The Center for Democracy and Technology (CDT), the American Civil Liberties Union (ACLU), and the American Library Association respectfully submit these supplemental comments in response to the Federal Trade Commission’s (FTC) proposed Rule implementing the Children’s Online Privacy Protection Act (COPPA or the Act). Notice of Proposed Rulemaking to Implement the Children’s Online Privacy Protection Act of 1998, and Proposed Rule, 64 Fed. Reg. 80 (April 27, 1999).

I. The Threat to Children's Speech

Directly contrary to both the statutory language and intent of The Children's Online Privacy Protection Act, the Proposed Rule dramatically inhibits the ability of children to communicate over the Internet. COPPA appropriately addresses the privacy concerns raised by the collection of personal information by commercial Web sites directed to children (or that have actual knowledge that they are dealing with a child). The Act was designed to place duties on those who collect information from children. It was not designed to regulate children's behavior; indeed, great effort was taken to ensure that the Act would not limit children's ability to speak. That is, however, exactly what the Proposed Rule does.

The core of the Act's protections is the requirement that commercial Web sites and online services directed at children 12 and under, and Web sites that have actual knowledge they are dealing with a child, obtain parental consent prior to the collection of personal information from children. The legislation was not intended to interfere with children's ability to communicate, interact, and seek out information online. However, two definitions contained in the Proposed Rule go beyond the statutory language and threaten to upset the balance between protecting children's privacy and ensuring their ability to participate online.

Under the Proposed Rule, Web sites that do not collect personal information from children will nonetheless be required to obtain verifiable parental consent before allowing children to participate in any service that allows children to speak. Simply put, any site that would enable a child to communicate with a peer, ask a question of a teacher, or e-mail to a neighborhood friend, would have to obtain parental consent before allowing such communications. For example, Internet sites that provide anonymous chat or email services for children would be required to obtain parental consent, even if the operator of the site does not gather any information from the children.

Rather than focusing on the risks to children posed by the collection of personal information by commercial Web sites, the Proposed Rule erects a barrier to children's speech because of the possibility that children may (as they may when using the telephone or playing on a playground) disclose information about themselves. The Proposed Rule reduces the vibrant and interactive Internet -- where children can speak as well as listen -- to something far more akin to television.

The harmful effect of the Proposed Rule may indeed be inadvertent on the part of the Commission. In its discussion of the Proposed Rule, the Commission expressly draws a critical distinction between "conduits" and "operators." The discussion states: "Where the website or online service merely acts as the conduit through which the personal information collected flows to another person or to another's website or online service, and the website or online service does not have access to the information, then it is not an operator under the proposed Rule." Based on this discussion, it would appear that the Commission does not intend to reach services providers that merely provide communications capabilities to children -- but that is exactly what the Proposed Rules do.

Whether an inadvertent drafting problem or an intentional effort to go beyond the statutory language of the Act, the Proposed Rules are contrary to the statute and must be changed, as detailed in the following section.

Problematic Sections of the Proposed Rule and Recommended Changes

The statutory language of COPPA was clearly limited to reaching situations where the "operator" of an Internet site gathered information from children for commercial purposes. The Proposed Rule, however, places obligations on operators of email services, chat rooms, and other communications media even if the operator does not gather information. The effect of this overreaching in the Proposed Rule is to place significant burdens on the ability of children to speak online.

The problem arises in two specific definitions found in the Proposed Rule: that of "disclosure" and "collect." Separately, either definition would likely be read to encompass the mere provision of communications capability to children (even if the operator of the service does not collect information). Taken together, the two definitions would likely be interpreted to burden children's ability to speak. Both definitions warrant careful review and correction by the Commission.

The Proposed Rule expands the statutory definition of "disclosure" (bold indicates new language):

The term 'disclosure' means, with respect to personal information --

The release of personal information collected from a child in identifiable form by an operator for any purpose, except where such information is provided to a person other than the operator who provides support for the internal operations of the Web site and does not disclose or use that information for any other purpose, where (1) release of personal information means the sharing, selling renting, or any other means of providing personal information to any third party, and (2) support for the internal operations of the Web site or online service means those activities necessary to maintain the technical functioning of the Web site or online service, or to fulfill a request of a child as permitted by ßß312.5(c)(2) and (3): and,

Making personal information collected from a child by a Web site or online service directed to children or with actual knowledge that such information was collected from a child, publicly available in identifiable form, by any means including by a public posting, through the Internet, or through --

A home page of a Web site;

A pen pal service;

An electronic mail service;

A message board; or

A chat room; or,

Any other means that would enable a child to reveal personal information to others online.

The boldfaced provision in Subsection (b) was added in the Proposed Rule, and that language (especially when read in conjunction with the definition of "collect") sweeps in the mere provision of a communications capability to children. Simply read, the language would cover any service in which a child could possibly disclose information even if the operator of the service does not collect the information.

While the FTC clearly must have flexibility to ensure that the list of methods through which an operator can disclosed collected information in section (b) are not outdated, this is accomplished by the phrase "by any means" in the statutory definition. The definition in the Proposed Rule turns the disclosure or revelation of information by a child -- an activity which an operator cannot (nor are they expected to under the Act) control -- into a "collection" and subsequent "disclosure" by the operator. Clearly this is not the intent of the statute.

