It’s 10 p.m. Do you know where your children are? Online, that is?

Perhaps it’s time to dust off the old public service announcement, which ran before the nightly news from the 1960s through the ‘80s, reminding parents to check in on their kids. This time, the message should include not only where children are going in real life — but also on their iPhone, says a digital privacy expert at Harvard Law School.

On Aug. 2, the United States Department of Justice and the Federal Trade Commission sued the popular video-sharing app TikTok — and its parent company ByteDance — alleging that the platform violated the law in collecting and maintaining data about children under 13.

In particular, the government’s lawsuit says that TikTok allowed kids to create accounts without a parent’s permission, retained personal information about them, and failed to respond to caregivers’ requests to delete the data, all in contravention of the Children’s Online Privacy Protection Act. The suit also alleges that, even in the app’s “restricted mode” — which is intended for children — TikTok illegally collected and stored information about underaged users.

The suit comes in the wake of a law signed by President Joe Biden in April aimed at coercing TikTok to divest its Chinese ownership or be banned in the U.S. It’s also part of a pattern of more aggressive legal action by state and federal governments against online service providers that target or host children, such as social media apps, games, and communications tools, says Leah Plunkett ’06, executive director of Harvard Law School Online and a lecturer on law at Harvard.

Plunkett says that data privacy is just one issue parents should think about when letting their kids spend time on tablets, phones, and computers. “It’s not just about what data is being collected about children, and with whom they are interacting,” she says. “It’s also about what are they being told? What are they learning or not learning?”

“There’s a lot to be concerned about,” she adds.

And her worries are not limited to what kids themselves do. In an interview with Harvard Law Today, Plunkett, the author of “Sharenthood: Why We Should Think before We Talk about Our Kids Online,” says that parents should not only be wary of what their children post online — but what they are posting online about their children. Here, Plunkett explains the lawsuit against TikTok, how the government can better protect minors, and what parents can do in the meantime.

Leah Plunkett headshot

Harvard Law Today: What are the biggest concerns right now around children’s use of the internet and social media?

Leah Plunkett: The biggest concerns associated with children’s use of the internet, especially social media platforms right now, center around privacy, well-being, and information accuracy.

The first, privacy, is making sure that youth (as developmentally appropriate) and their parents or other trusted adults in their lives have access to comprehensive, clear, and candid information about what data is being collected by a given service or tool and why, and to what ends it’s being used and by whom. That is the really the only way that youth themselves, as well as their parents or other trusted adults, can even hope to make informed choices about whether or not to enter into the “contract” with a social media platform or other digital platforms. And I’m putting that word “contract” in air quotes, because the legal device that is technically being used anytime you set up a social media account or other type of online account is a contract. But most of these are contracts in name only, and don’t actually represent informed consent.

The next category is well-being, and it reflects growing and very legitimate concerns and questions about links between youth internet use, especially social media, and such factors as mental health, emotional regulation, social relationships, and other key factors that go into having a good quality of life. Seeing how much time kids are spending online, particularly on social media, what kinds of experiences they’re having, and with whom they’re having them is critically important.

HLT: And what about the third area you mentioned, information accuracy?

Plunkett: This is something that I have been studying, initially as part of the Berkman Klein Center for Internet & Society, since about 2014. We are seeing that a lot of the concerns about information accuracy are now more in the general consciousness, and they include how misinformation, disinformation, propaganda, and conspiracy theories can circulate online. And it is even more concerning when we think about these things as targeting youth.

So, it’s not just about what data is being collected about children, and with whom they are interacting. It’s also, what are they being told? What are they learning or not learning? And how can we empower youth, as well as the parents and other trusted adults in their lives, to look for information accuracy in the content they are seeing, creating, and perpetuating? In other words, there’s a lot to be concerned about.

“Seeing how much time kids are spending online, particularly on social media, what kinds of experiences they’re having, and with whom they’re having them is critically important.”

HLT: What is the Children’s Online Privacy Protection Act, and what does it cover?

