tweeners and certainly the younger ones, and they’re using it for a broad range of activities.

But now like schoolwork and social media, we know that the gaming and streaming and content creation. Creating their own online presence and they’re making personal choices about what to share and watch and post and how to act. And I think that also they’re using digital services that aren’t necessarily intended for people that are not quite adults yet.

Uh, across all ages. You know, technology is both a tool and a space for connection and learning and self-expression, but it also comes with growing risks [00:10:00] related to privacy and safety, and again, ages and stages. It’s a 10-year-old is not the same as a 15-year-old, but they tend to try to take on what the older siblings and older folks are are doing.

So that’s so different from how I grew up. So when I was growing up, I, we had the TV and, but it was. Mostly co-opted by my grandparents who would watch whatever they wanted to watch, which was most of the time political commentary shows. So it was super boring. I do remember they allowed me to watch a Britney Spears Con concert once, which I was so excited about.

I mean, of course I tried to memorize all the moves and stuff as not good at it. And then eventually we got a computer. And that was used to play Minecraft. Or we had a former social media, which was really bizarre. It was basically this like fake world with buildings and [00:11:00] really bad graphics and the ground.

And you would walk around and try to meet other people, but there’s never anybody there. Right. And now there’d be so many people there. They just wouldn’t be humans. Right. They’d be bots, right? Yeah. It would be bots now, but it’s wild because. There was no social element to, to that space because there’s nobody there.

Mm-hmm. So it didn’t, you know, you just walked around and looked at the buildings and stuff. But that was pretty much it, you know, and then you went to school and you got a computer, at least in my generation, but used that for research and writing up papers and stuff, and. There were a couple websites of like, I remember I waste so much time.com and I don’t know if that’s still available, but it’s like a bunch of funny pictures and memes that you would look at, and that was.

That was it. Right? And now, you know, you use AI and you just create the content yourself. Mm-hmm. Um, you you’re talking with, you know, talking and engaging with people all over the world, [00:12:00] and most people have just sort of. Check the box and, and come into those environments. So a lot of, uh, engagement, interaction happening with companies themselves, people to people and the like.

But I have to tell you, if, if they had recorded everything I thought or did, right, you said, you know, you would tried to memorize Britney Spears. Right? Exactly. Well, now you just like, turn on your camera and you, you know, you memorize it. You do it, everybody else sees it, you’re horrified by it. You wonder how you’re gonna take it down.

Uh, it’s a whole different world, isn’t it? Yeah. I, I would die from embarrassment. If anybody had a video of me dancing to Britney Spears and it was online, I think I would just, I would just move to the forest. That would be it. Um, so you talked about how much kids are online now. What types of personal information is being collected about them?

[00:13:00] Sure. Well, it’s a lot more than people realize, and again, you know, sort of like the ages and stages. I’m thinking of this in categories to, to take it in bite-size, you know, categories of data. So the, the easy one is first just identifiers, your first and last name, your email, your display name. Phone number, address.

I mean, all the kids use their phone number right when they log into social media. Why? ’cause all their friends are connected to their phone number. They’re not emailing each other like US adults might be doing. Uh, so that’s one, one area, device and location data, right? So, you know, in the world of Kapa and when you think of children’s data, IP address comes into play, device identifiers.

Precise geolocation. So not just maybe what city, but you know, where down to what street I might be on. And of course, when you combine my city and my name and another [00:14:00] piece of info about me and my school behind me you know, you can really get down to a pinpoint. Online behavior and our activities, our choices, our clicks and our likes, and our things that make us nervous and excited.

Search terms, browsing, history, all of that information, and again, you know, it maybe combined with other pieces and it just creates this. Richer place. Media and content. Like we said, kids are creating their own content and media, their biometrics. Uh, how about their voice and their data prints? If you went to a social media service and they thought, Hmm, are you really old enough?

You better prove it. They might ask you to put your face in the camera for age estimation, recognizing that that is the collection of your. Biometrics to do so might be on device, might not, right? Chances are it likely goes [00:15:00] back to a server educational information or the things we do in the educational context.

