Casestudy in Legal Linearity: The Children's Online Privacy Protection Act (COPPA)

As discussed previously, developmental psychology has moved toward a nonlinear paradigm driven by studying individuals in social context. The Children's Online Privacy Protection Act framework, however, presents a static framework that does not take into account the nonlinear nature of development.

COPPA requires that websites targeting children under age 13 provide notice of privacy practices and obtain verifiable parental consent prior to collecting data from the child. The statute also empowers the Federal Trade Commission to promulgate additional regulations to require the operator of a website subject to COPPA to establish and maintain reasonable procedures “to protect the confidentiality, security, and integrity of personal information collected from children.” Specifically, COPPA stipulates that prior to collection of data from a child under 13, a website “operator” must obtain obtain “verifiable parental consent”. The preferred medium for this verifiable parental consent is receipt of a fax from the parent, however an email exception was originally crafted as an interim measure for limited amount of time. This email exception evolved into a “sliding scale approach” which is still applied by the FTC in COPPA inquiries. Depending on the character of the data collection and the intended use, the FTC’s analysis varies.

During the first six years of its effectiveness, COPPA has received mixed reviews at best. The deterrent effect of prosecutions appears to have been limited. As a practical matter, a large number of websites which are governed by COPPA are simply noncompliant, willingly risking prosecution rather than investing effort in attempting to comply. As demonstrated by several studies, compliance level is generally under 60%, and even those websites which attempt compliance on their face, are frequently easily circumventable in their age verification process. From the perspective of the child user, COPPA has been viewed to only protect the data of the children who wish to have their data protected. For children who simply wish content access, in many instances immediate workarounds are readily available. Often the child merely needs to log in again and provide a false birthdate to gain access to the material to which s/he was denied access.

COPPA makes linear developmental assumptions. First, COPPA is predicated on the idea that an adult parent’s development and proficiency with technology surpasses that of her child, an assumption research demonstrates is unsustainable. Technology learning and development do not always cleanly map on to chronological age. Parents frequently feel their ability to monitor their children’s activities online is limited.

Second, the age of capacity to consent to data gathering stipulated in COPPA, age 13, appears to have been selected arbitrarily. During early adolescence, large divergences in development are visible, perhaps even more so than in later life. Particularly since the issue at hand relates to data security contracting, a more logical age of consent might mirror contractual capacity generally. The usual age of contractual capacity is 18.

Third, COPPA takes into account only one computing context, the home, and presumes a parent’s being available during the child’s internet time. However, children frequently access the internet and give away information about themselves using computers at school, at friends’ houses and in the library. Therefore, a regulatory paradigm presuming parental presence does not reflect the reality of children’s situated learning in multiple contexts.

Fourth, both technology use and development are emergent phenomena. COPPA did not take into account the norms of corporate conduct that would arise to circumvent its restrictions. Because COPPA grants no private rights of action to parents, enforcement of COPPA is the sole province of the FTC, which is an understaffed and overburdened agency. As demonstrated by widespread noncompliance, companies frequently run a risk-benefit calculus regarding the likelihood of prosecution and decide to risk regulatory action rather than invest in compliance structure.

Finally, COPPA presents a technology-focused regulatory design; the focus is on each website that chooses to collect children’s data. However, as technology evolves, a website-centric approach is destined for obsolescence. A more promising regulatory design would be constructed in a human-centric manner, focusing on the child and the child’s information. Such an approach would not only demonstrate greater versatility and regulatory longevity, but systemic efficiencies would also result. In lieu of each website needing to institute a separate age verification process for each child, and each parent approving each website, a child-focused approach could be constructed in such a manner to allow for a single parental approval and a single website registration. In this way, economies of scale could be created through a child data protection structure focused on the child rather than on the website operator. Such an approach would also acknowledge that parents may be less knowledgeable and need more protection than their children, suboptimally suited for a role of gatekeeper.

