Loading summary
Marquitecture
This podcast is brought to you by Freewheel. Freewheel gives advertisers direct connections to streaming video inventory from the world's leading publishers. It's simple, really. They're removing middlemen, which means more working media dollars, better outcomes and enhanced control. Discover how it pays to go direct. Visit freewheel.com marquitecture that's freewheel.com marquiquure.
Alan Chappelle
Welcome to the Monopoly Report. The Monopoly Report is dedicated to chronicling and analyzing the impact of antitrust and other regulations on the global advertising economy. If you are new to the Monopoly Report, you can subscribe to our weekly newsletter@monopoly-report.com and you can check out all of the Monopoly report podcasts@monopolyreportpod.com I'm Alan Chappelle. This week my guest is Gary Kybel, a partner at the law firm of Davis and Gilbert. Gary and I have been friends for 20 years and have shared clients and work closely together in the iab, NAI, and daa. Gary can speak on any number of challenging issues in the ad space. So I picked a particularly difficult topic today. Today we're talking about how to better protect kids. So we'll talk about COPPA and CASA and state level initiatives designed to protect kids, how all of that impacts those working in the ad space. So let's get to it. Hey, Gary, thanks for coming on the pod. How are you?
Gary Kybel
Great. It's great to be here with you, Alan.
Alan Chappelle
Well, good. You're down in Florida right now.
Gary Kybel
Exactly. You know, it's a little chilly today. I think it's only about 89 degrees and, you know, 90% humidity, but, you know, I put on a sweater and I can get by.
Alan Chappelle
Fantastic. Well, I also heard you may be having some air conditioning problems, so that's. That's got to be fun.
Gary Kybel
Yes, the number one Floridian problem you can have.
Alan Chappelle
So you and I met about 20 years ago as we were both representing companies in the adware space. And I sometimes refer to that as sort of ad tech's evil doppelganger. Just curious, what did you learn from your experience in that space? How does that impact your thinking about the ad tech space today?
Gary Kybel
Yeah, I mean, it's been an incredible evolution over these two plus decades. I mean, I started out my career at Davis and Gilbert representing the IAB in its infancy and developing terms and conditions where nothing really applied to the industry. And the idea that privacy about data was an important issue was something that people weren't talking about. It was really something that evolved over the early 2000s so it became such a small part of the conversation, and now it absolutely dominates every conversation when you're talking about the digital media ecosystem.
Alan Chappelle
Yeah, we were in pretty early when it comes to consumer privacy. Took me a while to build a book of business, but it now seems to be the only thing anybody wants to talk about.
Gary Kybel
Well, thanks to all the state legislatures for constantly passing what we call the Full Employment act for privacy orders.
Alan Chappelle
So today we're talking about kids and the various way that policymakers are attempting to protect children online, how that impacts the ad space. So a few different concepts sometimes get conflated a bit when talking about protecting kids online. I mean, first, there's the idea that advertising to children carries some risk of undue influence. And that's an issue that goes back to well before the Internet and into the onset of, like, the Saturday morning children's cartoons. And second, there's the idea that one might violate privacy interests simply by collecting personal data about kids, profiling kids, serving targeted ads to kids. And for now, at least, I want to talk about the second one, the idea of protecting kids from profiling and data collection. So let's start with the Children's Online Privacy Protection act, or COPPA. COPPA was originally enacted in 1998. Now, what was the first iteration of COPPA designed to do?
Gary Kybel
So that was, you know, we were at the infancy of the online world, mostly through email and, you know, rudimentary Internet services. And the idea of protecting children is certainly a bipartisan issue. Back in 1998, it was an easy idea to get people to coalesce around. Today, it's an easy issue when we talk about all the various privacy issues that we debate about. You can get people to agree on protecting children. And, you know, there's a number of ideas that, you know, children are not able to make proper decisions about how their information is going to be used, and we don't want them to be profiled and targeted in ways that adults are because they are more susceptible to being manipulated. And also dangers that people can get access to this information and manipulate children in dangerous ways. So back in 1998 and today in 2025, the idea that it's a bipartisan issue to protect children and that it's an important issue to protect children is still a consistent thought.
Alan Chappelle
COPPA gives the FTC the ability to conduct rulemaking. I'm using air quotes around when I say rulemaking. So what does that mean, and why is that important?
Gary Kybel
So the FTC has the broad authority to regulate deceptive and unfair practices. But then there are certain laws which give the FTC direct powers perhaps to issue fines and to enforce a specific law such as coppa. We don't have a federal privacy law, so they have a few discrete sectoral laws that they can enforce. And it gives them the ability to do rulemaking as well, which means they can sort of bump up the law and give their own spin to it. And so not many laws allow them to do that. And the FTC certainly has done that in the children's space, did that back in the early days in 1998 and continues to do that today.