The Proposed Rule should be amended as follows:

The release of personal information collected from a child in identifiable form by an operator for any purpose, except where such information is provided to a person other than the operator who provides support for the internal operations of the Web site and does not disclose or use that information for any other purpose, where (1) release of personal information means the sharing, selling renting, or any other means of providing personal information to any third party, and (2) support for the internal operations of the Web site or online service means those activities necessary to maintain the technical functioning of the Web site or online service, or to fulfill a request of a child as permitted by ßß312.5(c)(2) and (3): and,

Making personal information collected from a child by a Web site or online service directed to children or with actual knowledge that such information was collected from a child by an operator, publicly available in identifiable form, by any means including by a public posting, through the Internet, or through --

A home page of a Web site;

A pen pal service;

An electronic mail service;

A message board; or

A chat room; or,

Any other means that would enable a child to reveal personal information to others online.

Section 312.2 defines the term "collects or collection," a term not defined in the Act:

Collects or collection means the direct or passive gathering of any personal information from a child by any means, including but not limited to:

Any online request for personal information by the operator regardless of how that personal information is transmitted to the operator;

Collection using a chat room, message board, or other public posting of such information on a Web site or online service; or,

Passive tracking or use of any identifying code linked to an individual, such as a cookie.

We concur with the FTC's assessment that the terms "collects and collection" must be defined. All personal information collected by the commercial operator pursuant to these regulations -- including information collected from parents, information collected offline, and information collected during the process of verifiable consent -- should be covered by this definition. The Rule appropriately clarifies the intent of the Act to cover all such instances of collection.

However, by not making clear that "collection" refers to collection by the commercial operator, the definition (especially when read in conjunction with the definition of "disclosure") appears to reach beyond the statutory language to cover communications services provided by an operator even if the operator is not collecting any information.

Inserting the words "by an operator" in the first line of the definition clarifies the scope of the Act -- commercial Web sites directed at children or who knowingly collect information from children. Currently the definition appears to expand the scope of entities covered by the Act. Inserting the phrases "the use by an operator" and "to gather" in section (b) would clarify that the act that triggers the parental consent requirement of the law is that of "collecting" -- an intentional act, not the provision of a service where a child may -- despite the operator's best efforts -- disclose information. This distinction, as the Commission acknowledges in the discussion of the term "operator," is critical.

Collects or collection means the direct or passive gathering, by an operator, of any personal information from a child by any means, including but not limited to:

Any online request for personal information by the operator regardless of how that personal information is transmitted to the operator;

Collection using The use by an operator of a chat room, message board, or other online service public posting of such to gather personal information on a Web site or online service; or,

Passive tracking or use of any identifying code linked to an individual, such as a cookie.

If the expansion of the Proposed Rule beyond that supported by the statutory language was inadvertent, we assume that the Commission will make the needed corrections. If, however, the harmful provisions of the Proposed Rule were intentionally inserted, then those provisions cannot stand. The Proposed Rule violates the will of Congress in at least four different ways:

As the Commission acknowledged in its discussion, the Act was not intended to reach mere "conduits" that provide communications services to children without collecting information. That is, however, exactly what the Proposed Rule does.

The rule greatly expands the scope of the Act. By equating the possibility that a child might disclose personal information with the intentional collection of information by the operator of a service, the Proposed Rule arguably would require commercial Web sites and service providers to actively seek out age information prior to allowing individuals to engage in communicative activities. For if a child uses the service and discloses his or her age and other information -- an act which the Web site or service is completely unable to control -- the site or service arguably would be guilty of collecting information without parental consent. Thus a child's activity, rather than the Web site or service provider's activity, will trigger the law. Clearly Congress did not intend to create a system where businesses are unable to structure their activities to avoid liability.

The impact of the Proposed Rule is an expansion of service provider liability for the acts of third parties. Congress has taken great pains to limit liability for illegal content and conduct to those directly responsible. Section 230 of the Communications Act of 1995 clearly distinguished between the creators of content and those who provide the pipes and wires on which that content sits -- placing liability firmly on the shoulders of the content creator. The Proposed Rule cuts directly against the congressional decision about liability in the online context. Rather than creating a framework where individuals and businesses are held responsible for their own actions, the Proposed Rule would allow the act of a child to cause a Web site or Internet Service Provider to be found guilty of violating the law.

Congress is actively attempting to increase children's access to the Internet. Major expenditures have been targeted to wire classrooms and libraries across the nation. If the Proposed Rule is not substantially modified the government may just as well spend its funds installing non-interactive "TV" sets -- for the Proposed Rule is likely to substantially limit children's use of the very characteristics that make the Internet powerful -- creating another environment where children can see but not speak. If this was Congress' intent they could have merely required that computers provided to children come equipped with a "mouse" but no keyboard -- for this is likely to be the effect of the Proposed Rule.

COPPA represents an effort to create a legal framework for privacy protection designed specifically for the Internet. This rulemaking is the first effort by a federal agency to implement Rules specifically for the Internet environment. The success or failure of these Rules and this law will have an enormous impact on the future of privacy protections, speech, the Internet, electronic commerce, and future regulatory efforts in these areas. In many ways this is the test bed for whether government intervention can be successful in the online environment. We believe that the changes requested above are essential to ensuring that the Act meets its goal of protecting children in a manner that preserves the interactivity of children's experience on the Internet and preserves children's access to information in this rich and valuable medium.

We welcome the opportunity to comment upon the proposed Rule and looks forward to working with the Federal Trade Commission and all interested parties to implement the Act in a manner true to its goals.

Sincerely,

Jerry Berman, Executive Director

Center for Democracy and Technology

Barry Steinhardt, Associate Director

American Civil Liberties Union

Lynn Bradley, Acting Director of the Washington Office

American Library Association