BEFORE THE Children’s Online Privacy Protection Rule FTC File No. P994504 COMMENTS OF THE PROMOTION MARKETING ASSOCIATION, INC.
June 11, 1999 The Promotion Marketing Association, Inc. ("PMA"), through its attorneys, hereby submits these comments in response to the Federal Trade Commission’s Notice of Proposed Rulemaking ("NPRM") addressing the Commission’s implementation of a Children’s Online Privacy Protection Rule (the "proposed Rule") as required by the Children’s Online Privacy Protection Act of 1998 ("COPPA"). See 64 Fed. Reg. 22750 (released April 27, 1999).
The PMA has been the leading non-profit association representing the promotion marketing industry since 1911. The PMA has over 700 members representing diverse aspects of the industry, including Fortune 500 consumer goods and services companies, advertising and promotion agencies, and university faculty who educate about promotional activities as part of a business curriculum. The PMA's mission is to encourage the highest standards of excellence in promotion marketing. The objectives of the PMA are to educate its members on the laws that govern promotions and to act as a resource to state legislatures, state attorneys general, and federal regulatory agencies in drafting appropriate and focused legislation and rules to combat deceptive marketing and promotion practices. The Internet provides consumers and marketers with enormous opportunities to develop mutually beneficial relationships. The PMA notes that recent research conducted at Georgetown University indicates that industry has made significant progress on the online privacy issue since the Commission’s first online privacy report was issued last year. Given the industry’s positive response to concerns over children’s privacy and the significant progress the industry has made, on its own initiative, the PMA urges the Commission to avoid overly restrictive regulations which may impede the growth of the Internet as a viable commercial medium. The PMA recognizes that children’s online activities, like children’s offline activities, raise special concerns. These special concerns, both online and offline, revolve around the issue of responsible adult behavior towards children. The PMA urges the Commission to issue children’s privacy regulations that are consistent with the COPPA mandate and that encourage, rather than impede, the development of legitimate new media marketing opportunities. The PMA looks forward to offering the Commission its unique industry perspective in connection with this rulemaking proceeding.
The PMA recognizes that children present special issues in the online environment, and it supports the Commission’s effort to issue online children’s privacy regulations as required by COPPA. The PMA urges the Commission to issue regulations that address COPPA concerns while recognizing the unique aspects of online marketing and advertising. A brief summary of the major components of the PMA’s comments is provided below. First, the PMA is concerned about a number of the definitions contained in the Commission’s proposed Rule. The PMA asks that the Commission clarify whether the proposed definition of the "collection" of information would include operators who merely provide chat room, message board, and other services without collecting information from those services. In addition, the proposed definition of "disclosure" does not currently exempt a marketer who merely includes a child’s name on a "winner’s list" pursuant to state law requirements. Also, the proposed definitional distinction between an operator and a third party may create administrative burdens for the industry and is contrary to existing regulatory precedent. The PMA is seriously concerned that the proposed definition of a child-directed site and the definition of the "actual knowledge" standard for general interest sites may impose significant burdens upon the legitimate marketers who will take steps to comply with the Rule, while rewarding others who do not take such steps with a lower regulatory burden. The proposed Rule’s regulatory approach may therefore create incentives for marketers that are contrary to the Commission’s goals. Second, the notice placement and notice content provisions of the proposed Rule also raise issues for PMA members. The PMA urges the Commission to adopt regulatory standards in this area that require marketers to provide appropriate information collection notices to parents without imposing unnecessarily restrictive or impractical limitations upon the manner in which such notices can be provided or upon the content of the notice. As long as parents are provided sufficient and accurate information to make an informed consent decision, the PMA does not believe that stringent regulatory requirements are warranted. Third, the PMA supports the Commission’s inclusion of limited-purpose online contests as an acceptable exemption from the prior verifiable parental consent requirement. Fourth, on the issue of parental consent, the PMA urges the Commission to adopt flexible regulatory standards regarding the mechanisms by which verifiable parental consent can be obtained. In the absence of evidence indicating that children will be more likely to falsify online parental consent than offline parental consent, the PMA requests that the Commission allow for verifiable parental consent to be obtained through online mechanisms such as regular email, with or without digital signatures, whenever possible. On this issue, the PMA believes that the development of evidence regarding the children’s falsification of online consent, as opposed to the falsification of offline consent, would be useful. The PMA would also support the inclusion of more flexible, less onerous, parental consent mechanisms when the information collected will not be disclosed to third parties or be made publicly available. Fifth, the PMA requests that Commission regulations implement the "reasonably necessary information" standard connected to the gathering of information in online promotions in a manner that takes into account the long history of the use of promotions as a data-gathering device. Sweepstakes, prizes, premiums, gifts, and other incentives have long been used by industry as a mechanism to gather information about interested customers. As long as appropriate parental notice and information security measures are followed when such efforts are directed to children online, such promotions should not be automatically condemned via regulation.
