Children's Online Privacy Protection Act of 1998

Student: Alishka Long-Nelson
BUS 630 - Business Law and Ethics in a Digital Age
Instructor: Professor Timothy W. Reinig

Abstract: This paper focuses on the Children's Online Privacy Protection Act which was set in place to hinder websites from collecting identifying information from children under the age of 13. This paper will examine the Act, the need to have such an Act and will also seek to identify any loopholes in the Act and possible solutions to address these loopholes.

I. Introduction The Children's Online Privacy Protection Act of 1998, and effective in 2000, applies to the collection of personal information from any child under the age of 13 on the internet. The Act dictates requirements in an online Privacy Policy, the requirements of seeking parental consent and how to go about it, and also includes operator responsibilities of protecting those under the age of 13 with regard to their privacy online.

II. Content A . Purpose of the Act and a Brief History. In today's age, many minors are comfortable using computers and the internet and recent studies show that 90% of children over the age of three use computers and almost 60% use the internet. Because they are so apt at using the equipment, they increasingly do not need to be int he company of an adult and can now go online at school, libraries, internet cafes, or at the home of a friend or relative. Minors under the age of 13 are a highly sought-after market for many companies and as such, are a highly marketed segment of the consumer population. Using websites designed to attract this audience, it was common practice to target these minors for marketing purposes. The Act was a direct response to the marketing techniques employed by websites using personal information collected from children under the age of 13. these techniques included using cartoon or other television show characters, prizes, etc to encourage children to submit personal information. In the mid-1990s, the Federal Trade Commission conducted studies which revealed that commercial websites aimed at children were collecting personal information and using that information to target the minors with advertising. In response, Congress passed the Children's Online Privacy Protection Act (COPPA) in 1998 and which took effect in 2000. The law was intended to give parents control over the information collected from their children online and how the information is used and shared. Personal information applies to individually identifiable information such as a full name, home address, e-mail address, telephone number, Social Security number and/or any other information that would allow someone to identify or contact a child. Individually identifiable information also includes hobbies, interests and information collected through cookies or tracking mechanisms on the computer which can be tied to identifiable information.
Under the Act, Operators covered must: 1. Post a clear and comprehensive privacy policy on their website describing their information practices for children’s personal information; 2. Provide direct notice to parents and obtain verifiable parental consent, with limited exceptions, before collecting personal information from children; 3. Give parents the choice of consenting to the operator’s collection and internal use of a child’s information, but prohibiting the operator from disclosing that information to third parties; 4. Provide parents access to their child’s personal information to review and/or have the information deleted; 5. Give parents the opportunity to prevent further use or online collection of a child’s personal information; 6. Maintain the confidentiality, security, and integrity of information they collect from children.

B .Compliance According to COPPA. org, anyone who operates a commercial Website or an online service directed to children under 13 that collects personal information from children or if you operate a general audience Website and have actual knowledge that the information provided is from someone under the age of 13, then you must comply with COPPA.

• To determine whether a Web site is directed to children, the FTC considers several factors, including the subject matter; visual or audio content; the age of models on the site; language; whether advertising on the Web site is directed to children; information regarding the age of the actual or intended audience; and whether a site uses animated characters or other child-oriented features. • To determine whether an entity is an "operator" with respect to information collected at a site, the FTC will consider who owns and controls the information; who pays for the collection and maintenance of the information; what the pre-existing contractual relationships are in connection with the information; and what role the Web site plays in collecting or maintaining the information. Provisions of the Act ▪ Post a clearly written privacy policy with links to the notice provided on the home page and at each area where ▪ the site or online service collects personal information from children. ▪ Describe the kinds of information collected from children, for example, name, address, e-mail address, hobbies, and age. (Note: This requirement applies to all information, not just “personal information.”) ▪ Explain how the information is collected – whether directly from the child and/or behind the scenes through ”cookies.” (explained below) ▪ Explain how the web site operator uses the personal information, such as marketing to the child or notifying contest participants, and whether it is disclosed to third parties. ▪ Provide parents with contact information – address, phone number, and e-mail address – for all operators collecting or maintaining children’s personal information. ▪ Obtain parental consent before collecting, using, or disclosing personal information about a child. ▪ Provide parents with the ability to review, correct, and delete information about their children collected by such services. ▪ Maintain reasonable procedures “to protect the confidentiality, security, and integrity of personal information collected from children.”