Alan Chappelle
Well, what's interesting is that the ftc, some might argue, has very little actual power. And so the power they have with respect to COPPA is actually significantly broader than the the rest of the powers given to the ftc. And not just that rulemaking may end up being sort of the bane of everyone's existence when it comes to some of the state laws. I know, we'll talk about that in a minute, but, but you've got New Jersey and California and I guess Colorado right now who have the ability to issue their own guidance or rulemaking. And so it has the potential to significantly expand the scope of a law.
Gary Kybel
No, yeah, exactly. I mean, because, you know, the FTC can enforce, as I said, Section 5 of the FTC act for deceptive and unfair practices, but that's a subjective standard and people can debate what is deceptive and what is unfair. In addition, they're not able to issue fines directly under the FTC act, but when you have a specific law like COPPA that gives them much more power because they're allowed to issue significant fines for violations, they have a defined law that they can enforce. And when I often see enforcement actions from the FTC and they're alleging a COPPA violation, I always view that as low hanging fruit, because that's easy to do. You have a very specific standard, and if you violate that standard, they can issue fines. They don't have to go down the rabbit hole of arguing, well, is this deceptive, is this unfair? What sort of remedy can we get in a consent order? We can't find you right away unless perhaps we can get consumer redress and get you to disgorge some money. So COP is always an easy one for the FTC and then a popular one for the ftc.
Alan Chappelle
So when COPPA was first enacted, they were really more focused on like, oh, collecting an email address from someone under 13 or collecting maybe a telephone number. And so what's happened to the marketplace is it's shifted pretty significantly. So you fast forward 10 years and the then head of the FTC had started raising concerns about the creation of profiles of known children. I'm not sure that that was a widespread practice to begin with, but anyway, how do the industry associations respond to, to that concern from the ftc?
Gary Kybel
Sure. So you know, the self regulatory organizations and trade associations in the industry always try to help out the industry and try to keep lawmakers and regulators at bay. Because the view is that if the industry can self regulate and keep things under control, then lawmakers are less likely to jump in and impose some really burdensome rules. So trade associations have been very helpful in this regard. And it's sort of been, you know, hopscotch back and forth, you know, which standards are stricter ones under applicable law or ones under self regulatory regimes. And it's gone back and forth over the years, but over the past five years, with all the enactment of state privacy laws, it's clearly that the, the states have now gone further in regulating these issues, more so than the federal government and more so than the self regulatory organizations.
Alan Chappelle
Oh yeah, the states have kicked their butt on this. There's no way, no two ways about it. But so going back to about 2010, 2011, the FTC used that rulemaking authority that we just talked about to revamp COPPA. So what new rules did COPPA, we'll say COPPA 2.0 impose and how did they impact the ad space?
Gary Kybel
So when they first started doing it, as you said, when COPPA was first put in place, we were thinking about email. Then we evolved beyond email and thinking about cookies and other online trackers. And then in the most recent amendments they're working on, they're thinking about the fact that behavioral advertising is all over the place and we need to have a little bit of a stricter standard and how we allow companies to engage in targeted advertising towards children. And also it's evolved in terms of how you get consent, because going back to 1998, the thinking was, well, how do you get consent from the parent to process their child's information? It's probably via a telephone call or an email. Now in 2025, there's many different ways you can give consent. It can be through a mobile device, it can be through text messaging, it can be through an app. There's other ways to get consent. So the FTC is trying to stay on top of the changes in technology and do two things. Number one, continue to protect children. As the types of online Services expand and vary. And number two, stay on top of how you get informed consent from the parent or guardian in light of new technology as well.
Alan Chappelle
So COPPA rules had always had a rather squishy term, the term child directed site or app. And so how did that work conceptually? Because how. How does the FTC decide that XYZ.com is child directed and abc.com is not child directed?