Section 312.2 of the proposed Rule defines the collection of personal information, in part, as the direct or passive gathering of any personal information from a child by any means, including the use of a chat room, message board, or other public posting of such information. The PMA requests that Commission clarify whether the mere provision of chat room, message board or other such services alone is sufficient to constitute "collection" for purposes of the Rule. The PMA suggests that the definition of "collects or collection" should include the collection of information through the harvesting of data provided on such services, but should not include the mere provision of such services.
In Section 312.2 of the proposed Rule, the Commission defines disclosure as releasing personal information collected from a child in identifiable form or making publicly available personal information collected from a child online. The PMA requests that the Commission exempt the inclusion of a child’s name on a contest or sweepstakes "winner’s list" from the definition of disclosure under the final Rule. These "winner’s lists" are often required by state laws governing contests and promotions. If no exemption is included, many legitimate marketers may face a conflict between state law and federal law. C. Operator/Third Party Definitions In Section 312.2, the NPRM states that "(i)n determining whether an entity is an ‘operator’ or ‘third party,’ the entity’s corporate relationship to another operator, such as whether it is an affiliate, is not a determinative factor. Rather, as described above, its status is determined by how the data is obtained and used." Many large corporations operate under one well-recognized corporate name, but have many different divisions, operating units, or subsidiaries associated with that name. For such companies, the obligation to treat internal operating units or corporate affiliates as third parties for purposes of the Rule may be onerous. As currently written, the FTC’s proposed Rule would require website operators to do more than required by consumer expectations. The PMA believes that the distinction between an operator and a third party for purposes of the Rule should be based upon a consumer perception standard. If consumers reasonably expect that several affiliated corporate entities are part of one organization that shares information within itself, then the entities should be considered one "operator" for purposes of the Rule. Regulatory precedent exists for such an approach. The Federal Communications Commission uses a similar consumer perception standard in its telemarketing regulations. The FCC’s telemarketing rule requires that corporate affiliates maintain one corporate do-not-call list when consumers reasonably would perceive the affiliated entities to be included. 47 C.F.R. 64.1200(e)(2)(v).
In Section 312.2, the proposed Rule defines the term "Website or online service directed to children" as "a commercial website or online service, or a portion thereof, that is targeted to children." The proposed Rule also lists a number of factors that the Commission will consider in determining whether a website or online service is directed to children, including its subject matter, visual or audio content, age of models, language, and other factors, such as evidence of audience composition. In order to comply with the Commission’s proposed Rule, legitimate marketers will take affirmative steps to determine the age of their online visitors. Others may not take such steps. The PMA is concerned that legitimate marketers who attempt to comply with the Commission’s Rule may find themselves faced with a higher regulatory burden than others who do not take any affirmative steps to comply. This regulatory approach would appear to reward those marketers who take the head-in-the-sand approach to children’s online marketing issues. The PMA is also concerned that the proposed Rule imposes fairly strict regulatory requirements upon sites directed to children, but the proposed Rule does not provide significant guidance regarding the types of sites that will be considered to fall into the regulated category. Many websites and online services that are directed to older, more sophisticated, teenagers and young adults may unintentionally attract children under 13. Given this situation, the PMA requests that the Commission provide marketers with concrete analytical tools to help marketers determine whether or not a site falls into the regulated category. In this regard, examples may provide marketers with useful guidance. The Commission often uses examples in its regulations, including in other portions of this proposed Rule [e.g., proposed Section 312.5(c)(3)]. Placing such examples either in the final Rule or in the Statement of Basis and Purpose for the final Rule would provide online marketers with useful assistance.
