By:

Assistant United States Attorney/Lead Counsel
Middle District of Pennsylvania
Federal Building, Suite 220
228 Walnut Street
Harrisburg, Pennsylvania 17108-1754
(717) 221-4482

Plaintiff, the United States of America, acting upon notification and authorization to the Attorney General by the Federal Trade Commission ("FTC" or "Commission"), for its Complaint alleges that:

1. Plaintiff brings this action under Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 ("COPPA"), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act ("FTC Act"), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a), to obtain monetary civil penalties, a permanent injunction, and other equitable relief for defendant's violations of the Commission's Children's Online Privacy Protection Rule (the "Rule"), 16 C.F.R. Part 312.

JURISDICTION AND VENUE

2. This Court has jurisdiction over this matter under 28 U.S.C. §§ 1331, 1337(a), 1345, and 1355, and under 15 U.S.C. §§ 45(m)(1)(A), 53(b) and 56(a). This action arises under 15 U.S.C. §§ 45(a)(1) and 6502(c).

3. Venue in this District is proper under 15 U.S.C. § 53(b) and 28 U.S.C. §§ 1391(b)-(c) and 1395(a).

DEFINITIONS

4. For purposes of this Complaint, the terms "child," "collects," "collection," "Commission," "delete," "disclosure," "Internet," "online contact information," "operator," "parent," "person," "personal information," "third party," "verifiable consent," and "website or online service directed to children," are defined as those terms are defined in Section 312.2 of the Rule, 16 C.F.R. § 312.2.

THE CHILDREN'S ONLINE PRIVACY PROTECTION RULE

5. Congress enacted the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501-6506, in 1998 to protect the safety and privacy of children online by prohibiting the unauthorized or unnecessary collection of children's personal information online by Internet websites and online services. The Act directed the Federal Trade Commission to promulgate a rule implementing COPPA. The Commission promulgated the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312, on November 3, 1999 under Section 1303(b) of COPPA, 15 U.S.C. § 6502(b), and Section 553 of the Administrative Procedures Act, 5 U.S.C. § 553. The Rule went into effect on April 21, 2000.

6. The Rule applies to any operator of a commercial website or online service directed to children that collects, uses, and/or discloses personal information from children, or to any operator that has actual knowledge that it is collecting or maintaining a child's personal information.

7. The Rule requires a subject website operator to meet specific requirements prior to collecting online, using, or disclosing personal information from children, including but not limited to:

a. Posting a privacy policy on its website providing clear, understandable, and complete notice of its information practices, including what information the website operator collects from children online, how it uses such information, its disclosure practices for such information, and other specifically required disclosures;

 

b. Providing clear, understandable, and complete notice of its information practices directly to parents when required by the Rule;

 

c. Obtaining verifiable parental consent prior to collecting, using, and/or disclosing personal information from children;

 

d. Giving parents the option to consent to the collection and internal use of their children's personal information without consenting to the disclosure of that information to third parties;

 

e. Providing a reasonable means for parents to review the personal information collected from their children and to refuse to permit its further use or maintenance; and

 

f. Establishing and maintaining reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children.

8. Pursuant to Section 18(d)(3) of the FTC Act, 15 U.S.C. § 57a(d)(3), a violation of the Rule constitutes an unfair or deceptive act or practice, in violation of Section 5(a)(1) of the FTC Act, 15 U.S.C. § 45(a)(1). See also COPPA, 15 U.S.C. § 6502(c).

DEFENDANT

9. Defendant Hershey Foods Corporation is a Delaware corporation with its principal office or place of business located at 100 Crystal A Drive, Hershey, Pennsylvania, 17033.

10. Defendant markets its chocolate and non-chocolate confectionery, and chocolate-related grocery products throughout the Unites States, including through the Internet. Since at least April 21, 2000, defendant has been the operator of www.hersheys.com, a website on the Internet, portions of which are directed to children. Defendant also has operated numerous other websites featuring its individual name-brand candies or other candy-related themes. Some of these websites knowingly collect personal information from children.

11. The acts and practices of defendant alleged in this Complaint have been in or affecting commerce, as "commerce" is defined in Section 4 of the FTC Act, 15 U.S.C. § 44.

DEFENDANT'S COURSE OF CONDUCT

12. Defendant operates the www.hersheys.com website and over thirty other websites dedicated to particular brand name candies or to other marketing opportunities for its candies. The www.hersheys.com website includes a "Kidztown" area directed to children. The subject matter, visual content, and language of Kidztown are targeted to children under the age of 13. For example, Kidztown features cartoon characters in the shape of candies introducing the various children's activities. Kidztown's "Fun & Games" section includes mazes, hidden words, simple crossword puzzles and coloring activities. Kidztown also includes a section titled "Candy of the Month." (See Exhibit A.)

13. Defendant collects or has collected personal information from children through the operation of the Kidztown portion of its website. In addition, defendant operates other websites, such as www.paydaybar.com and www.reesefastbreak.com, through which it has collected personal information from its visitors. Many of these websites are targeted to children under the age of 13; others are general audience websites where the defendant had actual knowledge that the visitors giving their personal information were under the age of 13. Defendant is, therefore, an "operator" as defined in the Rule.

Defendant's Information Collection, Use and Disclosure Practices

14. Children who visited the "Candy of the Month" section of the Kidztown area were invited to register for a sweepstakes to win a free box of candy. (See Exhibit B.) The registration page included a hyperlink inviting individuals over the age of 13 to register. The registration page informed children 13 years of age or under that they must get the consent of a parent or guardian before entering the sweepstakes, and included a "Parental Consent" form. (See Exhibit C.) The parental consent form asked for the parent's name, the child's name and their full home address. At the bottom of the form, there was a box labeled "Click here to consent." Clicking on this box automatically brought up the registration form for the sweepstakes. (See Exhibit D.) This registration form asked for additional personal information, including name, home address, email address, gender and age range. This method of obtaining parental consent was not reasonably calculated to ensure that the person providing consent was the child's parent. Moreover, even if no information was submitted in the parental consent form, and a child filled in the registration form indicating that he/she was under the age of 13, the entry form was accepted by defendant.