Plunkett: There’s the act, Children’s Online Privacy Protection Act, and the regulations implementing the act. COPPA as an act and a rule is designed to safeguard the personal information of users under 13 who are using commercial websites or other similar digital services when that digital provider is intending to direct their activity at kids under 13, or actually knows that kids under 13 are using their website, app, or similar service. When COPPA applies, it requires a number of safeguards for a child’s personal information, including parental consent for the minor to create an account, and access to information for the parent about what information has been collected — including the ability to request and get the deletion of information that’s been collected.

COPPA is a very, very important federal privacy law, but it is not sufficient for the way that the internet works today. And in fact, the Senate very recently passed something that is being referred to as “COPPA 2.0” that, if it then is passed by the House and signed into law, would represent the biggest overhaul of COPPA since it came into being. But that new law hasn’t been passed by the House of Representatives yet, so it is critically important that the current law, COPPA, be applied diligently and comprehensively to, especially, our biggest tech providers who either direct their activities toward kids under 13 or know that kids under 13 are using their service or other product.

HLT: What kind of data about kids are platforms allowed to collect or keep?

Plunkett: There’s a difference between when a platform bound by COPPA gets parental consent for the user to create an account and when it does not. At a national level, if a platform has verifiable parental consent, under COPPA, it can collect personal information, including the child’s name, email address, and their activity. But if the platform doesn’t have verifiable parental consent, the amount of information that it can collect about a user under 13, even if that user is giving permission, is extraordinarily limited and really designed to be just enough information to facilitate the requesting and getting a verifiable parental consent. So, the platform may be able to get some basic user contact information, for instance, for the purpose of then getting parental consent. COPPA is really meant to require age gatekeeping on the part of a website or other service provider to whom it applies.

HLT: Given how easy it is to lie about personal details on the internet, can platforms ever fully prevent underage users from accessing and using their products?

Plunkett: This question makes me think of a classic New Yorker cartoon about anonymity on the internet. No, it is never going to be possible for 100% of websites and other digital service providers to know 100% of the time with 100% certainty the age of the user on the other side of the device. That said, though, there is a whole lot of space between, on the one hand, the reality that we’re never going to have 100% knowledge and, on the other, making good faith efforts to comply with COPPA and any other applicable federal or state privacy laws.

The allegations in the Department of Justice’s suit against TikTok aren’t that TikTok got to 99.9% of knowing the age of their users, and they just didn’t get that last little bit. The allegations here are that TikTok violated terms of a 2019 federal court agreement to which it was subject and violated the terms of COPPA — both the act and the rule. The allegations that DOJ brings are of, and I quote, “massive scale invasions of children’s privacy.” And they’re saying that it’s data about millions of children under 13, for years, and that TikTok, even in their product that was billed as being a kids’ version, allegedly failed to comply with the 2019 order and COPPA. So, according to the U.S. Department of Justice, TikTok is engaging in behavior that is coming nowhere close to reasonable, good faith attempts at compliance with COPPA.

HLT: Is TikTok unique in its collection of data on users under 13, or should we be training a wary eye on other apps as well?

Plunkett: Right now, there is growing focus from the Federal Trade Commission and the Department of Justice on protecting kids’ and teens’ digital privacy, not limited to TikTok. We should be looking at all of the major social media, gaming, and other interactive platforms that our kids and teens are using, and the FTC and DOJ have been doing so.

In 2019, we saw Google and YouTube pay what was then a record fine to the FTC and the New York Attorney General for violating COPPA — $170 million total. Then fast forward to 2023, we saw Epic Games get hit with what then became the largest set of financial penalties for a COPPA violation in children’s games. So, we are seeing the federal government taking a very close look and taking very necessary enforcement actions against platforms — whether it’s social media or gaming — where we know kids and teens are hanging out and spending a lot of time.

HLT: What do you think is the most likely outcome of the lawsuit against TikTok?