Gary Kybel
Yeah, that. That one's always a very hard one because, you know, certainly, you know, children may be interested in, you know, accessing many different types of services that adults are accessing. You know, we are sitting here on a particular day after the Knicks had a huge win last night. Obviously adults are interested in that, but children are interested in that as well. And I'm sure young children would want to go online to ESPN or other sports websites and read about the game. So in terms of what is directed to children, I mean, usually regulators are thinking not about things that are general audience sites that can appeal to everybody. It's things that are uniquely directed to children or that you should reasonably expect would have the primary audience being children. I always give it the typical example of comparing, say, a car rental website which is obviously not directed towards children, and a website which has a fluffy purple dinosaur dancing around and singing songs. That one's probably directed to children. So there are the obvious examples, but the really hard thing is the gray area, what is directed towards children. And you need to analyze the content, the expected audience, maybe if you know about the actual audience and not try to play games, you know, that, you know, really who are you trying to reach? You know, if your website is about some cute, fluffy toy, is it that you're trying to reach the parents to encourage them to buy that toy? Or are you trying to really reach the children to play and interact with the toy online and then go harass their parents nonstop in December to buy it for them. So it's really tough in the middle. It's very subjective and you can always argue what does it mean to be directed towards children. And last thing I'll say is that in some other industries there is a standard, like in the alcoholic beverage industry, there is a percentage, a specific percentage of the expected audience that's under age 21 or over age 21 that can be used to determine if a website is appropriate for those who are of drinking age. We don't have that for children.
Alan Chappelle
I remember, and this is now 10 years ago, so it's clearly outdated, but I remember there was almost outrage within the mobile app marketing world because Angry Birds was deemed by the FTC as a child directed app. And I am positive that, that there was never a time where fewer than 70% of the users of Angry Birds were over 15.
Gary Kybel
Exactly. Yeah. It's sort of like, you know, SpongeBob SquarePants. Is that targeted towards children or that targeted towards, you know, college students are getting high in their dorms, you know, it depends, you know, who it is. So I always like to look at it from reverse. I like to look from the business's perspective. What are you trying to do? Are you really trying to reach children and just being cute about it, or do you just have a product or service that appeals to people of many different ages and you don't care if somebody is, you know, 11 years old or 81 years old? So it's kind of look, look at those factors.
Alan Chappelle
So we're going to turn now to some of the state laws. And what's really interesting about the state laws is that many of them set the bar at not at 13 like Coppa, but they said it was 15, 16. I think some of them are now up to anybody under 18 is a child and that collecting data from them would be considered sensitive. And so nobody's tried to come up with a child directed site in that context. But not having, you know, even that admittedly subjective standard is creating all kinds of havoc for people who are just trying to honor these new state laws.
Gary Kybel
This is a tremendous burden for anyone that might be trying to reach teens because it would seem to be very simple to say, you know, who was a child. Well, we have 50 different states, they're enacting different laws and they're coming up with different ages over who's a child. Under Coppa, it was always someone under 13. But as you said, Alan, you know, there are states where it's 13 to 15. There are some states where it's 16, there's some where it's all the way up to 17. Basically anybody under 18. So the challenge for businesses these days is deciding do I want to go with the strictest standard or do I want to go in a state by state approach? And I think we are trending towards having to treat anybody under 18 as a child. Look, on the federal level, again, it's still under 13. If they enact new laws in Congress, it's probably going to be under 16. But as you said, there are states out there that treat under 18 as a child and will have enhanced recovery requirements for processing their data.
Alan Chappelle
I think I'm agreeing with You, I think it's just too difficult on a state by state basis to ascertain different ages. I think there might be some isolated instances. Maybe you stay out of the state of Washington for certain health data. I know that's an unrelated topic, but that I could get my head around. But the hodgepodge estates, which each have a different age requirement, and our collective inability to necessarily know from an ad standpoint where somebody is located with anything resembling reliability, I think pushes everybody towards a one size fits all approach.
Gary Kybel
Absolutely. Because just think, if you've got a letter from a state regulator, and I'm working with a lot of clients who have gotten letters from various state regulators these days, picking apart their privacy practices based on their new state privacy laws. And just imagine a regulator saying, okay, in my state you need to get consent from anybody under 18. And I know in other states it's under 16 or under 13. Explain to me how you are treating users in my state differently. What controls do you have in place to ensure that you treat teenagers in my state differently? And it would be hard to answer that question for most businesses. So I think going with a national approach is what most businesses have to do.
Alan Chappelle
I would agree. So as we shift away from COPPA into the state laws, I want to not necessarily just focus on the state law privacy laws, but there's kind of a much broader set of issues that the states are trying to address. I mean, they're, you know, we'll start with the, the California age appropriate design code and some of the similar state laws. I mean, what are those laws trying to accomplish and what are some of the pros and cons of just trying to comply with those types of laws?