So not just like our grades and how well we are doing it, something, but what about when we get in trouble? And that goes into our record and how, you know, years from now somebody’s saying, well, you know, you never really were the best kid, were you? You might have made bad choices along the way. Well, we’ve all done that.

But if you’re very modern school system is collecting more and more and more, then there’s that much more to, to look back at. I think also just social, um. Entertainment, like who are our friends and who do we talk more to and how long are we on? And. Again, just that combination of all of that data gets us to a point where I hear there’s 72 million data points on somebody by the time they turn, you know, 13.

Wow. But [00:16:00] lots of these data points are definitely PII or pi. You know, people don’t know whether to have the identifiable piece in there or not when they think of CAPA or GDPR. You know, at the end of the day, somebody said to me. I’ve got a tool that doesn’t share any data. It actually blocks all of the data.

And I said, well, how do they get their password recovery? Well, we provide an email. You know, that’s not them. So, but the message still gets back to them. So, you know, when you think about our laws, privacy laws, it’s not just do you really have the real data that ultimately gets to the user, but can you get to them right.

You may not have any data, but you know what they like and don’t like. And so the next screen you can feed them a very targeted communication. And you didn’t, you just did that by watching how they acted within the game or, or the environment. I’m mostly thinking about like chat functions and chat [00:17:00] histories.

Mm-hmm. And, and all that other stuff. And I mean, kids say all kinds of things, you know, and most of the time they don’t even mean what they say. They’re just trying to figure out like social norms and what’s okay to say and what’s not okay to say. And then. If that stuff’s recorded somewhere and then you become an adult and it could potentially be used against you.

That’s really scary. Well, and if I could just add on, add to that, you know, I hear people talk about certain platforms and where their origins are. We had a a lot of parents don’t realize that we had music ly musically, which was the fastest growing social media platform for kids. First grade and above.

It never asked age. Its terms of service. Said, well, if you’re, you know, we care about. Kids’ privacy and we expect parents to do the job. Um, and this service is only for 13 and over, but we’re the fastest growing social media platform for first graders. And then they [00:18:00] sold for just under 900 million to bike dance, and it came back to us as TikTok.

So it really started in the us it was a US company that sold and then came back to us. So somebody might say, well, what’s wrong with that service? I’m not gonna say anything’s wrong with the service. I, I, it’s not my place to say that. But what I can say is that you might be in charge of the sixth fleet when you’re 39 years old, right?

You’re almost ready to retire from the military. Right. And what you. W paused on what concerned you, your, your what scared you, what excited you, all of that’s being captured by your eyes, your actions. And so is the 10-year-old prepared for his big job 20, 30 years from now? Because I am very sure that certain nations will be very patient in how they use [00:19:00] the data that they’ve collected.

Mm-hmm. Um. You know, we did talk about a couple of risks, but can you give us a couple more examples of risks that children face online, um, related to their privacy? Sure. So, we’ll, you know, we first can look at unintentional data sharing. They, they just didn’t even realize they were sharing that the school was behind them when they were taking pictures.

You know some apps just, and services just request more information than they need. They shouldn’t be asking for it to begin with, but, you know, children are sometimes vulnerable. Right. And accommodating and providing. I think that there’s just an absolute inadequacy of age understanding, age awareness.

I’m gonna call it, you know, the age gates that exist are pretty flimsy and broken. And, uh, not only do they make it super easy for kids to fib, but they make it really easy for parents [00:20:00] to do it as well. So very often you’ll see a parent who has, you know. Some autonomy for their home. They’re like, I know what my kid can handle and not handle.

What do you mean they can’t have fantasy football? They’re playing with their dad. He’s overseas, their cousins. You know, why do we have to lie about our age to get this account? Well, that’s okay. Let’s do it. Because I’m gonna watch, I’m gonna be, I’m checking the router and I’m doing this, but Yeah. But what about all the data points that are going off underneath and literally the license that you’re giving to the company to use the data the way they would us as adults, simply because somebody checked a box that they were 13 and over, or, you know, back, back, back and change their age.

