| Thomas A. Marino United States Attorney By: Assistant United States Attorney/Lead
Counsel IN THE UNITED STATES DISTRICT
COURT
WHEREAS plaintiff, the United States of America, has commenced this action by filing the Complaint herein; defendant has waived service of the Summons and Complaint; the parties have been represented by the attorneys whose names appear hereafter; and the parties have agreed to settlement of this action upon the following terms and conditions, without adjudication of any issue of fact or law and without defendant admitting liability for any of the matters alleged in the Complaint or that the facts as alleged in the Complaint, other than the jurisdictional facts, are true; THEREFORE, on the joint motion of plaintiff and defendant, it is hereby ORDERED, ADJUDGED, and DECREED as follows: 1. This Court has jurisdiction of the subject matter and of the parties. 2. The Complaint states a claim upon which relief may be granted against the defendant under Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 ("COPPA"), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act ("FTC Act"), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a). Among other things, the Complaint alleges that defendant violated COPPA by failing to obtain verifiable parental consent prior to collecting and/or disclosing personal information from children online. DEFINITIONS 3. For the purposes of this Consent Decree, the term "Rule" means the Federal Trade Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312. 4. For the purposes of this Consent Decree, the terms "child," "collects," "collection," "Commission," "delete," "disclosure," "Internet," "online contact information," "operator," "parent," "person," "personal information," "third party," "verifiable consent," and "website or online service directed to children," are defined as those terms are defined in Section 312.2 of the Rule, 16 C.F.R. § 312.2. 5. For the purposes of this Consent Decree, the term "subject to the Rule," when referring to a website or online service, means either (1) a website or online service directed to children; or (2) a website or online service through which defendant has actual knowledge that it has collected or maintained personal information from a child. INJUNCTION 6. Defendant, and its successors and assigns, and all persons in active concert or participation with any one or more of them who receive actual notice of this Consent Decree by personal service or otherwise, are hereby enjoined, directly or through any corporation, subsidiary, division, website, or other device, from violating any provision of the Rule. A copy of the current Rule is attached hereto as "Appendix A" and incorporated herein as if fully set forth verbatim. 7. In the event the Rule is hereafter amended or modified, defendant's compliance with that Rule as so amended or modified shall not be deemed a violation of this injunction. CONSUMER EDUCATION REMEDY 8. For a period of five (5) years from the date of entry of this Consent Decree, defendant, and its successors and assigns, in connection with the operation of any website or other online service directed in whole or in part to children, shall place a clear and conspicuous notice (1) within the privacy policy required to be posted on its website(s) by Section 312.4(b) of the Rule, 16 C.F.R. § 312.4(b); and (2) within the direct notice required to be sent to parents by Section 312.4(c) of the Rule, 16 C.F.R. § 312.4(c), which states as follows in bold typeface:
Where the above notice is posted on a website or delivered via email or other electronic service, it shall be in the form of a hyperlink to www.ftc.gov/kidzprivacy. The Federal Trade Commission may change the hyperlink/URL upon thirty (30) days prior written notice to defendant, its successors or assigns. CIVIL PENALTY 9. Defendant, and its successors and assigns, shall pay to plaintiff a civil penalty, pursuant to Section 5(m)(1)(A) of the Federal Trade Commission Act, 15 U.S.C. § 45(m)(1)(A), in the amount of eighty-five thousand dollars ($85,000). 10. Defendant shall make the payment required by Paragraph 9 on the date of entry of this Consent Decree by certified or cashier's check made payable to the Treasurer of the United States and delivered to: The Office of Consumer Litigation, Civil Division, U.S. Department of Justice, Washington, D.C. 20530, for appropriate disposition. 11. In the event of any default in payment, which default continues for ten (10) days beyond the due date of payment, the entire unpaid penalty, together with interest, as computed pursuant to 28 U.S.C. § 1961, from the date of default to the date of payment, shall immediately become due and payable. COMPLIANCE 12. Defendant, and its successors and assigns, within five (5) days from the date of entry of this Consent Decree, shall delete all personal information collected from every child through its websites subject to the Rule at any time from April 21, 2000 through the date of entry of this Consent Decree. Provided, however, that defendant shall not be required to delete such information, which was collected in compliance with the Rule, to conduct the "Hershey's Haunted Home" sweepstakes until all prizes have been awarded. 