Plunkett: If it follows similar paths, the likely outcome would be some sort of settlement that I predict would set a new record for a dollar amount paid to settle a COPPA case. I also think that the government will likely be very focused on the part of its complaint where it is looking for injunctive relief — in other words, a court to order TikTok to comply with the 2019 order, with the COPPA act and rule.

Looking at the government’s complaint, they’re very focused on the fact that they can’t even fully tell the extent of TikTok’s alleged privacy violations, because TikTok has not been following the recordkeeping requirements in the 2019 order. I would predict that the federal government would not be amenable to a settlement here that didn’t include comprehensive, verifiable, good faith compliance with existing and potentially additional recordkeeping requirements.

HLT: Do you think the government should be doing more to protect children’s privacy online?

Plunkett: I think that the federal government should continue to move forward with what is now being called KOSPA (Kids Online Safety and Privacy Act). When the Senate passed KOSPA last week, it took a major and necessary step toward putting in place practical, ethical privacy protections for minors, including minors over the age of 13. I hope the House quickly and decisively passes KOSPA and that it is signed into law, and that the agency work necessary to fully develop new regulations and enforce them is done expeditiously. We’re at a real inflection point here, and I as well as other privacy experts in academia, industry, civil society, and beyond, are looking closely, to see what the House does.

HLT: In the meantime, how can parents help protect their children from some of the risks you identified?

Plunkett: Parents can help protect their children by having regular and direct conversations where they get a sense of what their kids are doing. Then, they should put either requirements or guidelines or both — depending on the particular child and family — in place around where their kids can go online.

I really encourage parents to think about online spaces as analogous in many ways to brick-and-mortar spaces. The same way that parents don’t generally give their 12-year-old keys to the car and a credit card and tell them to have fun, parents may not want to give kids open devices without using things like the parental controls. That’s the equivalent of saying, “Go wherever you want on the information superhighway.”

“The same way that parents don’t generally give their 12-year-old keys to the car and a credit card and tell them to have fun, parents may not want to give kids open devices without using things like the parental controls.”

What is trickier about digital spaces than their brick-and-mortar analogs is that kids and teens, if they put their mind to it, can generally find their way around attempts at parental restrictions or guidelines online. If a police officer sees a 12-year-old driving a car, they’re going to stop them. But kids are very good at finding a friend whose device doesn’t have restrictions on it, or that website on their school-issued device that doesn’t have controls on it. So, it is not enough to look at the devices and services that you know your child has.

HLT: How should parents address that challenge?

Plunkett: The same way you talk to kids in developmentally appropriate ways about brick-and-mortar safety, you need to start saying to young kids, “don’t talk to strangers online.” We need to have integrated digital citizenship safety conversations with our kids, starting at the same time that we have brick-and-mortar safety conversations with them, because inevitably, our children are going to wind up in open digital spaces where we are not with them.

And even more important than what we can do as parents and other trusted adults to put requirements or guidelines in place, we need to be empowering our kids to have a digital citizenship toolkit that involves privacy, safety, and information accuracy. I think some really excellent resources include content produced by the Youth and Media team at the Berkman Klein Center, content produced by Common Sense Media, and Urs Gasser and John Palfrey’s book for parents.

HLT: Anything else parents should be thinking about?

Plunkett: We as parents and other trusted adults often wind up inadvertently compromising our children’s privacy ourselves, which I have written about in my own book, “Sharenthood.” Especially at this time of year, when we’re doing back-to-school season, we as parents are proud of and excited for our kids. But let’s help set our children up for online privacy and digital citizenship success and not share online exactly where their school is located, or exactly who their teacher is, or all their hopes or dreams or fears and anxieties for the upcoming year. Because right there, we as parents and other trusted adults are giving social media or other platforms private information about our kids, and we’re making it available to the world. So, we need to be mindful of our own sharing habits as well.

Want to stay up to date with Harvard Law Today? Sign up for our weekly newsletter.

Sign up for the Harvard Law Today newsletter