Evan Schuman's StorefrontBacktalk

As federal authorities are preparing in 2013 to significantly update the the Children’s Online Privacy Protection Act (COPPA), one likely area will involve taking jurisdiction over all mobile interactions, including those in-store. This will finally address what had been a retail marketing loophole, where tracking nine-year-olds online is prohibited but the identical conduct in a store’s aisles is permitted.

This puts retailers in an awkward position. As malls and stores track mobile device activity, retailers will likely have no idea the age of the shoppers associated with phones and tablets unless they ask—which is exactly what COPPA is intended to prevent.

The prospect of such an in-store child CRM program was raised last month at a financial analyst meeting by the CEO of JCPenney, whose people quickly backpedaled from the idea. Although mobile restrictions would certainly not close this loophole, much of the youth CRM and related marketing efforts do involve quite a bit of mobile.

This came up as the U.S. Federal Trade Commission (FTC) released a report on Monday (Dec. 10) that found many child-focused applications that said they had no ads, interactive features and pledged to not share the child’s information with third-parties without parental consent, you guessed it, often did all three.

“Many of the apps shared certain information—such as device ID, geolocation, or phone number—with third parties without disclosing that fact to parents,” the report said.

One of the problems that laws have had with technology restrictions is that lawmakers—and sometimes even regulators—are often behind the curve. How would it be classified, for example, when a mobile phone is not using the Internet? Perhaps it’s communicating solely through a retailer’s Wi-Fi, restricted to that store’s LAN. Would that change matters?

Let’s take it one step further. What if the phone is in airplane mode and has Wi-Fi disconnected? And what if the phone is being used as a beacon, as a customer identifier, in some other way? Perhaps an app is listening for an audio signal sent from store music speakers, as Macy’s has done. Or what if the app uses store-and-forward to capture information without connecting to any wireless source, as ShopKick has done?

One of the impressive things about federal consumer protections—especially for children—is that enforcement is rarely based directly on what was done, but a side issue. A site that steals shoppers’ money wouldn’t be charged with theft, but instead with deceptive trade practices because the site’s operators didn’t inform shoppers that they were thieves.