U.S. Gov’t Phasing In New Internet Child Privacy Measures

The United States Federal Trade Commission released a set of rules Wednesday to implement the Children’s Online Privacy Protection Act of 1998, a law passed last fall amid heightened concern that children are being lured into making online purchases or sharing personal information that could threaten their safety.

As of April 21, 2000, some commercial Web sites will be required to obtain parental consent before collecting, using, or disclosing personal information from children under the age of 13. The FTC called the rule “a definitive move” that “puts parents in control over the information collected from their children online.”

The agency was also careful to position the new rules as reasonably merchant-friendly. FTC Chairman Robert Pitofsky argues that the rules are “flexible enough to accommodate the many business practices and technological changes occurring on the Internet.”

Data Collection Rules

Under the new rules, all commercial Web sites and online services aimed at children under 13 must provide notice of the company’s intention on the site’s main page and on each page that solicits information from a child.

The site must also provide notice to parents when they plan to collect, use or disclose a child’s personal information. The notice must include the name and contact information of all site operators, the types of personal information collected from children, how such personal information is used and whether the information will be disclosed to third parties.

Sites may not hinge a child’s participation in an activity on the disclosure of more personal information than is “reasonably necessary,” the FTC says, although it does not define “reasonably necessary.”

In addition, the notice must state that the parent can review and ask the site operator to delete personal information that the child submitted, and the parent can refuse to permit further collection or use of the child’s information.

Parental Powers

The statute also lays out the specific requirement that sites obtain “verifiable parental consent” before collecting, using or disclosing information collected from a child. According to the law, such consent consists of “any reasonable effort (taking into consideration available technology) … to ensure that a parent of a child … authorizes the collection, use, and disclosure” of a child’s personal information.

Recognizing that obtaining such consent may become a major headache for some companies, the FTC adopted a two-yearphase-in period based on the technology available to enable online companies to make contact with the parents.

In the first two years, methods such as the use of print-and-send forms via regular mail or fax, use of a credit card or toll-free telephone number, submission of a digital signature or an e-mail accompanied by a PIN or password will be required “only for those activities that pose the greatest risks to the safety and privacy of children,” the commission said.

Such activities include disclosing the child’s personal information to third parties or making it publicly available through chat rooms or other online activities.

For internal use of that information, such as to market to the child based on the child’s personal information, operators can obtain parental consent by sending a confirmation e-mail or regular mail letter to the parent or call the parent on the telephone.

“After two years, more reliable methods would be required for all uses of information, unless the Commission determines more secure electronic methods of consent are not widely available,” the FTC said.

No consent is required for a company to respond to a child’sone-time request for “homework help” or other information, the commission said. A child can enter an online contest or subscribe to an online newsletter as long as the parent is given notice and an opportunity to prevent further use of the child’s information. In addition, schools can act as the parents’ agents to give notice and consent.

Congressional Intent

As a politically appointed body, the commission was also careful to note the rules clearly follow Congress’ original intent in passing the Child Online Privacy and Protection Act. However, given the public support that major online merchants and Internet companies voiced throughout the legislative process for the implementation of better child privacy protections, the law and the FTC’s implementation rules are not expected to see many challenges.

The FTC conducted a three-year study of the issues raised by the online collection of personal information from children and adult consumers before Congress passed the law. In a survey of online merchants during that period, the commission found that only 24 percent of sites that collected personal information from children posted privacy policies. Only one percent required parental consent for collection and disclosure of that information.

As part of that effort, the FTC launched a public education campaign to raise awareness of, and support for, the new rules.