Gary Kybel
Yeah. So the age appropriate design codes, this is now proliferating across a number of states. It started with California, but there was an injunction that was held up by the courts. But the Maryland age appropriate design code is currently in effect and most recently Nebraska and Vermont are on the precipice of passing age appropriate design codes. And what these are is they usually apply to anyone under 18 and requires businesses to act in the best interest of the children for services that are reasonably likely to be accessed by children. Now, we got a whole bunch of lawyer weasel words in there. You know, reasonably likely and best interest. These are really subjective, but that's the standard. And if a service is reasonably likely to be accessed by children, then you need to configure under these age appropriate design codes all privacy settings by default to the highest level of privacy. So let's Think about that. You have a website, it's got a consent management platform. By default, we're saying, need to turn everything off. That's the highest level of privacy under your service. So the age appropriate design codes are really going to make it hard to do anything like behavioral targeting or profiling to anyone who falls within the age buckets that they're trying to address. And these are standalone laws. Sometimes they have a private right of action, sometimes they don't. Again, regulators love to protect children. So I think if an enforcer wanted to enforce some of their new privacy laws and they had an age appropriate design code, that would be probably their favorite to enforce because they're protecting children, what could be better for a politician?
Alan Chappelle
So it's funny, I feel like a broken record on this podcast, but I don't think it can be said enough. I mean, call Jody Daniels. Find somebody who can implement your CMP in a way that makes sense. Because it's funny, you're talking about like, you know, black belt level CMP implementations and yet we're still, as an industry are struggling with like, you know, just basic consent things under SIPA in California. So this stuff is just going to get more complicated, folks, and you need to have somebody who really understands it. You can't just punt it, you know, to Joey in your marketing department, who happens to be the intern in there for the summer, because Joey may or may not have the expertise.
Gary Kybel
Yeah, and look, the CMP providers, I work with many of them and many of them are very good and very sophisticated, but they are not taking over your compliance with law's obligation. And if you look at your contract with your CMP provider, it absolutely says they are not responsible for compliance with laws because they're basically giving you a tool and you can configure that tool any way you want. So if you want to turn everything on, you can turn everything on. You want to turn everything off, you can do it as well. You want to give 3, 3 options to people or 10 options to people. The CMP will let you bake the cake any way you want, but you're going to be responsible for what's ultimately presented.
Alan Chappelle
True that, Gary. So I want to turn our attention to a slightly different set of rules. There's, there's some states that have even tried banning social media and I wonder if you can give us an overview of that and like, how that's really played out.
Gary Kybel
Yeah. So, I mean, New York is a perfect example of this. As a former New Yorker, but now Floridian you know, in New York, they passed the Safe for Kids act, which SAFE stands for Stop Addictive Feeds Exploitation. And the view is, and if you have a teenager anywhere, you will completely agree with this that social media is addictive. And they get into the feed and they're scrolling and the algorithms are designed to keep sucking them in so they don't put down the device. So these laws are. In New York is a good example where you are prohibited from having an addictive feed and an algorithm that's intentionally designed to suck in those in New York under 18. Now, how do the social media providers deal with that? And they. And will they admit that they actually have algorithms that are intentionally created to create addiction amongst teenagers? And are they going to change it for teenagers and then try to keep sucking in and get the adults addicted? We'll have to see. But states are starting to pass that. That's come up in New York, that's come up in Arkansas, it's coming in other states as well, where they realize that there is a real addiction problem to social media and they're going to legislate around it.
Alan Chappelle
Well, you must feel fantastic to have moved away from the political insanity that is New York State towards the relative certainty that is Florida. So well done, Gary.
Gary Kybel
Well, yeah, in Florida, anything goes. So it's the wild, wild west down here.
Alan Chappelle
I just saw an alligator walk by outside your window, so that's just fantastic.
Gary Kybel
As long as it doesn't attack my golf cart, then I'll be happy.
Alan Chappelle
So next I want to talk about the Kids Online Safety act, cosa. What are the underlying issues that COSA is trying to solve and what are some of the background stories and issues that triggered the need for lawmakers to enact kosher COSA and similar laws?
Gary Kybel
Right. So COSA is sort of, you know, bumping up the requirements under Coppa and Coppa 2.0 in Congress, which is being considered as well. And there's sort of a recognition that, you know, we said at the beginning of this discussion, Coppa is from 1998, and it was a very different world back then. And we've recognized two things. Number one, technology has radically changed, and treating a child as someone just under 13 might not be the right age. We really should bump it up. So Congress has been talking about bumping it up to under 16 and also adding additional controls in there, such as changing the standard about knowledge for when you know that you're dealing with a child. Because under copper right now, it's got to be that you have actual knowledge that somebody's under the age of 13. There's been a debate about whether you should have, you know, more constructive knowledge and you should do more diligence to understand who your audience is, as opposed to just actual knowledge and putting your hands over your eyes to pretend you don't know someone's under a particular age. And I'm actually quite surprised that it hasn't gotten out of Congress. It's been kicked around in a couple of Congresses right now. And as I said at the beginning of our conversation, protecting children is a bipartisan issue. So I'm shocked that hasn't happened yet. If you ask me to put Money on COPPA 2.0 or CASA coming out of Congress this year, I would say greater than 50% chance, but I say that every year. It still hasn't happened.