And we have, you know what we all know, tracking and profiling. We’re all sort of waking up to, was it listening to me? I’m pretty sure we were just talking about that in the other room. Why am I getting that ad [00:21:00] on my Facebook? I’m not even on it right now. Yes, you are. You didn’t turn it off. It’s still on, and yes, it is listening to all of us along the way, so we all have that targeted advertising and mm-hmm.

I think that when I think of, uh, predatory behavior, yeah. And sure that can come from companies, uh, but it can come from humans and people. It’s not just kids. It’s, I I mentioned when we were just chatting before, my father has dementia, I. Uh, our, our pa, our, our seniors are under attack online by things that they do.

My, um, somebody I love very, very much who’s super smart and couldn’t possibly make a mistake in this arena, I. Called the number for Microsoft, and before she knew it, she let people remote access to her device and they showed her all the horrible things that was happening and her money leaving her account.

And this went on for five days where she was [00:22:00] tortured, uh, and ended up at the bank. I. Trying to withdraw tens of thousands of dollars. Okay, well maybe our kids don’t have that kind of money, but they might have access to their parents’ money or they might share information about their very senior executive parents somewhere because they are literally being blackmailed.

Or, you know, they think they’re talking, they’re a young man thinking they’re talking to a girl. But then somebody puts a face in the camera and says, you know. I’m gonna have to tell all your friends and everybody what you just shared with me, and then they’re alone and they don’t know where to go. If, if I could give advice to parents, I would say, whatever you do, you’ve gotta bite your tongue, you’ve gotta listen, and you’ve gotta help them resolve that life.

Goes on. You can’t, you know, you can’t go straight for the throat. What do you mean? What were you doing? Why were you doing it? I told you not [00:23:00] to. Or they won’t tell you and they’ll be all alone trying to resolve some, some pretty scary things that can happen to any of us when we’re vulnerable in a vulnerable state.

Especially now with ai. I mean, I’ve seen videos of men that use AI to turn their video into very attractive looking woman and um, you know, I’m sure, you know, hopefully they were just using that to play around. But I mean, I’m sure there’s some bad actors out there who could be using it for other means to, you know, entangle people into certain things, especially kids who don’t understand, I mean, they just assume.

You’re on video, so that’s who you are. Yeah. That might not be the case anymore. I mean, look, ai, somebody said to me it’s like crack cocaine and, uh, it’s gonna be, it’s highly addictive. You can get whatever you want. You can have whatever you want instantaneously. Children are not prepared for that kind of [00:24:00] creativity.

Coming through, coming actually, you know, actually forming itself right in front of their eyes without some supervision and some guardrails. It is, it could become a very scary time to think, you know, my kid never comes out of the basement. He is on his video game all the time, but he is so smart. Well, he is also got his, you know, AI girlfriend.

That’s not how we want kids to learn intimacy. It’s it’s so, it’s, it’s a, it’s something that we have to talk about and, uh, we can’t ignore that. Those sorts of things could happen to the very best. It’s interesting that you mention seniors. Uh, my grandma who’s turning 80 this year is surprisingly really good with technology.

So we talk over Facebook Messenger and we send each other pictures and stuff. And one year I sent her, um, flowers for Grandmother’s Day. She lives in Lithuania, and somebody buzzed her door and said, Hey, we got a flower delivery for you. [00:25:00] So this woman, I mean, she is 80. She’s so sophisticated about this stuff that she called me beforehand and then she got this, uh, buzz.

She called me to confirm that I sent her flowers because she read about some scam where somebody knocks on the door of a senior saying they got flowers or a package and they opened the door and they get robbed or attacked and stuff. Mm-hmm. And I was like, I didn’t even know that. Like, how do you know that?

And she’s like, well, it’s important to me. I need to know this ’cause I’m old. Like things like this happen to old people. And I was just. So shocked that she knew about that. It, there was a movie called Beekeeper that I think was, uh, I saw it, yes. Yeah. Interesting. Uh, and, and probably everybody should, should watch that, but you know what else I learned?

I was in the bank the other day, well, the other day, it was four months now. And I saw an old friend and I thought, you know, he looks. Sad. He doesn’t look quite [00:26:00] himself. I hadn’t seen him in maybe a year or so, you know, how are you, how are you doing? And he said, oh, I’m fine. I’m fine. He was, you know, very intent.

And I’m a little nosy. I’m in line and I’m complaining there’s nobody at the counter to serve us anymore. Where are the people to serve us? I, and, uh, I could hear him. Say to somebody on the phone, well, the banker said something about it could be fraud, but I know, I know who the person is. I know what I’m doing.

And so I butted in, Hey, you know, I don’t wanna say his name, but hey, uh, what do you, you know what? I heard them say something about fraud. What were you looking at? What, what’s happening? Can I help in any way? Oh, no, I’m fine. I’m fine. I’ve got a friend who, who’s in trouble, they need some help. I said, oh, there’s so many scams.

You know, there’s, I, I get this kind of stuff. I’m, and he dismissed me. And then a few minutes later, I, I, I saw it, I saw that he was just really looking and looking and he goes, look, I, I meant I broke in again. And he says, look, I, I’ve got, I’ve got her driver’s [00:27:00] license. And I thought, ding, ding, ding, ding.

Yeah. Why do you have a copy of her driver’s license? And, and I held my breath and I got to the counter, and then finally I just couldn’t take it. I just lost it. I, I stopped right in the middle and I turned, and I said to my friend, we’ll call him John, John. I’m an internet privacy and security expert. How did you, uh, get this request?

Oh, by email. Great, thank you. Please hand me your phone now. Show me where. Okay, now, 1, 2, 3, 5 nine@gmail.com is likely not your friend. She could be in real trouble. We’re getting ready to send 35,000. I want you to sit down just for a minute. I wanna help you find her. Let’s sit. Was he in what we could do?

I’m like, bang. Like, what am I gonna do? I sit down and I, I’m like, okay, we’ve gotta try to find her and Google her. And I’m thinking she’s half his age, but he had, he shares with me that his, his wife just died. And he’s lonely and he’d never met her. And he’s only talked to her [00:28:00] over this dating app. And I thought, oh my gosh.

Oh my gosh, where’s this money going? It was going to a particular bank. I said, let’s go over to the bank and see. She could be in real trouble. I literally had to become a psychologist to pull my friend off the ledge. Yeah. And I realize now that we must have billions. Leaving our seniors pockets because they have empathy.

Because they’re lonely. Yeah. Because they have the money to to spend and they just don’t know. You know what I mean? They just don’t know. They think it’s a friend and you know, they think somebody needs help. They wanna help them, and they don’t know any better. They don’t necessarily know how to look somebody up or look up their email.

Or you need codes, bank accounts. You need codes. Because remember, your grandmother called you. ’cause the person’s at the door. Had it been, you know, if, if it was online, AI’s gonna let them use the child’s face, grandkid’s face. Yeah. Their voice. Right. If they hit them up. And so [00:29:00] we need a code. What’s, what’s the safety code that nobody has a great idea.

Yeah. Mm-hmm. Just a random word that nobody would know. Mm-hmm. That’s a great idea. For sure. So. You know, when it comes to parents, how do, how can parents explain this to their kids? Well, they’ve got to in, they’ve got to try to put the online and offline world into the real world. It’s not the real world and the online world.

The offline and, and, and online world are constantly ebbing and flowing against each other, and so. If kids understand they can’t go to the bar, they get it. They get that they can’t take mom’s keys and drive the car. They know that they might sneak, but they can’t, like, you know, smoke a joint in the basement and not expect mom to.

Have a, maybe have issue with it. So age matters, ages and stages. They’ve [00:30:00] gotta talk to them like they’re, that they, like, they would talk about any other risks out there. It can’t be the, uh, boogeyman behind the screen, but they’ve gotta talk about. How to really equip themselves to recognize what’s true and not when.