Crafting Nonlinear Technology Regulation

Nonlinear developmental theory offers five concrete lessons for crafting successful technology regulation.

First, nonlinear developmental theory instructs us that human development and learning is always situated; the proximate zone of development varies across individuals. Development is not something that happens to humans in a preordained manner; development is an interactive process that occurs not within the individual, but on the person-society border. Therefore, the society the person experiences pushes the course of development and visa versa. The same biological individual in two different technology-mediated social contexts will arrive at two different developmental outcomes and potentially two different regulatory prescriptions.

Second, development is an emergent phenomenon. The social context – including the technology itself – changes in frequently unpredictable ways. Thus, regulating in a manner predicated on static assumptions about people and technology results in law destined for quick obsolescence. Both human behavior and technology will evolve in response to law. Nonlinear developmental theory show us that effects on individuals’ development and behavior are emergent across multiple layers of context. Multiple developmental layers must coincide in pushing humans in the direction sought by the regulation. The influence of the exosystem of social norms, the mesosystem of peer groups and the economic exchange and the microsystem of the individual’s current state of development all come into play. Without considering all of these, regulation can frequently be circumvented or ignored.

Third, learning and development do not always cleanly map on to chronological age. An adult user whose only interactions with a software application occurs once a week for an hour in a library on a shared machine experiences technology development and learning differently than does the ten year old child with a dedicated laptop in her bedroom. Technology can act as both an equalizer of abilities and an exacerbator of differences.

Fourth, regulating the way that humans interact with technology means contemplating multiple layers of context that cooperate or conflict to generate development. At various stages of life, developmental progress intersects with identity goals, creating another lens guiding individual behavior and developmental outcomes. Because these identity goals are inherently social in nature, two layers of context push on the individual – first the context shaping development through interactions and second the context in which the individual attempts to work toward identity goals.

Finally, technology is merely a tool that assists humans in achieving more than they otherwise could; the regulatory and developmental focus should always remain human-centric. New technologies should be analyzed merely as tools in a Vygotskian sense. They enable a user to accomplish more than the user ordinarily could without the tool. As such, the conduct that arises from this assisted action is not new; it is merely amplified conduct. Regulating technology creation is, however, not the answer; regulating humans, their conduct and their use of that technology is a more promising approach. These humans, perhaps unlike the technology itself, can demonstrate extreme levels of variation but provide a more efficacious, though more complicated, point for regulation.

Placing these five lessons in regulatory context, the Children’s Online Privacy Protection Act demonstrates how ignoring these five lessons of contextualist developmental theory can result in regulatory suboptimality.

Humans + Technology = Emergent Behaviors, part II

Albert Bandura’s Social Learning Theory presents an analysis consonant with Vygotsky and Bronfenbrenner. Bandura's theory views the person-environment interaction as a three way exchange in which the person, an entity with unique characteristics, performs a behavior in an environment which responds to the person and the behavior in a process of reciprocal determinism; it is an idiosyncratic interaction. According to Bandura, models can serve to instruct, motivate, disinhibit, inhibit, socially facilitate, and arouse emotion in a process of vicarious reinforcement. Essentially, development is viewed as a process of quantitative change, during which learning episodes gradually accumulate over time. Although Social Learning Theory does not directly address historical or cultural context, it reflects the tradition of Vygotsky and the contextualist approach by recognizing the dialectical process of a person who is working within and shaped by an environment; a triadic reciprocal determinism occurs among behavior, cognitive factors and the environment. Also, as in the theory of Vygotsky, there is no endpoint to development, and universal behaviors are rare. Thus, children are developmentally malleable but only within constraints of biology and environment, an environment replete with technology.

