FTC Protecting Children's Privacy Online

On the second anniversary of the Children's Online Privacy Protection Rule, the Federal Trade Commission announced its sixth COPPA enforcement case together with new initiatives designed to enhance compliance with the law.

The package of initiatives includes:

• A settlement with the operators of the Etch-A-Sketch Web site resolving alleged violations of COPPA and requiring a $35,000 civil penalty;
• Release of an FTC COPPA compliance survey, and a business education initiative to help children's Web site operators draft COPPA-compliant privacy policies;
• Announcement of warning letters to more than 50 children's sites alerting them to the notice provisions of COPPA and the requirement that they comply with these provisions; and
• Extension of COPPA's sliding scale mechanism for obtaining verifiable parental consent for a three year period.

"Enforcing promises to protect the personal information of our youngest consumers is an important part of our privacy program," said J. Howard Beales, III, Director of the FTC's Bureau of Consumer Protection. "With the publication of the COPPA privacy policy compliance guide, Web sites that cater to kids have a new plain language guide to how to get it right."

The Children's Online Privacy Protection Act applies to operators of commercial Web sites and online services directed to children under the age of 13, and to general audience Web sites and online services that knowingly collect personal information from children. Among other things, the law requires that Web sites obtain verifiable consent from a parent or guardian before they collect personal information from children. It also prohibits sites from conditioning a child's participation in an activity on the child's disclosing more personal information than is reasonably necessary to participate in such an activity.

Settlement with The Ohio Art Company

The Ohio Art Company, manufacturer of the Etch-A-Sketch drawing toy, will pay $35,000 to settle Federal Trade Commission charges that it violated the Children's Online Privacy Protection Rule by collecting personal information from children on its www.etch-a-sketch Web site without first obtaining parental consent. The settlement also bars future violations of the COPPA Rule. This is the FTC's sixth COPPA law enforcement case.

The FTC alleges that The Ohio Art Company collected personal information from children registering for "Etchy's Birthday Club." The site collected the names, mailing addresses, e-mail addresses, age, and date of birth from children who wanted to qualify to win an Etch-A-Sketch toy on their birthday. The FTC charged that the company merely directed children to "get your parent or guardian's permission first," and then collected the information without first obtaining parental consent as required by the law. In addition, the FTC alleged that the company collected more information from children than was reasonably necessary for children to participate in the "birthday club" activity, and that the site's privacy policy statement did not clearly or completely disclose all of its information collection practices or make certain disclosures required by COPPA. The site also failed to provide parents the opportunity to review the personal information collected from their children and to inform them of their ability to prevent the further collection and use of this information, the FTC alleged.

FTC Survey of Children's Web Sites and Educational Outreach

The agency also announced the results of an April 2001 COPPA compliance survey reviewing information collection practices at 144 children's Web sites. The 2001 survey follows up on an earlier 1998 survey and indicates that much progress has been made. For example, the vast majority - nearly 90 percent - of the sites that collected personal information from children had privacy policies, as opposed to only 24 percent in 1998. At the same time, the survey shows that many sites are not fully complying with all the requirements of the Rule. For example, only about half the sites complied with COPPA-specific notice requirements such as informing parents of their right to review information collected from their child, have it deleted, and to refuse to allow further collection of information.

To improve compliance, the FTC has launched an educational effort and issued a new publication, "You, Your Privacy Policy and COPPA," to assist the operators of children's Web sites in drafting a COPPA-compliant privacy policy. This guide explains each component of a COPPA-compliant privacy policy, answers questions that Web site operators have asked, and features a compliance checklist to help site operators improve their privacy policies.

Warning Letters to Children's Web Sites

The FTC also has sent letters to more than 50 children's Web site operators, identified through its April 2001 survey, warning them that they must improve their privacy policies in order to make them COPPA compliant. The site operators were sent copies of the Commission's new COPPA privacy policy compliance guide, and were encouraged to call or e-mail the staff with any questions.

Extension of the Rule's Sliding Scale Mechanism

On October 31, 2001, the FTC published its proposal to extend the Rule's sliding scale mechanism for obtaining parental consent, originally slated to expire on April 21, 2002. Under the sliding scale, a Web site collecting personal information solely for its internal use, and not disclosing the information to the public or third parties, may obtain parental consent through the use of an e-mail message from the parent, coupled with additional steps to provide assurance that it is the parent providing the consent. If the Web site is going to disclose the personal information to the public or third parties, the Rule requires that the Web site use more reliable methods.

As part of the rulemaking process, the FTC sought comment on several questions, including the current and anticipated availability and affordability of secure electronic mechanisms and/or infomediary services for obtaining parental consent. The Commission also sought comment on the length of the proposed extension and the negative impact, if any, of extending the sliding scale mechanism.

The comments received indicated that secure electronic technology and infomediary services are not yet widely available at a reasonable cost and that the sliding scale mechanism to date has been an effective method for obtaining parental consent.

Accordingly, the FTC has extended the sliding scale mechanism for three years, until April 21, 2005. The Commission will re-examine this issue through public notice and comment in connection with the statutorily mandated review of the Rule in 2005.

The Commission votes to accept the settlement in the Ohio Art Company case, publish the survey, and extend the sliding scale were 5-0. The complaint and consent were filed by the Department of Justice at the request of the FTC. They were filed in the U. S. District Court for the Northern District of Ohio, Western Division, in Toledo.

NOTE: A consent decree is for settlement purposes only and does not constitute an admission by the defendant of a law violation. Consent decrees have the force of law when signed by the judge.

Copies of the complaint and consent decree are available from the FTC's Web site at http://www.ftc.gov and also from the FTC's Consumer Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580. For further information about the COPPA Rule, and to access the survey report and compliance guide, see http://www.ftc.gov/kidzprivacy. The FTC works for the consumer to prevent fraudulent, deceptive and unfair business practices in the marketplace and to provide information to help consumers spot, stop and avoid them. To file a complaint, or to get free information on any of 150 consumer topics, call toll-free, 1-877-FTC-HELP (1-877-382-4357), or use the complaint form at http://www.ftc.gov. The FTC enters Internet, telemarketing, identity theft, and other fraud-related complaints into Consumer Sentinel, a secure, online database available to hundreds of civil and criminal law enforcement agencies in the U.S. and abroad.

(FTC File Nos. 022-3028 (Ohio Art); P01 4505 (compliance surf); P02 4517 (sliding scale))