13. Defendant, and its successors and assigns, within thirty (30) days from the date of entry of this Consent Decree, shall provide a copy of this Consent Decree and the Federal Trade Commission compliance guide entitled How to Comply with the Children's Online Privacy Protection Rule (Nov. 1999) ("compliance guide") (attached hereto as "Appendix B") to each of its current principals, officers, and directors, and to all current employees, agents, and representatives having managerial or supervisory responsibilities related to the operation of any website or online service subject to the Rule, and secure from each such person a signed statement acknowledging receipt of a copy of this Consent Decree and the compliance guide, and shall, within ten (10) days of complying with this Paragraph, submit to the Commission a signed statement setting forth the fact and manner of defendant's compliance, including the name and title of each person to whom a copy of the Consent Decree and compliance guide has been provided. For the purposes of complying with this Paragraph, defendant shall be permitted to redact the dollar amount of the civil penalty (set forth in Paragraph 9 above) from the copy of the Consent Decree provided to any such person. 14. For a period of three (3) years from the date of entry of this Consent Decree, defendant, and its successors and assigns, shall provide a copy of this Consent Decree and the compliance guide to each of its future principals, officers, and directors, and to all future employees, agents, and representatives having managerial or supervisory responsibilities related to the operation of any website or online service subject to the Rule, and secure from each such person a signed and dated statement acknowledging receipt of a copy of this Consent Decree and the compliance guide, within thirty (30) days after the person assumes such position or responsibilities. Defendant shall maintain copies of the signed statements, as well as other information regarding the fact and manner of its compliance, including the name and title of each person to whom a copy of the Consent Decree and compliance guide has been provided and, upon request, shall make the statements and other information available to the Federal Trade Commission. For the purposes of complying with this Paragraph, defendant shall be permitted to redact the dollar amount of the civil penalty (set forth in Paragraph 9 above) from the copy of the Consent Decree provided to any such person. 15. Within one hundred and twenty (120) days from the date of entry of this Consent Decree, and at such other times as the Federal Trade Commission may require, defendant, and its successors and assigns, shall file with the Commission a written report, setting forth in detail the manner and form in which it has complied and is complying with this Consent Decree. This report shall include but not be limited to:
16. For a period of five (5) years from the date of entry of this Consent Decree, defendant, and its successors and assigns, shall maintain and make available to the Federal Trade Commission for inspection and copying within fourteen (14) days of the date of receipt of a written request, a print or electronic copy in HTML format of all documents demonstrating compliance with the terms and provisions of this Consent Decree, including, but not limited to, a sample copy of every different information collection form, Web page, or screen, and a sample copy of each different document containing any representation regarding defendant's collection, use, and disclosure practices pertaining to personal information of a child. Each Web page copy shall be accompanied by the URL of the Web page where the material was posted online. Electronic copies shall include all text and graphics files, audio scripts, and other computer files used in presenting information on the Internet. Provided, however, that defendant shall not be required by this Paragraph to retain a document for longer than two (2) years after the document is created; or retain a print or electronic copy of any amended Web page or screen to the extent that the amendment does not affect defendant's compliance obligations under this Consent Decree. 17. For a period of twenty (20) years from the date of entry of this Consent Decree, defendant, and its successors and assigns, shall notify the Commission at least thirty (30) days prior to any change in its business that may affect compliance obligations arising under this Consent Decree, including, but not limited to, any merger, incorporation, dissolution, assignment, sale or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that, with respect to any proposed change in the corporation about which defendant, its successors and assigns, learn less than thirty (30) days prior to the date such action is to take place, it shall notify the Commission as soon as is practicable after obtaining such knowledge. 18. Defendant is hereby required, in accordance with 31 U.S.C. § 7701, to furnish to the Federal Trade Commission its taxpayer identifying number (social security number or employer identification number), which shall be used for purposes of collecting and reporting on any delinquent amount arising out of its relationship with the government. 19. All reports, submissions, and notices required by Paragraphs 12 - 18 of this Consent Decree shall be sent by certified mail to:
CONTINUING JURISDICTION 20. This Court shall retain jurisdiction of this matter for the purposes of enabling any of the parties to this Consent Decree to apply to the Court at any time for such further orders or directives as may be necessary or appropriate for the interpretation or modification of this Consent Decree, for the enforcement of compliance therewith, or for the punishment of violations thereof. JUDGMENT IS THEREFORE ENTERED in favor of plaintiff and against defendant, pursuant to all the terms and conditions recited above. Dated this __________ day of _______________, 2003. UNITED STATES DISTRICT JUDGE The parties, by their counsel, hereby consent to the terms and conditions of the Consent Decree as set forth above and consent to the entry thereof. Defendant waives any rights that may arise under the Equal Access to Justice Act, 28 U.S.C. § 2412, concerning the investigation and prosecution of this action.
|