When people are asking for things that’s invading on their privacy, that’s just getting too close that you can, that you can type and pause. Don’t we all wish we had done that more? I mean, if I could get back all my emails, I’m gonna be wildly successful one day and somebody’s gonna show up with this terrible email.

The only good thing I have going for me is I can’t spell. And my thing never listens to my voice. Right. And, and I’m constantly sending, you know. Gibberish. So I’m just gonna say, well, that was just gibberish. I don’t know what that was, but, um, you know, you just have to look at making it all, it’s all the real world.

Yeah. And, uh, and then they have to make themselves available. They have to [00:31:00] be available and safe. Anything happens. You have to come to me first. We’re gonna resolve the problems. Great advice, and then we’ll talk about what to do next. Yeah. To just so they’re not scared to come to you because otherwise they won’t, they won’t.

Yeah. So what kind of websites need to comply with copa? Any commercial website app game platform, uh, we use a catchall phrase online service that’s directed to children. And then we have some categories in the US primarily directed or maybe mixed audience where mm-hmm. Uh, certainly if you get actual knowledge, if you ask age and you get told that you’ve got a kid, you have to comply.

You now have the legal actual knowledge that everybody tries, all the many companies try to avoid. And then if you’re in other countries and under other jurisdiction jurisdictions, sorry then certainly it may be, are you just likely to attract [00:32:00] kids? So a big difference. It’s a, it’s really very interesting, right?

In the US we’ve got more parents have rights, if they could sort of make some decisions in maybe in Europe it’s more what are the child’s rights? And uh, so coming from those two different areas, they actually look at the audience types a little different. So if you thought about in the US we, people will say.

Well, those, that company should have known, there were kids there and they should have checked everybody’s age. But then that might stop me from using that service. And my first amendment rights may be trampled on, or, you know, I may have to share more information about myself to protect somebody else’s child.

And, and so where do we cross the line where if it was. You should have known. Everybody needs to be verified, so it’s, it’s a different perspective depending on what side of the pond you’re looking at. Some of [00:33:00] this, so we’re not really talking about like plumbers websites or websites that sell KitchenAid.

It’s more websites that display things or online services to display things that might be of interest to kids. Yeah. But at the same time, what if the utility company has a kids section learn about utilities and why they matter? Oh yeah. Go green. So do you end up making, you know, if you’re the, if you’re the, you know, if you’re a service, a site that let’s say brings together all the football teams or all the baseball teams or all the.

Right. So you’re pretty much general audience. You’re really not putting out the stuff for kids. But they have kids clubs, of course, you know, they’re being marketed to in other ways and maybe driven or, uh, I’ll see folks, uh, like with games or toys that you might buy packaging, and then the packaging says, go to x, y, z site.

Well, if it’s a toy. The go to the X, y, Z [00:34:00] site to get the instructions. You may now have just brought kids to your service. Mm-hmm. If you’re customer service at a big box store and you might be getting calls or emails or you know, from kids who know how to, who are the ones setting up the TVs and the computer.

So are you now collecting that identifier to then communicate back and have this customer service engagement you may have triggered. COPPA because you’re now keeping it persistently. But you may have some exceptions on what does that really mean for parental notice and consent. Yeah, so I think anybody who has an age gate who’s trying to determine are you an adult or a minor or a minor of a particular stage, has to be concerned with all of these regulations because you can get that knowledge.

In many different places, not just the upfront gate, but like I said, the customer service on the back end. [00:35:00] Absolutely. So when you have a website or an online service that needs to comply, you do need to provide some privacy information. How do you make sure that that privacy information can be understood by kids and their parents?

Well, I would say that we have a LA bit of a way to go on kids understanding. You know, it’s called out directly in the Europeans regulations, the children’s codes. You have to build things with children in mind, so I think the privacy notices have a better chance of being understood by children because quite frankly, I don’t know that any of us can understand the full breadth of the privacy policy, but I think people are getting a lot better at it.

