COPPA: Sliding Scale

The Federal Trade Commission is seeking public comment on its implementation of the Children’s Online Privacy Protection Act (COPPA) through the Children’s Online Privacy Protection Rule. The FTC also is seeking additional comment on the COPPA Rule’s sliding scale approach to obtaining parental consent, which takes into account how information gathered from children will be used.

COPPA Rule Review

As COPPA requires, the FTC is conducting a review of the COPPA Rule five years after its effective date and is seeking public comment on its implementation of COPPA through the Rule. The Rule imposes certain requirements on operators of Web sites or online services directed to children under 13 years old and other Web sites or online services that have actual knowledge that they are collecting personal information from a child under 13 years old. The Commission requests comment on the costs and benefits of the Rule as well as on whether it should be retained, eliminated, or modified.

Public comment will be accepted on all aspects of the Rule during the 60-day comment period. In addition, the agency is specifically seeking comments on the Rule’s effect on:

• Practices relating to the collection and disclosure of information relating to children;
• Children’s ability to obtain access to information of their choice online; and
• The availability of Web sites directed to children.

The agency also is seeking comments on four additional issues on which public comment would be especially useful:

• To determine whether a Web site is directed to children, the Commission considers factors such as the subject matter of the site, visual or audio content, age of models, language used, and target audience of advertising or marketing materials. The Commission is seeking comment on whether these factors should be clarified or supplemented.
• The Rule applies to general audience Web site operators who have “actual knowledge” that they are collecting personal information from children under the age of 13. Some general audience Web sites collect age and refuse to allow children to participate while informing them that they must be 13 or older to participate. The operators then allow children to “back-button” or return to the entry screen and enter an older age. The Commission seeks comment on whether the term “actual knowledge” is sufficiently clear and whether Web site operators are encouraging children to back-button and change their age.
• Because some companies now market debit cards to children, the Commission seeks comment on the use of credit cards as a means of obtaining verifiable parental consent.
• The Commission also seeks comment on the COPPA safe harbor program. The Commission has approved four safe harbor programs, and the agency is interested in feedback on the effectiveness of these types of programs.

The Commission will report to Congress on the results of this review of the COPPA Rule, as well as commence rulemaking proceedings, if warranted, in response to the comments received.

Sliding Scale

The FTC also announced its decision to seek additional comment on the COPPA Rule’s sliding scale mechanism for obtaining verifiable parental consent. The sliding scale offers a flexible approach to obtaining parental consent before collecting personal information from children. Operators of Web sites and online services that collect children’s personal information solely for internal use can obtain parental consent through the use of an e-mail to the parent plus an additional step to provide assurance that the person providing the consent is actually the parent. Operators that wish to disclose children’s information publicly or to third parties must employ more reliable methods of obtaining parental consent, such as using a print-and-send consent form; a credit card transaction; a toll-free telephone number staffed by trained personnel; a digital certificate using public key technology; or an e-mail with a password or PIN obtained by one of the above methods.

The Commission adopted the sliding scale approach for parental consent when it issued the Rule in 1999. At that time, the agency anticipated that more sophisticated, reliable, and cost-efficient technology for obtaining parental consent would soon become available, so the sliding scale approach was set to expire in 2002. In 2002, the Commission extended the sliding scale approach until April 21, 2005, because such technology was still not available.

In January 2005, the Commission sought public comment on whether to sunset the sliding scale as scheduled on April 21, 2005. Following the public comment period, the Commission has determined that it would be useful to seek additional comment on this issue in the context of the larger rule review process. Accordingly, the Commission is extending the sliding scale approach. Persons who previously filed comments on the sliding scale issue need not do so again; the Commission will reconsider previously submitted comments along with any newly submitted comments.

Public Notice

Written comments should refer to "COPPA Rule Review 2005, P054505" both in the text and on the envelope, and should be mailed or delivered to the following address: Federal Trade Commission/Office of the Secretary, Room H-159 (Annex C), 600 Pennsylvania Avenue, N.W., Washington, DC 20580. Comments containing any material for which confidential treatment is requested must be filed in paper form, and the first page of the document must clearly be labeled “Confidential.” The FTC is requesting that any comment filed in paper form be sent by courier or overnight service, if possible, because U.S. mail in the Washington area and at the Commission is subject to delay due to heightened security precautions. Comments also may be sent electronically by using the Web-based form at the following Web link: Comments must be received by June 27, 2005.