In Section 312.2, the NPRM states that "an operator of a general interest website that is not directed to children, however, will have duties under the proposed Rule only if it knows that particular visitors are under the age of 13." Moreover, in Section 312.3, the proposed Rule states, in part, that it shall be unlawful for "any operator that has actual knowledge that it is collecting information from a child in a manner that violates the regulations prescribed under this Rule." The "actual knowledge" standard appears to stem directly from the language in COPPA. As noted in the previous section of these comments, the PMA is concerned that this regulatory approach places a higher burden on the legitimate marketers who will take steps to determine the age of their site visitors, while allowing others to avoid the regulation by taking a "don’t ask" approach. The PMA is also concerned that the proposed Rule does not provide guidance on what would constitute "actual knowledge" that information was provided to a website operator by a child under 13. Consequently, the compliance obligations placed upon operators of non-child-directed general interest websites by the "actual knowledge" standard is unclear. The PMA requests that the Commission clarify the circumstances under which its "actual knowledge" standard would be met by a general interest website operator. For example, a general interest website operator may get an email message indicating that a certain online member is a child. Would the receipt of that email message automatically create the requisite level of knowledge and require the operator immediately to treat the online member as a child from that point forward? Would the operator have to conduct an investigation into the sender of the email message and/or the member? If so, what would constitute an appropriate investigation? To use another example, what would happen if a general interest site operator provides site visitors with chat areas or bulletin boards, and a message sent to one those areas appears to be from a child? Would the site operator be required to treat the sender as a child as soon as the message is received? How would the actual knowledge standard apply to corporate operators in such a situation? Further guidance from the Commission on the applicable standard is necessary to avoid creating an undue burden and impracticable situation for general interest website operators.
Section 312.4(b) of the proposed Rule lists an operator’s obligations with respect to the online placement of its children’s information practices notice. The proposed Rule requires operators to place clearly-labeled links to their children’s information practice notices (a) on their home pages, and (b) on every page where personal information is collected from children. The proposed Rule would require both notices to be placed so that a typical visitor can see the notice without having to scroll down. The PMA supports the Commission’s effort to make children’s information practice notices available for parents to review. However, the PMA is concerned that the Commission’s approach to the notice-placement issue is more stringent than necessary to meet reasonable regulatory goals. If a clearly-labeled link to the appropriate portion of an online privacy policy is placed on each page where information is sought from children and a general "privacy policy" link is also provided on the home page, the specific requirement of a home page link to a children’s information collection practices notice appears unnecessarily duplicative. The PMA believes that a marketer should at least be given the flexibility to place its home page children’s information practice notice link as part of its general "privacy policy" notice link, which may be at the bottom of its home page. Most marketers regularly place such "privacy policy" links at the bottom or on one side of their sites, and consumers have presumably gotten used to seeing such notices in that location. More stringent regulatory requirements regarding home page notice-placement may injure the artistic composition of many sites without providing a corresponding benefit. As long as a link to the children’s information practices policy is provided on each page where information is collected from children, parents will be notified about the relevant policies. In addition, the PMA notes that the "scroll down" issue is often controlled by factors such as the type of browser used and computer monitor size. Those factors are not controlled by an online marketer. Consequently, the PMA requests that the Commission eliminate this requirement.
Section 312.4(b)(2)(i) of the proposed Rule requires the notice to include the name, address, phone number, and email address of all operators collecting information from children through the website or online service. This requirement could impose an unduly cumbersome and impractical obligation on marketers. Data sharing arrangements between companies are made and terminated regularly, sometimes on a daily or hourly basis. The list of operators may, therefore, have to be updated so frequently that, as a practical matter, marketers will find it virtually impossible to comply. The PMA suggests that marketers be allowed to comply with this requirement by providing parents with a telephone number and/or a postal address where those parents can obtain a list of relevant operators. In this way, any parent who wants to obtain this information will be able to receive it and will know where to obtain it, but marketers will not have to expend significant resources on constantly updating the lists. Section 312.4(b)(2)(iii) of the proposed Rule requires the disclosure of the types of businesses in which relevant third parties are engaged. Under this provision, a marketer would be required to obtain information on the specific businesses in which its third party partners are engaged. As companies enter and leave businesses regularly, the information-gathering burden associated with this obligation could be significant. Moreover, data sharing arrangements between companies are made and terminated regularly, sometimes on a daily basis. This disclosure requirement could, therefore, impose an onerous, if not unmanageable, administrative burden on marketers. In general, the PMA believes that parents understand that some marketers share information with third parties and that others do not. The PMA further believes that parents should be given the right and the responsibility to decide whether they will allow their children to share information with a particular marketer. As long as parents know that a particular marketer shares information with third parties, they can make an informed decision about allowing their child to provide that marketer with personal information. Providing parents with specific information regarding the third parties would place a severe administrative burden on marketers without providing a corresponding benefit to parents.
