Today, Common Sense filed comments to the FTC explaining how children and teens are particularly vulnerable to cross-device tracking, and urging the FTC to ensure there are appropriate protections in place.
Common Sense Kids Action, the advocacy arm of Common Sense Media (together, “Common Sense”), respectfully submits these comments following the Federal Trade Commission’s workshop on Cross-Device Tracking. Common Sense is a national, independent, nonpartisan voice for America’s children, working to ensure that every child has the opportunity to thrive in the 21st century. We applaud the FTC for turning its attention to the increasingly intricate, inventive, and in many ways invasive tracking of consumers.
The November workshop provided an eye-opening view of cross-device tracking, which, as discussed, is very opaque, occurring with little notice and few opportunities for individuals to exercise choice.  The concerns this raises will only grow as we move deeper into an Internet of Things world and cross-device tracking over a multitude of technologies becomes increasingly woven into daily life.
Common Sense seeks to call the FTC’s attention to the pernicious aspects of cross-device tracking for children and teens—whose personal information the FTC has recognized is particularly sensitive. Children and teens are especially vulnerable to cross-device tracking. Given cross-device tracking’s invasive nature, and the COPPA concerns it raises for young children, the FTC should carefully consider and investigate the occurrence and implications of cross-device tracking of youth. The FTC should also provide clear rules and guidance regarding cross-device tracking of children and teens, recognizing the sensitive nature of the information collected and the unique risks involved.
Cross-Device Tracking Is Now the Norm
As marketers and advertisers increasingly rely on tracking consumers as a means of measuring the success of their efforts, tracking people across devices (from computer to tablet to phone) is seen as one way of gauging effectiveness. Multiple companies are investing in various technologies designed to increase the accuracy and the prevalence of cross-device tracking. Teens are particularly susceptible to this type of surveillance; given the growth of educational technology in schools, a student could find herself on multiple Internet-connected devices a day as a precondition of receiving a public education.
With cross-device tracking, companies can pinpoint individual device users and build increasingly complex, minutely-detailed portraits of them.
Children and Teens Are Particularly Susceptible to Cross-Device Tracking
Children and teens spend significant parts of their days with devices, and live in homes filled with devices. For example, according to recent Common Sense research:
- teens and tweens (ages eight to twelve) spend over six and a half and four and a half hours, respectively, with screen media each day (not counting school and homework);
- mobile devices account for close to half of their screen time;
- the majority of tweens and teens watch TV every day;
- almost all homes with kids ages eight to eighteen have a TV set, and three-quarters or more have a video game player, smartphone, tablet, and laptop;
- more than half of tweens have their own tablets and almost half have TVs in their bedrooms; and
- two-thirds of teens have smartphones, more than half have TVs in their bedrooms, and almost half have their own laptops.
And this research just includes “classic” devices. Talking dolls and toys, in addition to smart thermostats and other gadgets, are increasingly present in families’ homes. The ever-present nature of technology in kids’ lives means that today’s young people are susceptible to having their every move monitored by corporations.
Moreover, these devices aren’t immune to tracking just because they are in kids’ hands—indeed, far from it. While companies are not forthcoming about their cross-device tracking activities, those who track have listed kid-friendly and kid-focused brands among their clients. Devices marketed to families and kids—like smart TVs—nowadays often come equipped with tracking capabilities.
Furthermore, children and teens are less likely to be aware of cross-device tracking or understand its implications for their futures, making them less likely to opt out of tracking even if they are given the chance. Young kids are less likely to realize they are being tracked; if teens do understand they are being tracked, they are less likely to fully consider the long-term consequences. The generation of children growing up is the first generation to have a digital footprint for their entire lives – in some cases, starting before birth in the form of shared ultrasound images. The digital picture companies can gather about them is enormous, and can follow them for decades longer than adults. It’s no longer just a digital footprint, but a full body scan.
When you couple this susceptibility with unknown future analytics practices, the concerns for young people multiply. Already, we see pervasive abuses of big data, ranging from housing discrimination and digital redlining in loans to flawed data used in hiring practices. Big data might also be used to determine school placement, college admission, and the availability of scholarships and student lending. As today’s children become tomorrow’s adults, we need additional protections in place to head off the potential abuses and human errors that will invariably accompany data collection that outstrips our ability to analyze the data and check for errors.
The FTC Should Carefully Consider Cross-Device Tracking’s Implications for Children and Teens and Ensure They Are Appropriately Protected
Given the special susceptibility of children and teens to cross-device tracking, the FTC should consider what additional safeguards are necessary. Any notice and choices should be presented to teens in a method tailored to their age and understanding, and companies should avoid practices of collecting now, and asking for forgiveness later, with such impressionable populations.
Further, for children under thirteen, the FTC should consider how cross-device tracking may run afoul of COPPA, and what additional guidance the FTC can provide to companies and the public about COPPA’s application to cross-device tracking.