▪ Websites also cannot require a child to provide personal information as a condition of participating in online contests, games and activities when it is not necessary. Website operators can only collect personal information that is "reasonably necessary" for an online activity.
Placement
An operator must post a link to a notice of its information practices on the home page of its Web site or online service and at each area where it collects personal information from children. An operator of a general audience site with a separate children's area must post a link to its notice on the home page of the children's area.
The link to the privacy notice must be clear and prominent. Operators may want to use a larger font size or a different color type on a contrasting background to make it stand out. A link in small print at the bottom of the page -- or a link that is indistinguishable from other links on your site -- is not considered clear and prominent.|

Covered entities. Any commercial Website or online service directed to children (under 13) that collects personal information from these children or any general audience Website that operates and has knowledge that they are collecting personal information from an individual under the age of 13 must comply with the Act.

C. Safe Harbor
Industry groups or others can create self-regulatory programs to govern participants' compliance with COPPA. These guidelines must include independent monitoring and disciplinary procedures and must be submitted to the Commission for approval. The Commission will publish the guidelines and seek public comment in considering whether to approve the guidelines. An operator's compliance with Commission-approved self-regulatory guidelines will generally serve as a "safe harbor" in any enforcement action for violations of the Rule. To be entitled for a safe harbor treatment, the proposed guidelines must contain requirements that are substantially similar to COPPA, a mechanism for evaluation of the operators' compliance with the guidelines, and incentives for compliance. Suggested mechanisms to determine compliance include periodic and random reviews of operators' practices, periodic industry or independent reviews of practices of all subject operators, and comprehensive information practices reviews as a condition of membership in self-regulatory programs.

▪ Business opportunities created
- Truste
According to its website, has become a "trusted Advisor to thousands of businesses worldwide. Clients include Apple, Facebook, Best Buy, eBay and many more. - ESRB Entertainment Software Rating Board assigns age and content ratings, enforces industry-adopted advertising guidelines and ensures responsible online private principles for computer and video games. - Privo Inc. Privo claims to be the first and only infomediary service to be recognized by the Federal Trade Commission. The Privo Privacy Assurance Program was approved as a Safe harbor provider under COPPA. D. Difficulties Enforcing the Act and Criticisms of the Act
How to enforce the act
The Commission may bring enforcement actions and impose civil penalties for violations of the Rule in the same manner as for other Rules under the FTC Act. The Commission also retains authority under Section 5 of the FTC Act to examine information practices for deception and unfairness, including those in use before the Rule's effective date. In interpreting Section 5 of the FTC Act, the Commission has determined that a representation, omission or practice is deceptive if it is likely to: ▪ mislead consumers; and ▪ affect consumers' behavior or decisions about the product or service.

It is, however, difficult to enforce the Act since it relies on the Commission monitoring the Internet for Compliance issues and brings law enforcement actions when appropriate. The Commission also relies on parents, consumer groups, industry members, safe harbor programs and other members of the public to submit complaints or provide information about website operators who may not be in compliance with the Act.
|
New technologies - Mobile and Social Networking services. - Mobile Application As mobile users get younger and parents supply their children with mobile phones, new applications with GPS technology or applications that collect personal information in order to customize themselves with the user become more popular and more frequently accessed. This leads to concerns about COPPA's ability to stay ahead of these new technologies and be effective in protecting those under 13 who may use these applications. - Social Networking Sites With the popularity of sites like Facebook, more and more teenagers and those younger than 13 are seeking ways to connect with family and friends who are members of the website. While joining Facebook under the age of 13 is prohibited by the website, studies show that increasingly, parents are allowing their children to lie about their age in order to join the website.

▪ School information systems and their loopholes Many school districts contract with third-party website operators to offer online programs solely for the benefit of their students and for the school system, e.g., homework help lines or web-based testing services. COPPA does not apply to the website operator’s collection of personal information from participating children where a school has contracted with an operator to collect personal information from students for the use and benefit of the school, and for no other commercial purpose. Thus, the operator is not required to obtain consent directly from parents, and can presume that the school’s authorization for the collection of students’ personal information is based upon the school having obtained the parents’ consent. The operator should, however, provide the school with full notice of its collection, use, and disclosure practices, so that the school may inform parents of these practices in its Acceptable Use Policy.