Section 312.4(b)(2)(vi) of the proposed Rule requires an operator’s notice to state that the parent has the right to review personal information provided by the child, to make changes, or to have the information deleted, and to describe how the parent can do so. In Question 8 of the NPRM, the Commission asks whether such information is needed in the notice on the website or online service or whether it should only be included in the notice provided directly to the parent under Section 312.4(c). The PMA believes that operators should have the flexibility to decide whether to include the listed disclosures only in their Section 312.4(c) notices or in their Section 312.4(c) notices as well as on their websites or online service children’s privacy notices. The listed disclosures will only be relevant to parents who are considering whether to allow their children to provide information to an operator, so requiring the placement of the disclosures in the Section 312.4(c) notice makes logical sense. For administrative ease, however, some operators may want their website or online service privacy notices to contain exactly the same information as their Section 312.4(c) notices. For those reasons, operators should only be required to include the listed disclosures in their Section 312.4(c) notices, but should be given the flexibility to include those disclosures on their website or online service children’s privacy notices if they choose.
Proposed Rule Section 312.5(c)(3) allows operators to collect online contact information from a child without prior verifiable parental consent under certain circumstances. In the commentary to proposed Rule Section 312.5(c)(3), the Commission notes that the proposed Rule would allow operators an exception to the prior verifiable consent requirement for the collection of online contact information in connection with online promotions and contests requiring later notification of the winner. The FTC’s position on this issue presents a reasonable balance between the need to notify parents and the ability of marketers to use information collected online to conduct limited and uncontroversial online promotions.
Section 312. 5 of the proposed Rule deals with parental consent. In Question 12 of the NPRM, the Commission asks whether parents should be given the option to refuse to consent to different internal uses of their child’s information. The PMA does not believe that giving parents such an option via regulation would assist in achieving the Commission’s goals in a meaningful way. The proposed Rule already requires marketers to inform parents of their information collection, use, and disclosure practices. Those marketers who believe that some internal uses of children’s information are less likely to cause parental concern than other uses will be likely to include differentiated consent options in their notices to parents in order to increase their chances of receiving parental consent in the first place. Marketers who do not wish to offer such differentiated consent options to parents should not be required to do so by regulation. Those marketers will have to face the possibility that they may not receive any parental consent at all.
The commentary to Section 132.5(b) in the proposed Rule identifies a number of methods that an operator might use to obtain verifiable parental consent. These methods include requiring a parental consent form to be filled out and sent by a parent via facsimile or postal mail, requiring a credit card number, establishing a toll-free telephone number, or use of a digital signature with an email message. Question 13 of the NPRM addresses the issue of methods of consent. The PMA is concerned that the listed verification methods are expensive and burdensome, but they still may not provide the requisite level of comfort that proper parental consent has been obtained. For example, the toll-free telephone number option and the postal mail consent forms are offline consent mechanisms that would appear to defeat the convenience and ease of use features that are presented by online media. Moreover, these offline consent mechanisms may be falsified at least as easily as online consent mechanisms. Creating these types of offline consent mechanisms will also increase the administrative cost of doing business online, and may significantly slow the development of the Internet as a commercial medium. The Commission also proposes the disclosure of a credit card number as a parental consent mechanism. However, many parents who would consent to the online collection and/or use of information regarding their children by a particular marketer may balk at releasing a credit card number that is unrelated to the information collection. Preliminary reports indicate that adults are concerned about security when they are required to disclose their credit card numbers online to make purchases. Parents are likely to be even more reluctant to disclose their credit card numbers online when no purchase transaction is involved. Another option mentioned by the Commission is the use of email with valid digital signatures. This option appears to be a promising alternative, but digital signatures are not widely used or understood by consumers today. Moreover, it is not clear when that technology, or any other verification technology, will be regularly used by online consumers. In general, the Commission’s presumption appears to be that children will accurately disclose their age online, but that children will fabricate online parental consent. In the absence of evidence, the PMA believes that such a presumption is unwarranted. Until evidence indicates otherwise, the PMA strongly believes that verifiable online parental consent can reasonably be obtained through methods such as regular email, with or without a digital signature. Such an approach would seem reasonable as long all appropriate security and notice obligations are observed. Furthermore, the PMA believes that the self-regulatory processes outlined under Section 312.10 of the proposed Rule may be able to provide some assistance on the issue of parental consent mechanisms. The entities who develop Commission-approved safe harbors will be in a unique position to take advantage of new technological developments as they occur. The PMA suggests that the Commission invite those safe harbor entities to develop new online consent mechanisms that provide speed and ease of use, and also provide assurances against falsification.