The Federal Trade Commission is seeking public comment on a proposal to amend the Children’s Online Privacy Protection Act Rule to make permanent a temporary provision in the Rule allowing operators of Web sites and online services that collect personal information from children only for internal use to obtain verifiable parental consent via e-mail.

The Rule currently contains a “sliding scale” approach for obtaining parental consent. Operators of Web sites and online services that collect children’s personal information solely for internal use can obtain parental consent through the use of an e-mail plus an additional step to provide assurance that the person providing the consent actually is the parent. Operators that wish to disclose children’s information publicly or to third parties must employ more reliable methods of obtaining parental consent, such as using a print-and-send consent form; a credit card transaction; a toll-free telephone number staffed by trained personnel; a digital certificate using public key technology; or an e-mail with a password or PIN obtained by one of the above methods.

The Commission adopted the sliding scale approach for parental consent when it issued the Rule in 1999. At that time, the agency anticipated that more sophisticated, reliable, and cost-efficient technology for obtaining parental consent would become available soon, so the sliding scale approach was set to expire in 2002. In 2002, the Commission extended the sliding scale approach until April 21, 2005, because such technology was not yet available. At this time, the Commission believes that the expected technological progress still has not occurred, and therefore proposes that the Rule be amended to make permanent the sliding scale approach.

The FTC is seeking comments concerning whether: (1) current or anticipated reliable technology or infomediary services could facilitate obtaining verifiable parental consent at a reasonable cost; (2) eliminating, extending, or making permanent the sliding scale approach would affect the incentive to develop secure technology for the purpose of obtaining parental consent; (3) eliminating the sliding scale approach would have an effect on how Web site operators would use personal information collected from children; and (4) the sliding scale approach should be eliminated, extended, or made permanent.

Comments may be filed electronically using the Web-based form available at https://secure.commentworks.com/ftcslidingscale/. Written comments should refer to “Sliding Scale 2005, Project No. P054503” on both the text and the envelope, and should be sent or delivered to: Federal Trade Commission/Office of the Secretary, Room H-159 (Annex Y), 600 Pennsylvania Avenue, N.W., Washington, DC 20580. Comments containing confidential information must be filed in paper form. Comments must be received by February 14, 2005.

Fed Reg Notice

Press Release Jan 12, 2005

COPPA Souvenirs

The Children's Online Privacy Protection Rule applies to operators of commercial Web sites and online services directed to children under the age of 13, and to general audience Web sites and online services that knowingly collect personal information from children under 13. Among other things, the Rule requires that Web sites get verifiable consent from a parent or guardian before they collect personal information from children.

The Rule uses a sliding scale approach for obtaining verifiable parental consent, which depends upon the reason the personal information is collected. If a Web site is collecting personal information solely for its internal use, and is not disclosing the information to the public or third parties, the Rule allows the site to obtain parental consent through the use of an e-mail message from the parent, coupled with additional steps. If the Web site is going to disclose the personal information to the public or third parties, the Rule requires that the Web site use more reliable methods to obtain the parent's consent. This sliding scale mechanism is set to expire on April 21, 2002, at which time Web sites must obtain verifiable parental consent using the more reliable methods for all uses of personal information.

When it issued the final Rule, the Commission anticipated that the sliding scale was necessary only in the short term because the more reliable methods of obtaining verifiable parental consent would soon be widely available and affordable. Now it appears that the expected progress in available technology has not yet occurred. The Commission proposes to amend the Rule to extend the sliding scale mechanism for an additional two years.

The Commission seeks comment on several questions, including the current and anticipated availability and affordability of secure electronic mechanisms and/or infomediary services for obtaining parental consent. The Commission also seeks comment on the length of the proposed extension and the negative impact, if any, of extending the sliding scale mechanism.
 

Public Notice