Rebecca Richards
Director of Compliance and Policy
TRUSTe
1776 K Street, NW
Washington, D.C. 20007

Dear Ms. Richards:

This letter is to inform you that the Federal Trade Commission has approved TRUSTe's application to serve as a safe harbor program for purposes of implementing the protections of the Children's Online Privacy Protection Rule.⁽¹⁾ As you know, the Rule includes a provision enabling industry groups or others to submit self-regulatory guidelines to the Commission for approval as a safe harbor program.⁽²⁾ Pursuant to this provision, TRUSTe submitted an application for Commission approval on August 29, 2000. The application was published in the Federal Register on September 7, 2000 for public comment, which closed on October 10, 2000.⁽³⁾

To be approved by the Commission, self-regulatory guidelines must include: (1) a requirement that participants in the safe harbor program implement substantially similar requirements that provide the same or greater protections for children as those contained in the Rule; (2) an effective, mandatory mechanism for the independent assessment of safe harbor program participants' compliance with the guidelines; and (3) effective incentives for safe harbor program participants' compliance with such guidelines.⁽⁴⁾ The Commission has determined that TRUSTe's application for status as a safe harbor program and its self-regulatory requirements satisfy these three criteria.

First, the Commission has determined that TRUSTe's "Children's Seal Program Requirements," Schedule A of its "Children's License Agreement," mirror the provisions of the Rule in setting forth the requirements that each safe harbor participant must follow, and therefore provide the same or greater protections as those contained in the Rule.

Second, the Commission has determined that the independent assessment mechanisms which TRUSTe has created to evaluate participants' compliance with its guidelines meet the standard set out in the Rule. The proposed program asks the applicant to complete and attest to an initial self-assessment sheet,⁽⁵⁾ in preparation for TRUSTe's independent assessment of the website's information practices. The program also includes random, periodic monitoring and seeding of each website to assess compliance with the self-regulatory guidelines.

Third, the Commission has concluded that TRUSTe's safe harbor program provides a number of effective incentives to ensure operators' ongoing compliance with its guidelines. For example, in cases where the operator fails to voluntarily comply with TRUSTe's program requirements, TRUSTe may revoke the website's Children's Seal, cancel the website's membership in the program, and/or refer the website to the Federal Trade Commission.

In response to the publication of TRUSTe's safe harbor application, the Commission received two comments. The comments raised concerns that, among other things, the TRUSTe program did not clearly articulate: (1) when websites are required to send direct notices to parents and the required content of the notices; (2) the exceptions to prior parental consent; (3) the accepted mechanisms for obtaining verifiable parental consent; and (4) the program's assessment mechanisms and incentives for participating websites. The Commission believes that the concerns raised by the comments have been addressed through TRUSTe's submission of its revised materials. TRUSTe's Children's Seal Program Requirements, which closely follow the requirements set forth in the Rule, now specifically articulate each requirement that website operators must meet in order to fall within the safe harbor program.

The Commission therefore is pleased to approve TRUSTe's application as its third safe harbor program. This program will play an important role in expanding the implementation of the COPPA Rule, and we look forward to working with TRUSTe and other safe harbor programs to provide these important protections for children's online privacy. The Commission reserves the right to revoke this approval if at any time it determines that the approved self-regulatory guidelines and their implementation do not, in fact, meet the requirements of the Rule.

By direction of the Commission.

Donald S. Clark
Secretary

1. 16 C.F.R. § 312.

2. 16 C.F.R. § 312.10.

3. The Commission received two comments. In response to concerns raised in the comments, TRUSTe revised its application and provided additional materials, which more fully describe the practices websites must implement under its program. TRUSTe's revised application was finalized on April 10, 2001.

4. 16 C.F.R. § 312.10(b).

5. The TRUSTe Children's Self-Assessment Sheet is a multi-page form that asks for detailed information regarding the website's privacy policy, information collection, disclosure and use practices, relationships with third parties, and other practices relevant to the Rule's requirements.