Alan Chappelle
But with COSA isn't one of the challenges that you have. You obviously have the business community jumping up and down saying, we can't do this. We can't do this. Now, that happens with most laws. So I don't know that in itself is that big a deal. But you also have the advocacy community who's saying, well, wait a minute, COSA is going to create all kinds of issues for protected classes of people. And so when you have the advocates and the business community, they're not making the exact same argument, but when they're vehemently objecting to a law, I think that's one of the things that's holding it back. But has that changed? And what do you make of the respective positions of the business community and of the advocates?
Gary Kybel
I mean, that debate happens in a lot of different privacy areas, because every time we put in place new controls, we're taking something off the table that might be positive. You know, with all the new state laws out there right now regulating sensitive personal information, they treat racial and ethnic information as sensitive. And yes, there may be uses of that that are inappropriate because it's sensitive, but there could be positive uses. You want to give someone a targeted ad for Hispanic Heritage Month or Black History Month or some other beneficial reason for promoting things. So the business community strongly has a concern about closing off permanently certain avenues and certain potential customers. Look, teenagers have debit cards. They have Apple Pay on their phone. They buy things. They are consumers. And so, as with any consumers, you want to target them with appropriate ads and convince them to buy your services. And if you're not able to do that at all to people who actually have the ability to purchase and have buying power, then businesses can lose out. So there are always, you know, pluses and minuses with any of these proposed new legislations.
Alan Chappelle
If you were to make a prediction as between COSA, COPPA 2.0 and a omnibus federal privacy law, which one is the most likely to be passed in 2025?
Gary Kybel
So maybe I'll rephrase that. Let's call it COSA, COPPA 2.0 and flying unicorns. So I don't think a comprehensive consumer privacy law that takes care of everything is going to pass this year. I would love to be proven wrong, but I don't see that happening with COSA dealing with social media. I think there's a good possibility. I think COPPA 2.0 is easy. I don't know why it hasn't happened. Let's raise the age to under 16 instead of under 13. Let's modernize the law a little bit in terms of how you get parental consent and what sort of medium it applies to. Let's update a little bit more about how you get knowledge that someone is under the prohibited age and pass that. So I would put copper 2.0 at the top of the list, but that's up to Congress to get their act together and actually do it.
Alan Chappelle
You didn't run down to Florida to run for Congress, did you?
Gary Kybel
No, no, no, no. I don't want to take that big of a pay cut.
Alan Chappelle
Fair enough. So we're turning back to the ad space. I mean, what do you think are going to be some of the next iterations of children's privacy rules coming down the pike? Do you really think It's Is a CAPA 2.0? Is that the limits of child related privacy laws? Or do you think there's something else that might come down the pike in the next couple of years?
Gary Kybel
I think it's going to be a combination of these things with changing ages, changing standards of what you have to do to understand your audience dealing specifically with social media. And I think then we'll have more states that do this in an inconsistent manner. So I think those are kind of the key issues. I hope Congress steps in and makes a standard and that the standard preempts all the states. But, you know, who knows if that's going to happen. But I think we'll just see more states because as we sit here now, and as most people know, we have 19 states with comprehensive consumer privacy laws, 13 are currently in effect. Then we have a few of the standalone privacy laws for children that I mentioned, like in New York, in Arkansas and elsewhere, but we have 50 states in the United States. So I think it's going to increase on the state level amongst those different issues.
Alan Chappelle
You know, one of my predictions, and I've been wrong forever here, but, but I'm going to eventually be right. Okay, you got 19 states right now. So that means that you have 19 attorney generals or other regulators within that state that really wants to make their mark. It is going to become really, really confusing and really, really difficult when you're being picked at from 19 different. 19 different states on each one who decides to make, you know, two or three things their pet issue. We've been very fortunate up to this point because there is a fair amount of symmetry across all of the state laws. But as that starts to change and as each state seems to go back to the bar for new laws every year or new additional rule sets every year, query whether that's just going to become such a big problem for the business community that we will have something akin to, you know, what happened around can spam 20 years ago where there was just such a wave of pushback from the business community that they ended up implementing can spam so as to preempt the state email law.