I mean, you’re, you know, what you do is really helping people get better at. Being more succinct and concise and, you know, pulling it forward. Mm-hmm. And, you know, I see, I see a, I see a place for AI here for my [00:36:00] AI agent to sort of take a glance at these things before I’m, I do, to bring things in to make the policies more readable.

Mm-hmm. You know, to try to use terminology that people might understand and see again and again. But it’s a lot. I, uh, it’s a lot to absorb. So I really hope that companies who create the privacy policies will do a better job of looking at some of the rules that we have in place for the kids. The more vulnerable, and c, don’t collect it if you don’t need it.

Don’t get, don’t tell us you’re gonna collect it someday in the future when you’re not quite doing it yet. Maybe reminding us, Hey, by the way, we’ve collected this to do this particular feature. I know in our tech, in our platform that we offer, we are we, we map to the feature and the activity. Who’s it for?

[00:37:00] Who can consent for it? Just how, what’s the level of assurance we need that they are who they say they are, that the relationship of parent child exists. What is the actual data to make that thing work? Um, what are the risks? It’s like many DPIs to, for, for the features and activities so that when people consent to, you can have my phone number, it’s you can have my phone number for this feature and that feature and my account authentication, or really three different things.

And I may say no to my phone number for this reason, but you can have it for the other two. And so I, I think we, you know, policies are gonna get better at. At, um, helping us understand how the data’s actually used and putting it into context. I like that of, um, purpose specific consent, because you’re right, I might be consenting to two factor authentication on my phone number, but I don’t want you to text me marketing text [00:38:00] messages.

Um, that’s right. And now, yeah. Now a lot of times that just comes with it, you know, you want TFA, oh, you’re gonna get marketing too. Which is, and that, and we know that would never be acceptable under the children’s privacy policies, right? No. So again, why parents, there is something to gain by being truthful about at least the 12 and unders right now, because we can’t just do that.

Right? It’s, it’s just not acceptable. Uh, and we can’t bundle all of the consents into one blanket consent. It has to be. More discreet. Yeah. And I know we’re gonna talk a little bit about the new Copper rule. Um, yeah. So, um. Can you tell us a little bit what, um, verifiable parental consent is? So it is, uh, I’m gonna give the technical way to say it first.

It, okay. So obviously it’s parent consenting to. Likely a child. That’s why parent comes into play. And the verifiable piece [00:39:00] of it is, are you who you say you are? Right? So the rule might say reasonable. You know, companies must use reasonable methods in light of available technology to ensure the person providing consent is the parent or guardian.

So verifiable is on a sliding scale. It’s levels of assurance. Uh, if you think about when you go to do your tax return at the irs, now you might to get a login, you have to verify at a high level. But to gain access to just information, you might just provide an email and click a link. So the levels of assurance.

It might be mapped to the risk of what data I’m sharing and, and why. So the same thing with verifiable parental consent under coppa. We kind of put it in, in different buckets. It’s all verifiable. But was I able to just take an email or if. What will soon be a phone number to start the process and [00:40:00] have somebody click a link back?

Well then I need to keep my data use to internal use low risk, but am I gonna start creating a profile? Am I gonna, am I gonna create a mechanism for people to kids to share their own data with just anybody? Am I, am I as a company gonna share data to facilitate, you know, engagement that’s more than just servicing the app, the bare minimum?

Well, then I might need to raise that level of assurance to, I actually know I’m dealing with an adult and not just any old adult. An adult that I can get back and verify if needed. Which, you know, emails and phone numbers combined with our first and last name get us all a long way there in that, in that world as well.

That makes sense. So, you know, if I need to log to, um, an account that just has, I. My coffee order history, maybe it’s just my email, but if I need to log into my [00:41:00] bank, maybe it’s my social security number, my birthday too. Mm-hmm. And in and in the world of VPC, verifiable parental consent. If I’m gonna con, if I’m going to consent to my child, having a social media account that allows them to, you know.

Have algorithmic, uh, uh, messaging coming. Right? Then I’m gonna have to, I may have to verify with something like the last four digits of my social or credit card transaction or perhaps, uh, verified bank account. I mean, there’s, there’s lots of places were already verified. I hate this idea of we’re gonna shove all this data into data brokers when.

