November 19, 2001
Donald S. Clark
Re: Children's Online Privacy Protection Rule Amendment - Comment P994504
Dear Mr. Clark:
The Online Privacy Alliance ("OPA") is a diverse group of more than 80 global corporations and associations who have come together to promote business-wide actions that create an environment of trust and foster the protection of individuals' privacy online. We support the development and use of self-regulatory enforcement mechanisms and user-empowerment tools. OPA also supports strong enforcement of applicable laws and regulations.
The Members of the Online Privacy Alliance believe that the development of interactive online communications provides tremendous opportunities for children. At the same time, it presents unique challenges for protecting the privacy of young children. Children under 13 are special. Unlike adults, they may not be fully capable of understanding the consequences of giving out personal information online. However, children often understand how to navigate online far better than their parents do. Parents will not always have the knowledge, the ability or the opportunity to intervene in their children's choices about giving out personal information. Therefore, companies operating online must protect the privacy of children.
When the Children's Online Privacy Protection Act ("COPPA") rules were adopted, the Online Privacy Alliance commended the Federal Trade Commission on striking a balance between the obvious need to protect children online and the need to maintain the interactivity that kids enjoy so much. Interactivity is the hallmark of the Net and the COPPA rules recognized that. At that time, OPA also said that it was important that the rules recognized the speed at which Internet technology changes and the decision to revisit the rules was sophisticated and sensible. The wisdom of the FTC's judgment has been confirmed. Given the passage of time, there is good reason to adjust the rules.
Under COPPA, in many cases, a site must obtain verifiable parental consent before collecting, using or disclosing personal information about a child. Consent is not required when a site is collecting an e-mail address to:
The FTC has recognized that it is a challenge to determine who is a parent and who is a child on the Internet. In the rulemaking proceeding leading up to the adoption of the COPPA rules, evidence was submitted that new technologies, such as digital signatures, were under development that could offer more reliable electronic verification at a reasonable cost. Yet, these products were not likely to be available by the effective date of the regulations. Therefore, the Commission adopted a "sliding scale" of permissible verification mechanisms, depending upon how the child's information was to be used. Under the current COPPA regulations, without action by the Commission, the "sliding scale" will be phased out on April 21, 2002.
Web site operators today may use e-mail mechanisms to obtain verifiable parental consent for internal uses of information collected from children under 13 years old. However, because many children are more Web savvy than their parents, the FTC concluded that even for these purposes, e-mail alone was insufficient. Instead, additional steps are required, including sending a follow-up e-mail to the parent confirming their consent or confirming the consent by letter or telephone call following the initial e-mail consent. Parents must be told that they can revoke their consent at any time.
Because the FTC concluded that third-party disclosures were among the most sensitive and potentially risky uses of children's personal information, it established an initially higher, more reliable standard for such disclosures. These disclosures also include chat rooms, message boards, pen pal services and personal home pages. The mechanisms approved by the FTC include print-and-send, use of a credit card, toll-free number and digital signatures or other reliable verification methods. E-mail verification is permitted, but only in conjunction with a PIN or password provided by one of the procedures described above.
A two-year extension, until April 21, 2004, of the phase-out of the sliding scale has now been proposed. The expected progress in available verification technology has clearly not yet occurred. Use of digital signatures has not become widespread nor have other verification technologies taken hold. Many have noted that even in the adult world, few companies have taken advantage of the new E-SIGN law to conduct transactions electronically.
Phasing out the sliding scale without an available, economical substitute for internal use of children's information would have considerable negative economic consequences for Web sites falling under the COPPA rules. In many instances, the added burdens and costs imposed by the phase out of the sliding scale would cause some sites to cease interactions with children and possibly go out of business because the alternative verification mechanisms are too costly. The impact of such a result would disadvantage children the most -- depriving them of the benefits and opportunities presented by a diverse array of child-friendly Internet content.
The Commission has sought comment on the length of the extension. First, there are no clear signals that the anticipated verification technology is likely to be economically and widely available in the consumer market in the foreseeable future. Thus, it is not clear why the sliding scale should only be extended for two years. Rather than conducting reviews of the COPPA rules every two years, it might make more sense to keep the sliding scale in place until the Commission believes that new verification technology is widely available. At that point, the Commission would be well positioned to propose a change in the rules. Second, all evidence suggests that the current sliding scale is working well. There are numerous Web sites safely interacting with children every day, providing children under 13 with valuable educational and entertaining content. OPA urges the Commission to consider making the current standard permanent, as it has proven to be an effective method of protecting children while maintaining the interactivity that kids enjoy so much.