Gary Kybel
Yeah. Oh, boy. You're taking me back to the good old days, can spam, when, you know, Congress actually did something and realized you cannot have individual states regulating the way that email marketing works. That has to be done on the federal level because the Internet knows no boundaries. If they would only take that lesson now. But I agree that all these different state ag regulators, they are all elected politicians and they want to look good. And protecting children makes them look good. And if you ask a state regulator about how to deal with the conflict amongst different state laws, they're probably all going to give you the exact same answer. My job is to protect the consumers of my state. And so they're not concerned about the disconnects. They're just going to look at their law and protecting their consumers, regardless of the fact that, you know, 10 miles down the road, it's a completely different standard.
Alan Chappelle
So I'm going to go a little off script. This is going to be out in less than a week. What's your take on the budget reconciliation bill that was making its way past the House? And that would probably, well, certainly preempt all state regulation on AI. But my sense is that once you start going down the road of AI, you probably cut a fair amount of the privacy, rulemaking and rules off at the legs as well. Any chance of that going through?
Gary Kybel
Yeah. And I mean, I think that it is interesting because it can bleed over into privacy, because, you know, what is AI? We're having this debate right now in California as they're looking at the rules about automatic decision making technology. Is that AI, is that a privacy issue? There's really, you know, a bleeding of the two issues together. But to go to your key point, you know, is that going to pass? I think it may not. Because I think we've heard from a number of senators on the left and the right that they're not happy about this 10 year moratorium. They, you know, some, like, you know, Senator Marshall Blackburn in Tennessee is concerned about protecting their AI law, which can protect against deep fakes and, you know, impersonating Elvis and other celebrities like that. You have some on the left that don't want to, you know, want to control about, you know, consequential decision making from AI technologies. So I think there's enough disagreement in the Senate that this outright moratorium may not happen. Maybe there'll be something watered down, but it won't be what came out of the House recently.
Alan Chappelle
Yeah, I, I would tend to agree with you. And I would also agree, I don't think this is the last time we're going to dance this dance and that, that 2.0 or 3.0 may actually have a better chance of getting through. I think this one was probably done a little haphazardly. If, if you try to push something through that that is maybe a little bit more tailored. Maybe it's a five year moratorium. But, but I think one of the things, I mean, leaving aside that there are very powerful people in this country who want no regulation whatsoever around AI, let alone copyright and privacy and Section 230 or whatever, they don't want anybody impeding that progress. But, but I also think that the GOP as a whole would say that the biggest thing keeping them from being able to put through a privacy law is state preemption as an issue. And I know that's not entirely a blue state issue. I mean, there's certainly plenty of red states who have privacy laws. But if you wanted to get preemption off the table to put out a comprehensive privacy law, one way to do it would be to, to chop off at the knees a lot of the state level authority.
Gary Kybel
Yeah. And I mean, from my perspective, preemption absolutely is, you know, the number one most important requirement for any of these laws, because it's very complex with 50 different standards. It's more complex with 51 standards. So if you don't have preemption. You're not helping the situation. You're making it worse. So we'll see what happens. But going back to the. The AI Conversation, I don't see it passing, but I could see them, now that they're having the conversation, coming back and doing a more focused law on AI. Maybe it's about deep fakes, and maybe it's about politics, or maybe it's about protecting children or transparency. But I could see them coming back and doing something on AI but on a much narrower scale.
Alan Chappelle
Yeah, I would tend to agree. So this has been a great discussion. I got one more question for you. I don't ask this of every guest, but a lot of guests, and certainly the more interesting guests, which you obviously fit into that category. Gary, I've known you a long time. What are some of your personal hobbies like? What's the thing that everybody. That maybe not everybody here knows about Gary, that you do in additional golfing, I suppose.
Gary Kybel
Well, you know, I was going to say that. So, you know, being down here in God's waiting room, you know, I certainly play golf, you know, haven't gotten into pickleball very much, although that. That is the craze down here. But I'll give you. I don't know if I should share this with everybody, but here goes. So everyone has unique, weird skills. And one of my unique, weird skills is that I know how to play the accordion. And I took accordion lessons when I was, you know, very young and a teenager because I guess I wasn't on the Internet because it didn't exist back then. And I still have an accordion in my closet, and I break it out every couple of years and annoy the family with it.
Alan Chappelle
Well, that's fantastic. And I have to imagine that that accordion playing was that just. And the trumpet, if I remember correctly.
Gary Kybel
Yes.
Alan Chappelle
Two things that attract women.