Trusting the integrity of sites/companies designed to protect - Echometrix - Echometrix is the developer of parental control software that monitors children’s online activity. Echometrix analyzes the information collected from children and sells the data to third parties for market-intelligence research. The complaint alleges that Echometrix engages in unfair and deceptive trade practices by representing that the software protects children online while simultaneously collecting and disclosing information about children's online activity. In 2010, Echometrix agreed to pay $100,000 to settle charges by the New York State Attorney General that it was selling the data obtained from its software that was designed to allow parents to monitor their children's online activities. The firm was charged with violating state deceptive-practices and false-advertising law.

Criticism of the Act - System based on trust. COPPA is based on a system of trust. Websites and parents must trust that children using the internet do not lie about their age. Unfortunately, there is no way to prevent this. Parents and the government must trust that websites who identify a user under the age of 13, dispose of any personal information collected about that minor or terminate the relationship with that minor (by refusing to allow them to register or to enter without permission from a parent). - Based on website having actual knowledge of violating Act According to the wording of the Act, a website must have actual knowledge of violating the Act. If not, they cannot be held responsible. This is likely a loophole that can be exploited by transferring liability to a third-party contractor or by claiming ignorance to one's own actions. - Parents can give consent and then that information be sold When a parent gives consent for a minor to register on a website, this gives express consent to the Website that personal information can be collected on that minor and that information can be sold, leading to that minor becoming individually identifiable and easily targeted by marketing agents. - Applies only to children under the age of 13 but needs to be extended to teenagers. It has been argued that COPPA should be extended to children up to the age of 18 since turning 13 does not mean that a person understands what constitutes violating a person's privacy and it is still important to protect children up to the age of 18. This extension has been fought by many companies, however, and it yet to be implemented or put into law. Cases for violation of the Act - Skid-e-kids Skid-e-kids is a social networking site that allows children ages 7-14 to create profiles, upload pictures and videos, and become friends with and send messages to other members. The Federal Trade Commission settled a complaint against the website Skid-e-kids after the operator violated both the Commission’s Children's Online Privacy Protection Act Rule and the website's own privacy policy by collecting personal information from approximately 5,600 children without obtaining prior parental consent.

- Sony BMG Music Sony BMG Music Entertainment agreed to pay $1 million as part of a settlement to resolve FTC charges that it violated the COPPA Act. On 196 of its 1,000+ Websites, Sony Music knowingly collected personal information from at least 30,000 underage children without their parental consent. Many of the websites allowed children to create personal fan pages, review artists' albums, upload photos, post comments on message boards and forums and engage in private messaging. The complaint claimed that Sony Music failed to provide sufficient notice on its Websites about what information was being collected, how it used the information and its disclosure practices. - W3 Innovations W3 Innovations, a company that develops mobile phone games, settled charges with the Federal Trade Commission for violations of the Children's Online Privacy Protection Act (COPPA). In the first settlement concerning a mobile application, the Commission imposed a fine of $50,000 against the company for "illegally collecting and disclosing personal information from tens of thousands of children under age 13 without their parents prior consent."

- Playdom Inc Playdom has agreed to pay $3 million to settle charges that it violated COPPA. The virtual game company failed to obtain notice and consent from parents before the collection and use of children's information.

III. Conclusion

The Act was created to protect those under the age of 13 from being identified and then targeted through marketing communications. While there has been enforcement of said Act, there are many loopholes to the Act, difficulties with enforcing it and a need to extend the reach of the Act. Overall, the information provided is meant to serve as a warning to parents about the importance of monitoring our children's online activities and about the need to give consent to registration to Websites and as parents, to understand what that consent means and the consequences of giving that consent to the privacy of our children.

References: http://epic.org/privacy/kids/ http://www.coppa.org/comply.htm http://business.ftc.gov/legal-resources/30/35 http://www.ftc.gov/privacy/coppafaqs.shtm
Legal Aspects of Managing Technology, 5th Ed, Lee B. Burgunder http://onguardonline.gov/articles/0031-kids’-privacy http://www.mediapost.com/publications/article/161679/report-coppa-turns-parents-into-scofflaws.html http://thehill.com/blogs/hillicon-valley/technology/95085-industry-lawmakers-clash-over-robust-changes-to-coppa http://www.privacyrights.org/fs/fs21-children.htm http://blogs.wsj.com/digits/2010/09/17/understanding-the-childrens-online-privacy-protection-act/ http://business.ftc.gov/documents/bus45-how-comply-childrens-online-privacy-protection-rule
http://www.ftc.gov/privacy/coppafaqs.shtm#enforce