15. At the bottom of the online parental consent form described above, defendant allowed parents to withdraw their consent at any time by clicking on a hyperlink. Because the use of this form was not reasonably calculated to ensure that the person providing consent was the child's parent, however, defendant did not provide a reasonable means for parents to review or delete the information collected from their children.

16. In addition to the sweepstakes on the Kidztown area of www.hersheys.com, defendant offered similar sweepstakes on some of its other websites. For visitors under the age of 13, defendant's methods for obtaining parental consent were substantially similar to those described above. Some of the parental consent forms asked for additional personal information, such as the parent's email address and the child's email address and telephone number. Because defendant asked whether visitors wishing to enter the sweepstakes were under the age of 13 during the registration process, it had actual knowledge that some of the personal information it was collecting was from children. Defendant's method for obtaining prior parental consent for the collection of this information was not reasonably calculated to ensure that the person providing consent was the child's parent. Moreover, even if no information was submitted in the parental consent form, and a child filled in the registration form indicating that he/she was under the age of 13, the entry form was accepted by defendant.

17. In this manner, defendant collected personal information from thousands of children, including the child's first and last name, street address, email address, gender, approximate age, and, in some cases, the telephone number. According to defendant's website, this information was to be used to send winners of the sweepstakes a box of candy.

18. At times, defendant disclosed the personal information it collected from children by posting the first and last names and home states of the sweepstakes' winners on the Internet. This personal information was disclosed without obtaining verifiable parental consent.

Defendant's Privacy Policy

19. Defendant posted a "Privacy Policy Statement" on its websites, but this statement did not clearly, understandably, or completely disclose all of its information collection, use, and disclosure practices and other disclosures required by the Rule. (See Exhibit E.)

DEFENDANT'S VIOLATIONS OF THE
CHILDREN'S ONLINE PRIVACY PROTECTION RULE

20. Since at least April 21, 2000, defendant has been an operator of a website directed to children and/or has had actual knowledge that it has collected or maintained personal information from children.

21. In numerous instances, including the acts and practices described above, defendant has collected personal information from children in violation of the Rule, including:

a. Failing to provide sufficient notice on the website of what information it collects online from children, how it uses such information, its disclosure practices, and all other required content, in violation of Section 312.4(b) of the Rule, 16 C.F.R. § 312.4(b);

 

b. Failing to provide direct notice to parents of what information it collects online from children, how it uses such information, its disclosure practices, and all other required content, in violation of Section 312.4(c) of the Rule, 16 C.F.R. § 312.4(c);

 

c. Failing to obtain verifiable parental consent before any collection, use, and/or disclosure of personal information from children, in violation of Section 312.5 of the Rule, 16 C.F.R. § 312.5; and

 

d. Failing to provide a reasonable means for parents to review the personal information collected from their children and to refuse to permit its further use or maintenance, in violation of Section 312.6 of the Rule, 16 C.F.R. § 312.6.

DEFENDANT'S UNFAIR OR DECEPTIVE ACTS OR PRACTICES
IN VIOLATION OF THE FTC ACT

22. Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), provides that "unfair or deceptive acts or practices in or affecting commerce are hereby declared unlawful."

23. Pursuant to Section 18(d)(3) of the FTC Act, 15 U.S.C. § 57a(d)(3), a violation of the Rule constitutes an unfair or deceptive act or practice in violation of Section 5(a)(1) of the FTC Act, 15 U.S.C. § 45(a)(1). See COPPA, 15 U.S.C. § 6502(c).

24. By and through the acts and practices described in Paragraph 21 above, defendant has violated Section 5(a)(1) of the FTC Act, 15 U.S.C. § 45(a)(1).

CIVIL PENALTIES, INJUNCTION AND OTHER RELIEF

25. Defendant has violated the Rule as described above with knowledge as set forth in Section 5(m)(1)(A) of the FTC Act, 15 U.S.C. § 45(m)(1)(A).

26. Each collection, use, or disclosure of a child's personal information from April 21, 2000 through the filing of this Complaint, in which defendant has violated the Rule in one or more of the ways described above, constitutes a separate violation for which plaintiff seeks monetary civil penalties.

27. Section 5(m)(1)(A) of the FTC Act, 15 U.S.C. § 45(m)(1)(A), as modified by Section 4 of the Federal Civil Penalties Inflation Adjustment Act of 1990, 28 U.S.C. § 2461, and Section 1.98(d) of the FTC's Rules of Practice, 16 C.F.R. § 1.98(d), authorizes this Court to award monetary civil penalties of not more than $11,000 for each such violation of the Rule.

28. Under Section 13(b) of the FTC Act, 15 U.S.C. § 53(b), this Court is authorized to issue a permanent injunction against defendant's violation of the FTC Act, as well as such ancillary relief as may be just and proper.

PRAYER

WHEREFORE, plaintiff requests this Court, pursuant to 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b) and 57b, and the Court's own equitable powers to:

(1) Enter judgment against defendant and in favor of plaintiff for each violation alleged in this Complaint;

 

(2) Award plaintiff monetary civil penalties from defendant for each violation of the Rule;

 

(3) Permanently enjoin defendant from violating the Rule; and (4) Award plaintiff such additional relief as the Court may deem just, proper, or necessary to redress injury to consumers resulting from defendant's violations of the Rule.

DATED: