This post is part of our "DCoded" series, a partnership with the Center for Democracy & Technology in Washington, DC. Each installment provides a look at the most important bills, regulations, and think tankery on issues that will affect your Internet and mobile experience.

Ever wondered why most Terms of Service include a seemingly arbitrary age cut-off, banning users who are under 13? It’s because of the Children’s Online Privacy Protection Act (COPPA), which restricts the collection of personal information from kids on the Internet. Sites like Club Penguin or Radio Disney that are aimed at children under 13 are required to get verifiable parental consent before collecting personal information from children. Instead, most sites simply ban users under the age of 13—Facebook is a famous example—rather than deal with COPPA’s notice and parental consent requirements.

It’s not a perfect system, but it has worked fairly well in limiting the amount of information collected from children—while leaving the rest of the Internet alone. But now the Federal Trade Commission (FTC) is proposing changes to COPPA that could create barriers to innovation and access to information for everyone.

Don’t share your code

The FTC plans to put COPPA obligations on plugin developers if they “know or have reason to know” that their plugin has been installed on a children’s site. “Plugins” include analytics providers, advertising networks, social media plugins, embedded videos, or anyone else who provides third-party code for websites. Under the FTC's proposed change, if plugin developers receive a user’s IP address through a plugin that’s been installed on a children’s site, they could face legal liability for collecting children’s personal information.

It’s unclear how a plugin or platform like Twitter is supposed to “know or have reason to know” that someone has cut and pasted a line of their code into a children’s site. The FTC says that plugin developers “will not be free to ignore credible information brought to their attention.” But the FTC doesn’t say what counts as “credible.” Would developers have to assume every random e-mail is a credible tip that could saddle them with legal liability? Even if the FTC did provide clarity, though, it would still be extraordinarily burdensome to place legal obligations on plugin developers based on the actions of others.

If this proposed change went into effect, developers would be faced with some difficult choices. They could try to prohibit children’s sites from using their services, but if a site ignores this prohibition, the plugin developer could still be liable for collecting children’s personal information.

Otherwise, developers would have to figure out a way to obtain verified parental consent—something that could range from difficult (for plugins that display content on the site) to almost impossible (for plugins like analytics providers that have no direct user interface). Or the plugin could preemptively break its connection with what it thinks might be a children’s site. Either way, plugin developers will face significant uncertainty over whether they must comply with onerous regulatory obligations, discouraging developers’ ability to create new, innovative services.

Show us some ID

Things get worse with the FTC’s second major proposal: expanding the scope of sites deemed “directed to children” from sites aimed primarily at a very young audience to include sites and services that are “likely to attract an audience that includes a disproportionately large percentage of children under 13 as compared to the percentage of such children in the general population.”

This convoluted standard raises a number of serious issues. Not only is it difficult for site operators to gauge what proportions of their audience fall into arbitrary age buckets, but the FTC also gives operators no sense of what it means for an audience to be “disproportionately” composed of children in comparison to the general population. If a site’s audience is 20 percent children, is it disproportionately composed of children? What about at 30 percent? It’s not clear from the language, and it won’t be clear to website operators trying to run their sites while staying within the bounds of the law.

Any attempt by operators to get more information about site demographics would result in more tracking and collection of sensitive information from all users—a backward result for a law intended to protect privacy.

The FTC takes things from bad to worse with a special exception it proposes. Sites that “age screen”—that is, ask all users for their age or birthdate—before collecting personal information won’t be considered to be “directed to children.”

So a site like Wikipedia, which could be left guessing the percentages of children which visit in preparation for a school science fair or for background on a game like Minecraft (which is gaining popularity with the elementary school set), might simply opt to age screen all users instead of deal with COPPA’s burdensome requirements.

The choice between setting up an age screen or conducting costly COPPA consent procedures (or facing expensive non-compliance penalties) is not much of a choice at all. This proposal would position us at the top of a very slippery slope into an age- and identity-verified Internet—the kind of Internet that the Supreme Court has rejected as a violation of adults’ First Amendment right to access information on the Internet anonymously.

In fact, COPPA is the only protect-the-children-from-the-Internet law passed in the late ‘90s that hasn’t been challenged in court. The Communications Decency Act (1996), the Child Pornography Prevention Act (1996), and the Child Online Protection Act (1998) each went to the Supreme Court and were all struck down due to First Amendment concerns about restricting access to information online

COPPA hasn’t faced the same kind of challenge only because it has, so far, been narrowly focused and hasn’t interfered with adults’ or older minors’ access to constitutionally protected information. The FTC is proposing to radically alter that balance.

The FTC is accepting public comments on the proposed changes until Monday, September 24th.