Gary Kybel
Well, when I realized that I was never going to get a date my entire life, I ditched the accordion and started to play the trumpet. And I didn't break out the accordion until after I married my wife. And then she saw the accordion. She's like, oh, my God, it's too late.
Alan Chappelle
What did I get myself into? Gary, this was a great conversation. I really appreciate you sharing your thoughts with my audience here. Have a good one, man.
Gary Kybel
All right, thanks very much, Alan.
Alan Chappelle
That was a great conversation. Children's issues in the ad space can be pretty challenging. I think it's safe to say that most advertisers and publishers are not attempting to directly target or create profiles of children. But also and speaking as a parent, I don't think there's a way around the fact that too much screen time and too much social media time can be harmful and addictive for kids. One of the areas I wish Gary and I had gone into some more detail are the potential First Amendment implications at play with the Kids Online Safety Act. Once you start allowing the government to censor one type of speech, you certainly open the door to government censoring other types of speech. And that was what was driving some of the pushback from the ACLU and some other advocacy groups when it comes to CASA and some of the other regulations being talked about right now in Washington. I'm sure we'll come back to the potential issues around censorship in future podcasts Meanwhile, we've got a bunch of other fantastic guests coming up on the Monopoly Report podcast over the next few weeks. Please subscribe to the show@monopolyreportpod.com or on Spotify, Apple, YouTube, or wherever you listen to your podcasts. Thanks for listening.
Marquitecture
Thank you for listening to the marketecture podcast. New episodes come out every Friday and an insightful vendor interview is published each Monday. You can subscribe to our library of hundreds of executive interviews at marketecture tv. You can also sign up for free for our weekly newsletter with my original strategic insights on the week's news at News Market tv. And if you're feeling social, we operate a vibrant Slack community that you can apply to join@adtechgod.com.
Episode 32: Kids Privacy in the Ad Space with Gary Kybel
Release Date: June 4, 2025
Overview
In Episode 32 of The Monopoly Report, host Alan Chappelle engages in a comprehensive discussion with Gary Kybel, a seasoned partner at Davis and Gilbert law firm. The episode delves into the intricate landscape of children's online privacy, examining legislative frameworks like COPPA and emerging state-level initiatives. Gary's extensive experience in the ad tech space provides listeners with deep insights into the evolving challenges and regulatory responses aimed at protecting minors in the digital advertising ecosystem.
Initial Framework: COPPA
Gary Kybel reflects on the inception of the Children's Online Privacy Protection Act (COPPA) in 1998, highlighting its bipartisan support aimed at safeguarding children’s data in the nascent online environment.
"Back in 1998, it was an easy idea to get people to coalesce around. Today, it's an easy issue when we talk about privacy issues. Children are not able to make proper decisions about how their information is used." [04:53]
Alan Chappelle concurs, noting the shift from COPPA's original focus on basic data collection (like email addresses) to more complex concerns about profiling and targeted advertising.
Transition to COPPA 2.0
The conversation shifts to the anticipated updates under COPPA 2.0, which aim to address modern technological advancements.
"The FTC is trying to stay on top of the changes in technology to continue protecting children and adapt consent mechanisms in light of new technologies." [09:02]
Gary explains the enhancements in COPPA 2.0, emphasizing stricter standards for behavioral advertising and more diverse methods for obtaining parental consent, such as mobile apps and text messaging.
"COPPA is being updated to reflect behavioral advertising and modern consent methods, ensuring protection remains robust in today's digital landscape." [09:02]
Ambiguities in "Child-Directed" Classification
Alan raises the issue of COPPA's vague criteria for determining what constitutes a child-directed site or app.
"How does the FTC decide that XYZ.com is child directed and ABC.com is not?" [10:15]
Gary discusses the subjective nature of these determinations, using examples like general sports websites versus sites with content explicitly targeting children (e.g., a site with animated dinosaurs).
"It's very subjective, and you can always argue what it means to be directed towards children." [12:31]
The difficulty in creating objective standards comparable to other industries, such as alcoholic beverages, is highlighted, underscoring the complexities businesses face in compliance.
Fragmented Regulatory Landscape
Alan points out the inconsistency across states, with some defining the age of a child as under 15, others under 16, and some under 18.
"The hodgepodge of states, each with a different age requirement, is creating havoc for businesses trying to comply." [14:01]
Gary elaborates on the logistical nightmares businesses encounter when navigating 50 different state laws, often leading to a preference for a national compliance strategy.
"Most businesses have to adopt a national approach because managing 50 different standards is impractical." [15:30]
Age Appropriate Design Codes
Discussion turns to specific state initiatives like California's Age Appropriate Design Code and similar laws in Maryland, Nebraska, and Vermont.