Section 312.5(b) deals with mechanisms for obtaining verifiable parental consent. In Question 14 of the NPRM, the Commission asks whether it should allow greater flexibility in verifiable parental consent mechanisms when an operator does not disclose a child’s personal information to third parties or enable the child to make such information publicly available. The PMA would strongly support including such flexibility in the Rule. As noted in PMA’s comments to the Commission at its June 1997 Privacy Workshop, marketers generally do not appear to disclose data derived from online marketing efforts to third parties. Given this factual background, the online arena appears to be an inappropriate one in which to create the first set of stringent regulatory requirements. The goal of COPPA and the proposed Rule is to reduce the risk of harm to children from the improper disclosure of a child’s information. This risk is significantly lower when the child’s information will not be released to any third parties. Consequently, greater flexibility with respect to the verifiable parental consent requirement in such situations will likely benefit children and their parents by allowing them to enter more easily into uncontroversial transactions that present little risk. For example, allowing parental consent by the use of an standard email message to a parent’s email address in such situations would seem reasonable as long all appropriate security and notice obligations are followed by the marketer. Precedent exists for such a flexible approach. For example, the federal video and cable privacy laws (18 U.S.C. § 2710 and 47 U.S.C. § 551, respectively) place restrictions upon the disclosure to third parties of information relating to a consumer’s cable or video preferences. Both of those laws, however, allow for greater use of such information for internal marketing purposes.
Section 312.5(b) deals with the question of verifiable parental consent. In Questions 15 and 16 of the NPRM, the Commission asks (a) whether there are any existing studies or sources of data on the fabrication of parental consent and (b) whether additional research on that issue would be useful. The PMA is not aware of any existing studies or data on this topic. The development of research on this topic would be crucial in determining whether the parental consent methods proposed by the Commission can work as a practical matter. As noted previously in these comments, the PMA is concerned about the imposition of a fairly heavy regulatory burden in the form of the required consent methods in the absence of practical information demonstrating that the required consent methods will be necessary to achieve the Commission’s regulatory goals.
Proposed Rule Section 312.5(c)(1) states that certain contact information can only be kept for "a reasonable time period." In Question 17 of the NPRM, the Commission asks about the meaning of a "reasonable time period" for purposes of proposed Rule Section 312.5(c)(1). The Commission further asks if an operator should be required to maintain a do-not-contact list. The PMA believes that the reasonable period of time should depend upon the method which is used to obtain parental consent. For example, consent by postal mail may take longer than an online consent mechanism. For that reason, the PMA would not support including a specific number-of-days standard in the Rule. If technology develops faster consent mechanisms, the incorporation of a longer time period in the Rule may allow information to be kept longer than it needs to be kept. On the issue of maintaining a do-not-contact list, the PMA notes that consumer contact information, especially online contact information, changes on a regular basis for many consumers. In the absence of evidence of abuse in this area, the PMA doe snot believe that such a do-not-contact list requirement is necessary to achieve the Commission’s goals.
Section 312.7 of the proposed Rule provides that an operator cannot condition a child’s participation in a promotion on the provision of more information than is "reasonably necessary" to participate in such activity. Although the PMA recognizes that this requirement stems from the language of COPPA, the PMA is extremely concerned about the implementation of this requirement in final Rule. Historically, promotional incentives, such as sweepstakes, contests, and gifts, have been widely used by marketers to gather database information. As long as the appropriate online notice and security requirements are observed, the PMA believes that online promotional incentives will continue to provide substantial economic benefits both to consumers and to marketers. The PMA welcomes the chance to work with the Commission to craft regulatory standards in this area that will allow marketers to engage in uncontroversial online promotional activities without violating COPPA regulations.
For the foregoing reasons, the PMA respectfully requests that the Commission revise its proposed Children’s Online Privacy Rule to reflect the concerns raised in these comments. Respectfully submitted, PROMOTION MARKETING ASSOCIATION, INC.
June 11, 1999 |