Finally, Erikson frames development through identification of eight stages/dichotomies of human development and identity formation: (1) basic trust versus mistrust, (2) autonomy versus shame, (3) initiative versus guilt, (4) industry versus inferiority, (5) indentity versus role confusion, (6) intimacy versus isolation, (7) generativity versus stagnation, (8) ego integrity versus despair. Erikson’s stages 1, 2 and 3 represent childhood stages when the individual is not yet capable of interacting with (borrowing a Vygotskian phrase) “cultural tools” such as the internet. Stage 8 is similarly a stage in which the individual is primarily conquering internal dynamics, and, therefore, interaction with culture, its tools and other individuals is not the primary focus of the stage. Conversely, in stages 4, 5, 6, and 7, the individual is learning from and making a place in society. The child becomes a different person in each stage with different cognitive capacities and progressively achieves a greater ability to interact with a wider range of people. For Erikson, the ego can only remain strong through interactions with cultural institutions that enable the development of the child’s capacities and potential. Technology is a key component of these interactions.

These four schools of nonlinear developmental theory offer useful analytical lense for (re)theorizing and assessing technology regulation. A discussion of some of the insights these theories may provide for technology regulation follows.

Humans + Technology = Emergent Behaviors, part I

A group of other developmental theorists, however, developed decidedly nonlinear approaches that hold important contrary insights to the approach of Piaget and other linear developmental theorists. The works of these theorists argues that development and identity are inherently dialectical and interactionist joint constructions. An individual interacts with and within a particular social and technological context to generate development in an emergent manner.

Lev Vygotsky, a key figure of contextualist developmental theory and a contemporary of Piaget, introduced the importance of analyzing development in cultural context. The smallest unit of analysis for Vygotsky is the child in a particular social context, an inherently variable construction across milieu and individuals. Learning and development occurs on the person-society border through an individual interacting inside the “zone of proximal development”. The zone of proximal development refers to the gap between the actual developmental level of the child at the time and the higher level of the child’s potential development with help from adults or more advanced peers. Help in development comes not only from humans in the environment, but also from self-help using cultural "tools" such as computers. For Vygotsky, humans master themselves from the outside through psychological and technical tools, which allow individuals to achieve more in the context. Tools also vary from culture to culture and social contexts. In other words, the focus of assessment using a Vygotskian developmental paradigm is less on the static notion of who the child currently is and more on the dynamic question of who the child can become, depending on context and tools.

An elaboration on the evolving, nonlinear nature of contexts that shape development can be found in the work of Urie Bronfenbrenner. Bronfenbrenner presents an ecological model that illustrates the importance of reviewing dynamics across multiple levels of social context. Specifically, he identifies four levels of analysis – (1) macrosystem; (2) mesosystem; (3) exosystem; and (4) microsystem. Macrosystem level analysis requires examination at the level of culture as a whole, along with belief systems and ideologies underlying cultural rules and norms. In other words, the analysis focuses on the mechanisms of social governance and the worldview prevalent in civil society. Mesosystem level analysis focuses attention on interpersonal dynamics and the dynamics between the individual and secondary settings, such as work. Exosystem level analysis contemplates the interactions outside of the primary sphere of analysis but which, nevertheless, affect or are affected by what happens in the primary setting. On the microsystem level, individuals and their psychological development in a particular context is the primary level of analysis. The individual interacts within and across all four levels and consequently develops. Technology impacts each of the levels of social context.

Humans + Technology = A Straight Line?

Linear and nonlinear developmental psychology differ in key assumptions about the manner humans interact with the world around them, in particular with "tools" like technology.

Linear developmental psychology theory, as demonstrated by the work of Jean Piaget, creates an age-contingent, lock-step trajectory for human development. Jean Piaget divided development into four periods with substages within each period. These four periods include the sensorimotor period, the preoperational period, the concrete operational period and the formal operational period. The sensorimotor stage lasts from birth to age two and is characterized by a child moving from simple reflexes to organized behaviors that are oriented toward interacting with the external world through goal oriented exploration behaviors and object permanence skills. It is followed by the preoperational period which spans age two until age seven. The preoperational period involves development of semiotic function, meaning ability to use symbols, incomplete differentiation of other people from the self while interpreting the world in terms of the self in a loosely logical manner. Next, the concrete period lasts between ages seven and eleven and is marked by the ability to perform logical mental operations, which are internalized and can be reversed. Finally, the formal operational period from age eleven to age fifteen is a time characterized by abstract thinking where mental operations are not necessarily tied to concrete objects. At this point in a linear developmental paradigm, adulthood arrives and development stops. Therefore, adulthood is the goal and signals the highest level of development in a linear paradigm, and the “achievement” of development.