At my employment, I’m already verified. I’m highly verified to be older than I like. Uh, and my detail@privo.com is, is protected. I signed a contract with the company, not gonna let my kids in there. I’m not gonna let my [00:42:00] husband or my friends in there. I’m, I’m going to not use it for, to do commit fraud and sh share secrets.

So therefore. It may be a very good place to simply get a five digit pin and type my pin. Mm-hmm. Because it’s, it’s based, its foundation is a highly verified individual already getting my paycheck through the company. Yeah. And so there’s all sorts of ways to, to gain a, um, a, a credential that has an associated.

Level of verification that would allow me to manage these high value transactions without having to use passports and driver’s license and, you know, age estimation and other things, my biometrics that I might not want to use. Absolutely. So what types of privacy rights do parents and children have? Uh, well, you know, we’ve got a, it goes back to what country are we in what age are we?

[00:43:00] But they have different privacy rights online. Parents have the right. Typically to control what personal information is collected from children under the age of 13. So we, we all agreed in 1998 to pass Kapa, right? It’s been enacted since some parents are now new parents and they are younger than the law has been in place, right?

But it really protects kids under the age of 13. So now you have to start looking to. Other jurisdictions like states that are saying, wait a minute kids 13 to 17 can do whatever they want in New York if it’s legal, but you company can’t do push notifications in the middle of the night or do behavioral algorithms without notifying and getting consent from a parent.

So those parent rights might kick in. At the activity level, the feature level, not necessarily the account level. Yeah, right. [00:44:00] Think about, um, healthcare. Healthcare, consent goes the other direction in many states. Children have access to certain aspects of healthcare on their parent’s insurance plan that the parent is not supposed to know they’re accessing.

Mm-hmm. And so how do they give credentials to teenagers? When the law says you can’t let the parent know, the kid just accessed. You know, healthcare for addictive, uh, behaviors or, you know, drugs and alcohol or abuse of some kind, you know, whatever it might be. So it’s, it’s complicated. Yeah. Mm-hmm. What about the most recent copper rule amendments?

Can you talk a bit about that? Sure. Um, the amendment has it used to be that the law was. If a child initiates engagement on a service that needs to comply, it [00:45:00] can ask for basic information to reach out to the parent. Hey kid, we need to get you. Thanks for wanting to join. We need to get your parents’ permission to do X, Y, z.

But the company doesn’t know who the parent is. They shouldn’t know who the kid is quite yet, so they’ve gotta ask the kid for the parent’s email address or an online identifier. So in the New Amendment, they’ve said, gee, that’s, that’s not easy. Kids don’t know their parents’ email. We’re gonna let kids provide their parents’.

Phone number so that the company can provide a request for the parent to take an action. It’s gonna be interesting to see if that holds up because Yeah. There is no, you know, you’re supposed to sort of consent to somebody texting you, right? Um, and they would say, well, this isn’t marketing. But if my kid’s trying to create a marketing relationship with you and you’re now communicating with me via text, uh, you know, what, what does that mean?

Another big change is we’re going to [00:46:00] have to actually notify in the privacy policy and the like, who are these third parties? What categories are they in, and who are they that data’s being shared with? So it’s gonna get more granular. Another area when you think of verification methods, credit card was always, okay.

So you, if, if you were piggybacking a credit card transaction, you could sort of bundle in, uh, notice and consent. If you would see companies that would say, okay, parent, you can. Uh, make a credit card transaction for a dollar and we’ll reverse it when we’re done. The reason that the companies needed to close that transaction out was to actually provide notice to the parents, so they would see, wait, wait a minute, my credit card was used, not just authorized.

So again, jurisdictionally In Europe, it’s mandatory that if you use your credit card, even on an authorization, you get notice. [00:47:00] But in the US that’s not the case. You don’t get a notice when you just necessarily authorize the hotel to hold your credit card. Yeah. So, uh, one of the changes is they, they’re saying, well, you can use the credit card as long as there’s a discreet notice, but how’s the company gonna know whether there was a discreet notice unless they’re using a particular credit card merchant provider who can guarantee there’s always notice.

