|
|
WASHINGTON, Oct. 20, 1999 -- Certain types of commercial Web
sites will soon have to get a parent's permission before collecting
personal information from children under 13.
The Federal Trade Commission today issued
the final rule to implement the Children's Online Privacy Protection Act
of 1998 (COPPA), which is intended to protect the privacy of children
using the Internet. The rule takes effect April 21, 2000.
"This final step achieves one of the
Commission's top goals - protecting children's privacy online,"
said FTC Chairman Robert Pitofsky.
"The rule puts parents in control over
the information collected from their children online, and is flexible
enough to accommodate the many business practices and technological
changes occurring on the Internet," Pitofsky said.
The Commission recommended that Congress
enact legislation concerning children following a March 1998 survey of
212 commercial children's Web sites. The survey found that while 89
percent of the sites collected personal information from children, only
24 percent posted privacy policies and only one percent required
parental consent to the collection or disclosure of children's
information. The COPPA received widespread support from industry and
consumer groups.
The statute and rule apply to commercial
Web sites and online services directed to, or that knowingly collect
information from, children under 13. To inform parents of their
information practices, these sites will be required to provide notice on
the site and to parents about their policies with respect to the
collection, use and disclosure of children's personal information.
With certain exceptions, sites will also
have to obtain "verifiable parental consent" before
collecting, using or disclosing personal information from
children.
The issue of how Web sites can obtain
"verifiable parental consent" generated the most interest
among the commenters and prompted the Commission to hold a workshop
devoted to the issue. The statute defines "verifiable parental
consent" as "any reasonable effort (taking into consideration
available technology) ... to ensure that a parent of a child ...
authorizes the collection, use, and disclosure" of a child's
personal information.
The comments and the workshop testimony
(available on the Commission's Web site)
showed that certain methods of consent provide greater assurances that
the person providing consent is the child's parent, but that some of
these methods need additional time to develop and become available for
widespread use. As noted below, the final rule temporarily adopts a
"sliding scale" approach that will allow Web sites to vary
their consent methods based on the intended use of the child's
information.
Key Provisions of the Final Rule
Privacy Notice on the Web
Site
A Web site operator must post a clear
and prominent link to a notice of its information practices on its
home page and at each area where personal information is collected
from children. The notice must state the name and contact
information of all operators, the types of personal information
collected from children, how such personal information is used, and
whether personal information is disclosed to third parties.
The notice also must state that the
operator is prohibited from conditioning a child's participation in
an activity on the child's disclosing more personal information than
is reasonably necessary. In addition, the notice must state that the
parent can review and have deleted the child's personal information,
and refuse to permit further collection or use of the child's
information.
Verifiable Parental Consent
The final rule temporarily adopts a
"sliding scale" approach that allows Web sites to vary
their consent methods based on the intended uses of the child's
information. For a two-year period, use of the more reliable methods
of consent (print-and-send via postal mail or facsimile, use of a
credit card or toll-free telephone number, digital signature, or
e-mail accompanied by a PIN or password) will be required only for
those activities that pose the greatest risks to the safety and
privacy of children -- i.e., disclosing personal information
to third parties or making it publicly available through chatrooms
or other interactive activities.
For internal uses of information, such
as an operator's marketing back to a child based on the child's
personal information, operators will be permitted to use e-mail, as
long as additional steps are taken to ensure that the parent is
providing consent. Such steps could include sending a confirmatory
e-mail to the parent following receipt of consent, or obtaining a
postal address or telephone number from the parent and confirming
the parent's consent by letter or telephone call. The "sliding
scale" will sunset two years after the effective date of the
rule, at which time the more reliable methods would be required for
all uses of information, unless the Commission determines more
secure electronic methods of consent are not widely available.
Choice Regarding Disclosures
to Third Parties
The rule requires operators to
"give the parent the option to consent to the collection and
use of the child's personal information without consenting to
disclosure of his or her personal information to third
parties."
Online Activities for which
Parental Consent is Not Required
The rule sets forth several exceptions
to the requirement of prior parental consent that permit operators
to collect a child's e-mail address for certain purposes. For
example, no consent is required to respond to a one-time request by
a child for "homework help" or other information. In
addition, an operator can enter a child into a contest or send a
child an online newsletter as long as the parent is given notice of
these practices and an opportunity to prevent further use of the
child's information.
Coverage of Information
Submitted Online
The Federal Register notice accompanying
the rule makes clear that the rule covers only information submitted
online, and not information requested online but submitted offline.
Role of Schools in Obtaining
Consent for Students
The Federal Register notice accompanying
the rule makes clear that schools can act as parents' agents or as
intermediaries between Web sites and parents in the notice and
consent process.
The statute includes a "safe
harbor" program for industry groups or others who wish to
create self-regulatory programs to govern participants' compliance.
Commission-approved safe harbors will provide Web site operators
with the opportunity to tailor compliance obligations to their
business models with the assurance that if they follow the safe
harbor they will be in compliance with the rule. Sites participating
in such Commission-approved programs will be subject to the review
and disciplinary procedures provided in those guidelines in lieu of
formal Commission action.
The statute authorizes the Commission to
bring enforcement actions and impose civil penalties for violations
of the rule in the same manner as for other rules under the Federal
Trade Commission Act.
|
|