Therefore, in summary, linear developmental theory presumes that all humans develop in a similar fashion, demonstrating an upward developmental trajectory that is tied to chronological age. Consequently, a linear approach to technology regulation presumes a homogeneity among users regarding individuals’ sophistication and comfort level with technology based on their chronological age. In other words, chronologically older individuals should demonstrate more technology proficiency than those of chronologically younger age.

Nonlinear developmental theory adopts the opposite approach. It asserts that chronological age cannot necessarily be tied to assumptions about development; development is an inherently social process that occurs in a particular real-world context using the "tools" of that context. Nonlinear developmental psychology theory is perhaps best reflected in the work of Lev Vygotsky, Urie Bronfenbrenner, Albert Bandura, and Erik Erikson. This work will be explored in the next two entries.

The Most Volatile Technology: The User

Thank you for the introduction and for including me in this project.

Perhaps the first steps in generating a successful broader theory of technology and law include identifying defining characteristics of such a theory. One of these defining characteristics is the ability of the theory to co-evolve with the particular incarnations of technologies we seek to govern. Therefore, a successful theory of technology and law will possess an emergent quality; it will develop in response to the interactions of technologies with the humans who use them.

In this way, any successful theory of technology and law is inextricably bound up with human development. Our assumptions in law about human development and how humans interact with technology are, however, rarely closely assessed. Legislative approaches are usually compartmentalized around a particular technology at issue or a particular legal idea, and rarely does technology legislation discuss users’ perceptions or development as its primary focus. The dominant human development paradigm adopted by technology regulation is one which, by default, presumes that users are a one-dimensional, linear, stagnant piece of the regulatory picture.

Although this assumption about linear human development is based in early developmental psychology theory, it is an approach not informed by later bodies of human development theory. Later developmental psychology is better suited to inform regulation of technology-mediated interactions. Nonlinear developmental theory better contemplates the emergent learning and behaviors in which users participate through technology than do traditional linear paradigms.

By inserting the dynamic nature of users and their development into the technology regulation picture, we begin to generate law that approaches the levels of complexity that actually exist in technology-mediated social systems. The remaining posts during this week will examine the work of nonlinear developmental psychologists and its lessons for technology regulation.

Introducing Andrea Matwyshyn

After a two week hiatus, Law & Tech Theory is back! It is my pleasure to introduce this week's main contributor, Andrea Matwyshyn. I have followed her work for some time and look forward to her writing this week.

Prof. Andrea M. Matwyshyn is the Executive Director of Center for Information Research and an Assistant Professor of Law at the Univ. of Florida Law School. She is an interdisciplinary researcher in the area of innovation policy and enterprise risk management, focusing her work on legal and social implications of information technology and data security.

In addition to her appointment at University of Florida, she is an Affiliate of the Centre for Economics & Policy in the Institute for Manufacturing at the University of Cambridge in the United Kingdom, where she is part of an international group of academics who explore issues at the intersection of information technology and manufacturing. She also lectures regularly to academic and industry groups, both within the United States and internationally, on issues of ethical enterprise risk management strategy, information technology regulation, and proprietary information security.

Her recent presentations include talks at University of Oxford, University of Cambridge, Stanford University, University of Edinburgh, Kellogg Graduate School of Management, Wharton School of Business, RSA Security, and BlackHat . Prior to joining the University of Florida faculty, she taught at Northwestern University School of Law and was a corporate technology transactions attorney in private practice in Chicago.

Welcome Prof. Matwyshyn!