"These codes require businesses to set privacy settings to the highest level by default for services likely accessed by children." [16:34]
Gary underscores the subjective language in these laws, such as "reasonably likely" and "best interest," which complicates compliance and enforcement.
"The standards are very subjective, making it challenging to implement consistent privacy protections." [16:34]
Addressing Social Media Addiction
Gary introduces New York's Safe for Kids Act (SAFE), which targets the addictive nature of social media algorithms designed to engage teenagers.
"In New York, you're prohibited from having an addictive feed designed to keep under-18 users engaged." [19:41]
Alan humorously contrasts New York's regulatory environment with Florida's laissez-faire stance, highlighting regional disparities in legislative approaches.
"In Florida, it's the wild, wild west." [21:08]
Goals and Legislative Challenges
Alan introduces the Kids Online Safety Act (COSA) and asks Gary to explain its objectives and the issues prompting its creation.
Gary outlines COSA’s intent to build upon COPPA by raising the age threshold to under 16 and enhancing consent requirements.
"COSA is bumping up the requirements under COPPA, recognizing that treating a child as someone just under 13 might not be adequate." [21:31]
He expresses surprise at the legislative delays despite the bipartisan support for protecting children online.
"Protecting children is a bipartisan issue, so I'm shocked that it hasn't passed yet." [22:56]
Business vs. Advocacy Perspectives
Gary discusses the tension between the business community's desire for flexibility and the advocacy groups' push for stringent protections.
"The business community is concerned about closing certain avenues for targeting teens, while advocates focus on comprehensive protection." [23:37]
Alan echoes these sentiments, predicting that inconsistent state laws may eventually prompt comprehensive federal legislation, similar to the CAN-SPAM Act's preemption of state email laws.
"The confusion from multiple state laws may drive the business community to seek federal preemption." [27:57]
Anticipated Legislative Developments
Gary predicts that COPPA 2.0 is likely to pass before comprehensive laws like COSA or an omnibus federal privacy law.
"I would put COPPA 2.0 at the top of the list for passage, though it’s up to Congress to take action." [24:54]
He anticipates further state-level regulations focusing on varying age definitions and specific issues like social media addiction.
"We'll see more states enact laws with different standards, complicating compliance for businesses." [26:07]
Call for Federal Standardization
Gary emphasizes the necessity for federal legislation to streamline protections and preempt the patchwork of state laws.
"A federal standard would prevent the complexity arising from 50 different state regulations." [28:45]
Intersection of AI and Privacy Laws
Alan briefly touches on the potential overlap between AI regulation and privacy laws, questioning the likelihood of passing stringent AI-related legislation.
"The budget reconciliation bill aims to preempt state regulation on AI, but disagreement in the Senate may prevent its passage." [28:45]
Gary voices skepticism about the immediate success of broad AI regulations, suggesting that more focused, narrower laws might emerge instead.
"I don't see the outright moratorium passing, but more targeted legislation on specific AI issues could be forthcoming." [29:15]
Gary Kybel’s Hobbies
In a lighthearted exchange, Gary reveals his unique skill in playing the accordion, a hobby from his youth that occasionally resurfaces to amuse his family.
"I know how to play the accordion. I take it out every couple of years and annoy the family with it." [32:24]
Alan adds that Gary also plays the trumpet, humorously noting these as traits attractive to women.
"Two things that attract women." [33:08]
Conclusion
Alan and Gary wrap up the episode by acknowledging the complexities and ongoing challenges in safeguarding children's privacy within the ad tech ecosystem. They touch upon the broader implications of government regulation on free speech and hint at future discussions on First Amendment concerns related to the Kids Online Safety Act. The episode underscores the critical need for balanced, coherent legislation that protects young users without stifling innovation or imposing untenable compliance burdens on businesses.
Notable Quotes
“Privacy about data was an important issue that evolved over the early 2000s and now absolutely dominates every conversation in the digital media ecosystem.” — Gary Kybel [02:10]
“COPPA is always an easy one for the FTC and then a popular one for the FTC.” — Gary Kybel [07:19]
“The business community strongly has a concern about closing off permanently certain avenues and certain potential customers.” — Gary Kybel [24:41]
“A federal standard would prevent the complexity arising from 50 different state regulations.” — Gary Kybel [28:45]
Subscribe and Stay Informed
For more in-depth analyses and discussions on antitrust and regulatory impacts on the global advertising economy, subscribe to The Monopoly Report on Spotify, Apple Podcasts, or your preferred podcast platform. Stay updated by subscribing to the weekly newsletter at monopoly-report.com.