On Wednesday, September 17, the Virginia Law Review convened Professors Danielle Citron and Ari Waldman to discuss their forthcoming article, "Rethinking Youth Privacy." Danielle Citron is a Professor of Law and Director of the LawTech Center at the Law School, while her colleague is a Professor of Law at the University of California, Irvine School of Law. Their article, forthcoming in Volume 111 of the Virginia Law Review, is the latest output of the collaboration between these two renowned scholars of privacy law.

In their article, Professors Citron and Waldman argue that the prevailing paradigm of youth privacy law—what they label the “parental control model”—obscures real privacy harms experienced by young people and is inadequate for protecting their interests in intimate privacy. Under the parental control model, parents provide consent for the collection of their children’s data and they are presumed to be responsible for protecting their children from online dangers. Where youth privacy laws create substantive rights—for example, the rights to access, delete, or amend stored personal information—those rights generally belong to the parents.

Professor Citron pointed to the Children’s Online Privacy Protection Act (COPPA) and the Family Educational Rights and Privacy Act (FERPA) as examples. Under FERPA, children under the age of eighteen are not permitted to access their own school records, but parents are able to access this information. Similarly, under COPPA, websites that direct their services towards or have actual knowledge they are collecting personal information from children under the age of thirteen are required to obtain verified parental consent. COPPA also grants rights to parents to access, correct, and delete their children’s personal information, among others. As these examples demonstrate, parents in the parental control model are functionally the “go-to executors of their kids’ privacy options,” noted Professor Waldman.

Supporters of the parental control model advance several premises that justify this paradigm. One of the primary rationales with which Professors Citron and Waldman took issue was the “developmental rationale.” According to this rationale, because children are presumed cognitively underdeveloped under a certain age, they “cannot make decisions on their own,” explained Professor Waldman. “The premise is that children cannot make educated, informed decisions until they reach a certain age” and commensurate level of maturity. But “if kids are immature, someone needs to step in to make that decision for them.” Parents fulfill that role by making informed decisions on behalf of their children.

At first gloss, this rationale is subject to critique because different privacy statutes are triggered at different age thresholds, noted Professor Waldman. Under these various statutes—compare COPPA and FERPA, for example—it is presumed that “young people cannot make decisions on their own, but after the [statute’s threshold] age apparently they can.” What is the developmental significance of thirteen compared to eighteen? The developmental rationale does not provide a coherent answer.

But Professors Citron and Waldman’s criticisms cut deeper. The basic assumption of the developmental rationale, according to Professor Waldman, is that it is necessary “to grow up and have experiences [in order] to make informed decisions, but [that it is not necessary to have the] opportunity to make educated, informed decisions” during the period of presumed immaturity. Not only is this logic circular, but it is not empirically accurate. Professor Waldman cited empirical evidence suggesting “that privacy is understood by children as young as two or three.” If children can understand the concept of privacy, they are competent enough to have a voice in making informed privacy decisions.

The developmental rationale “also assumes parents are better able to make informed decisions,” but neither does this assumption stand up to scrutiny. First, this assumption places the burden on parents to exercise privacy rights on behalf of their children, but parents rarely fulfill this responsibility. Not to mention that “parents can also be narcissists,” said Waldmann. He offers, for example, the rise of “sharenting”—parents excessively posting pictures and information about their children online without their consent. Although we may have a “presumption of parental beneficence,” many parents conduct such behavior for their own financial gain, reaping the benefits of the unconsented exposure of their children online.

After attacking the foundations of this prevailing privacy model, Professors Citron and Waldman offered some suggestions for reform. First, they recommended “structural change.” The parental control model operates in a broader notice and choice regime for privacy law. Under the notice and choice regime, corporate collection of information is generally legally permissible as long as companies provide notice of their data collection practices and consumers provide consent by continuing to use the service. The parental control model only makes sense in such a regime—“only a notice and choice model makes the developmental rationale relevant.” Moving away from this thin notice and choice regime could provide more robust protections for youth without relying on parental consent.

Short of sweeping structural changes, even implementing smaller “structural limits to what companies can extract from children” is a productive start. Eliminating features like infinite scrolling and algorithmically curated feeds, noted Waldman, would limit data collected from children without resorting to parental consent.

Most importantly, however, Professors Citron and Waldman argued it is necessary to create “greater platforms for youth voices.” The proposal is straightforward: young people deserve a seat at the table when decisions about youth privacy are made. “Legislatures can start by actually valuing youth voices,” suggested Waldman. “They can allow youth to testify,” and individual legislators can open their offices—which are normally closed to non-voters—to young people. As Professor Citron stated, providing the space for youth voices to contribute to dialogue about youth privacy recognizes their autonomy and creates a pathway to create the privacy that youth “want, expect and deserve.”

Citron & Waldman’s Rethinking Privacy

Judge David Bernhard Visits During Hispanic Heritage Month

Law School Hosts Rules and Reasons: A Conference for Fred Schauer