And I, I don’t know if that’s gonna be the case. Lots of other little tidbits and things to follow. Yeah. Um, and changes along the way. We, it everybody has to be in compliance within a year. The safe harbors have to sort of change their, um, requirements by the summer. Yeah. Well, at least there’s some lead time there.

That’s, uh, it’s not much, but it is better than nothing. I know sometimes we’ve had California regulations change and the lead time was like seven days over the holidays and everybody’s just panicking and running around with their heads cut off. [00:48:00] So at least there’s some time to prepare. Um. And, and speaking of preparation how does your company help businesses comply with children’s privacy requirements?

Thank you so much for asking. We are, I’m so proud. We are an approved safe harbor with the Federal Trade Commission, so that means that we help companies understand what they need to do. We. Audit that, and we certify that they are complying with the, the law under our safe harbor. Uh, that might mean that we are doing packet scan analysis.

We’re reading third party agreements. We’re mapping doing those data mappings. Uh, we’re helping to educate their executives. You know, providing them with tips and tools and even in-person, uh, or webinars to help them understand what they need to do. And then the ex, the really exciting part for me is not just telling [00:49:00] people what to do and sort of auditing and certifying their doing it, but actually giving them some tools to do it.

So. We provide an identity and consent management service. We help them manage children’s data in a compliant way, and, uh, gets back to that privacy vaults online. The parent may verify I. They are who they say they are using a privo verification service widget that’s promoted by a client of ours. They can add a password and now they have a verified credential that they can use to manage consent so they don’t have to.

Do it over and over and over again establishing that they are who they say that they are the parent of that child. So those consent services I talked about, we make those available as AC APIs and SDKs and we’ve got a new initiative that’s launching that I have lots of patents around. So you may have seen conversation about.

[00:50:00] You know, let’s let the app stores do it. They need to verify all the ages. Well, in 2009, I said, can we just let parents tell us the age of the kids and we’ll record that age and associated it to the online identifiers like a phone number. So we hash that number against an age, and then we provide it as a lookup service so that age restricted products and services can do a better job of locking their gates and not engaging with data that’s been protected by parents.

And then as part of that service, gonna help people get their age corrected. That’s awesome. Although fibbing that might have taken place when a 15-year-old really would like to not be 25 or 30, uh, we’re gonna let them verify with Privo and help them get that accomplished without having to turn over so much more data to make it happen.

That’s awesome. Yeah, I definitely would not [00:51:00] trust the app stores with anything privacy related. Even with Apple launching the do not track selections. I mean, it was found that you have to, if you wanna opt out, you have to do it multiple times for it to actually take and, and all this other stuff. So that’s awesome that you guys provide a solution.

Outside of that, um, where can people learn more about you and your company? So, and if I could stop all the dinging, I hooked my, there you go. Privacy. I hooked my phone to my PC so I couldn’t miss a text. And should have turned it off my apology. You could go to privo.com. P-R-I-V-O. We’ll answer to Privo and Privo, but, uh, we’re privacy minded.

We have Privo Protect where parents can go. And we’ve curated information that can help them in lots of ways around privacy and safety. And they can sign up and tell us that they’re interested in joining the [00:52:00] Privo Protect Service to make the internet more age aware, uh, giving, you know, giving them that tool to just put the world on notice.

Hands off my kids’ data. Don’t let ’em just fib you at your gate. That should be made into sticker. Thanks. That’s great. I want one of those. I’m gonna sign up first in line for sticker like that. Uh oh. We might do the sticker. Can I steal that from you? That’s a great, that’s a great idea. I love that. So Denise, thanks so much for joining me today and for telling us a bit about children’s privacy.

Super important topic. Thanks so much for having me. I really appreciate it. Yeah, and uh, for anybody listening, uh, definitely make sure to subscribe so that you don’t miss our next episode.