Cross-device tracking can be precise enough to qualify as the collection of personal information under COPPA (as geolocation, persistent identifiers, or simply because it allows for contacting an individual). Cross-device tracking also raises new questions as to when companies have actual knowledge they are collecting information from children. If one device is in an elementary school all day and another device communicates with it, and learns its location and past location, should the other device assume it is tracking a child and stop? If a device communicates with another device and learns that other device is a child’s toy, should it stop? As the Internet of Things and connected devices becomes more pervasive, these technical issues will become more common. As we saw with Google’s overly broad collection of wireless data, even the most sophisticated companies can take actions that erode privacy protections.
Common Sense agrees with the FTC that there is a need for more transparency, choice, and consumer education. But young, vulnerable teens and children deserve more. The FTC should further investigate cross-device tracking of children and teens and its implications. It should then carefully consider what protections and safeguards are appropriate for today’s young people living in an increasing connected, and increasingly tracked, world. For young children, this may include additional guidance with respect to COPPA, and for teens, rules and guidance with respect to age-appropriate notice and consent, as a starting point.
 And, as noted, in many instances, opting out simply restricts ad targeting, but not the underlying information collection.
 See, e.g., FTC, Protecting Consumer Privacy in an Era of Rapid Change 47, 60 (Mar. 2012) (stating that when sensitive data such as “children’s information is involved … the likelihood that data misuse could lead to embarrassment, discrimination, or other harms is increased,” and that, “companies that target teens should consider additional protections.”).
 The groups spend approximately another two and a half hours each day listening to music or with print media. Vicky Rideout, The Common Sense Census: Media Use by Tweens and Teens, 13 (Nov. 2015), available at https://www.commonsensemedia.org/research/the-common-sense-census-media-use-by-tweens-and-teens.
 Common Sense Census, supra note 3, at 16.
 Common Sense Census, supra note 3, at 20.
 Common Sense Census, supra note 3, at 22-23.
 Common Sense Census, supra note 3, at 22-23.
 Common Sense Census, supra note 3, at 22-23.
 This poses privacy and security concerns beyond cross-device tracking. See, e.g., Bill Fitzgerald, Privacy, Parenting, and the VTech Breach (Dec. 3, 2015), https://www.commonsensemedia.org/blog/privacy-parenting-and-the-vtech-breach; Samuel Gibbs, Hackers Can Hijack Wi-Fi Hello Barbie to Spy on Your Children (Nov. 26, 2015), http://www.theguardian.com/technology/2015/nov/26/hackers-can-hijack-wi-fi-hello-barbie-to-spy-on-your-children.
 At least as late as November 2015, SilverPush listed Disney and Cartoon Network as clients on the first page of its website. (See also Ed Felten’s Nov. 13, 2015 blog describing Cartoon Network as a listed client, http://altmode.org/2015/11/13/searching-for-ultrasonic-beacons/. ) As of Dec. 15, no clients are listed on the home page. See http://www.silverpush.com/#!/.
 See, e.g., Adriana Galván et al, Earlier Development of the Accumbens Relative to Orbitofrontal Cortext Might Underlie Risk-Taking Behavior in Adolescents, Journal of Neuroscience (June 21, 2006); Adriana Galván and Kristine M. McGlennen, Enhanced striatal sensitivity to aversive reinforcement in adolescents versus adults, Journal of Cognitive Neuroscience (2013). See also FTC, Data Brokers: A Call for Transparency and Accountability 55 (May 2014) (noting that that teens often fail to appreciate long-term consequences of posting data online). Special considerations related to teens’ level of understanding are discussed further in Common Sense’s comments to the FTC filed August 15, 2014.
 See, e.g., Ryan Calo, Digital Market Manipulation, 82 Geo. W. L. Rev. 995 (2014) (discussing big data and market manipulation); Brentin Mock, Redlining is Alive and Well—And Evolving, The Atlantic City Lab (Sep. 28, 2015), http://www.citylab.com/housing/2015/09/redlining-is-alive-and-welland-evolving/407497/; Jessica Silver-Greenberg and Michael Corkery, Evans Bank Settles New York Redlining Lawsuit, N.Y. Times Dealbook (Sep. 10, 2015), http://www.nytimes.com/2015/09/11/business/dealbook/evans-bank-settles-new-york-redlining-lawsuit.html?_r=0; Frank Pasquale, The Dark Market for Personal Data, N.Y. Times (Oct. 17, 2014), http://www.nytimes.com/2014/10/17/opinion/the-dark-market-for-personal-data.html?_r=0 (discussing algorithms and hiring); Nathalie Baptise, Them That’s Got Shall Get, The American Prospect (Oct. 13, 2014), http://prospect.org/article/staggering-loss-black-wealth-due-subprime-scandal-continues-unabated (discussing predatory lending automated by big data).
 See 15 U.S.C. § 6501(8).
 As noted by the FTC in its rule update, actual knowledge is a highly fact specific inquiry. See 78 Fed. Reg. 3978 (Jan. 17, 2013).
 David Kravetz, An Intentional Mistake, Wired (May 2, 2012), http://www.wired.com/2012/05/google-wifi-fcc-investigation/.
 Maneesha Mithal, Associate Director, Division of Privacy and Identity Protection, FTC, Closing Remarks at Cross-Device Tracking: An FTC Workshop (Nov. 16, 2015).