Internet Site Agrees to Settle FTC Charges of Deceptively Collecting Personal Information in Agency's First Internet Privacy Case

GeoCities, one of the most popular sites on the World Wide Web, has agreed to settle Federal Trade Commission charges that it misrepresented the purposes for which it was collecting personal identifying information from children and adults. This is the first FTC case involving Internet privacy. Under the settlement, GeoCities has agreed to post on its site a clear and prominent Privacy Notice, telling consumers what information is being collected and for what purpose, to whom it will be disclosed, and how consumers can access and remove the information. To ensure parental control, GeoCities also would have to obtain parental consent before collecting information from children 12 and under.

"GeoCities misled its customers, both children and adults, by not telling the truth about how it was using their personal information," said Jodie Bernstein, Director of the FTC's Bureau of Consumer Protection. "This case is a message to all Internet marketers that statements about their information collection practices must be accurate and complete. The FTC will continue to monitor these Internet sites and bring enforcement actions when it's appropriate. GeoCities should be commended for stepping forward and agreeing to undertake important privacy protections for consumers. I hope that other Web sites will follow GeoCities' lead in implementing these protections."

GeoCities, headquartered in Santa Monica, California, operates the GeoCities Web site, a "virtual community" consisting of members' personal home pages organized into themed areas, called neighborhoods. GeoCities has over 2 million members, and industry reports have identified it as the third most frequently visited Web site accessed from consumers' homes. The GeoCities Web site can be found at http://www.geocities.com (no period).

GeoCities provides numerous services to its members, including free and fee-based personal home pages and free e-mail service. In order to become a member of GeoCities, individuals must complete an online application form that requests certain personal identifying information. At the time of the investigation, the form designated certain information as mandatory and other information as "optional." The form also asked applicants to select whether they wished to receive specific "special offers" from advertisers, and specific products or services from individual companies.

Through this registration process, GeoCities created a database that included e-mail and postal addresses, member interest areas, and demographics including income, education, gender, marital status and occupation, the FTC said. According to the agency, this information created target markets for advertisers and resulted in disclosure of personal identifying information of children and adults to third-party marketers.

The FTC's complaint alleges that GeoCities misrepresented that the personal identifying information it collected through the membership application form was used only to provide members the specific advertising offers and products or services they requested, and that the "optional" information (education level, income, marital status, occupation, and interests) would not be released to anyone without the member's permission. In fact, the complaint alleges, this information was disclosed to third parties, who used it to target members for solicitations beyond those agreed to by the member.

The complaint also charges that GeoCities engaged in deceptive practices relating to its collection of information from children. According to the FTC, GeoCities promotes the Official GeoCities GeoKidz Club and contests for children in the Enchanted Forest neighborhood. Children wishing to join in these activities are required to complete forms that solicit personal identifying information. The agency charged that GeoCities misrepresented that GeoCities itself operated the GeoKidz Club and certain contests, and that the information collected online through the club and contests was maintained by GeoCities. In fact, according to the complaint, the Club and contests were run by third-party "community leaders" hosted on the GeoCities Web site, who collected and maintained the information.

The proposed settlement would prohibit GeoCities from misrepresenting the purpose for which it collects or uses personal identifying information from or about consumers, including children. Personal information is defined to include name, physical and e-mail address, phone number, and any other information that by itself or in combination with other information is identifiable to a specific individual.

The order would require the company to post on its site a clear and prominent Privacy Notice, telling consumers what information is being collected and for what purpose, to whom it will be disclosed, and how consumers can access and remove the information. The Notice, or a clear and prominent hyperlink to the Notice, would have to appear on the Web site's home page and at each location on the site at which such information is collected.

The order also would prohibit GeoCities from misrepresenting either the identity of a party collecting any personal identifying information or the sponsorship of any activity on its Web site.

To ensure parental control, the settlement would require GeoCities to obtain parental consent before collecting personal identifying information from children 12 and under. This provision conforms to current industry self-regulatory guidelines. The order would not require any particular procedure for obtaining parental consent, allowing for future technological developments, but would include a specific procedure that would be deemed to comply with the order. Under that procedure, GeoCities could collect certain "limited screening information" from consumers attempting to register at the site for the purpose of identifying and blocking children 12 and under from registering without their parent's permission. The company would then (a) notify the parents of the child's interest in registering at the site, and (b) obtain a parent's express consent. The order specifies several means by which the parent can transmit his/her consent, including a signed statement sent by mail or a credit card authorization.

Under the proposed order, GeoCities would be required to notify its members and provide them with an opportunity to have their information deleted from GeoCities' and any third parties' databases. The settlement would require GeoCities to notify the parents of children 12 and under and to delete their information, unless a parent affirmatively consents to its retention and use. GeoCities also would be required to contact third parties to whom it previously disclosed the information and request that those parties delete that information as well.

Finally, the settlement would require GeoCities to provide, for five years, a clear and prominent hyperlink within its Privacy Notice directing visitors to the FTC's Web site, http://www.ftc.gov, to view educational material on consumer privacy. Currently, the FTC site contains a brochure entitled: "Site-Seeing on the Internet." GeoCities also would be required to establish an information practices training program for its employees and volunteer community leaders.

The Commission vote to publish the proposed consent agreement was 4-0.

An analysis of the proposed agreement will appear in the Federal Register shortly. The agreement will be subject to public comment for 60 days, after which the Commission will decide whether to make it final. Comments should be addressed to the FTC, Office of the Secretary, 6th Street and Pennsylvania Avenue, N.W., Washington, D.C. 20580.

NOTE: A consent agreement is for settlement purposes only and does not constitute an admission of a law violation. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of $11,000.

Copies of the complaint, the proposed consent order, the analysis of the proposed consent order to aid public comment, the brochure, "Site-Seeing on the Internet," as well as information, including Commission reports and testimony about its privacy initiative are available from the FTC's web site at http://www.ftc.gov and also from the FTC's Consumer Response Center, Room 130, 6th Street and Pennsylvania Avenue, N.W., Washington, D.C. 25080; 202-FTC-HELP (202-382-4357); TDD for the hearing impaired 1-866-653-4261. To find out the latest news as it is announced, call the FTC NewsPhone recording at 202-326-2710.

(FTC File No. 982 3015)