01-27390. Children's Online Privacy Protection Rule

AGENCY:

Federal Trade Commission.

ACTION:

Notice of proposed rulemaking.

SUMMARY:

The Federal Trade Commission (“the Commission”) proposes amending the Children's Online Privacy Protection Rule (“the Rule”) to extend the time period during which website operators may use an e-mail message from the parent, coupled with additional steps, to obtain verifiable parent consent for the collection of personal information from children for internal use by the website operator. The Commission proposes to extend the time period from April 21, 2002 until April 21, 2004.

DATES:

Written comments will be accepted until November 30, 2001.

ADDRESSES:

Written comments should be submitted to: Secretary, Federal Trade Commission, Room H-159, 600 Pennsylvania Avenue, NW., Washington, DC 20580. The Commission requests that commenters submit the original plus five copies, if feasible. To enable prompt review and public access, comments also should be submitted, if possible, in electronic form, on a 31/2-inch computer disk, with a disk label stating the name of the commenter and the name and version of the word processing program used to create the document. (Programs based on DOS or Windows are preferred. Files from other operating systems should be submitted in ASCII text format.) Alternatively, the Commission will accept comments submitted to the following e-mail address [e-mail]. Individual members of the public filing comments need not submit multiple copies or comments in electronic form. All submissions should be captioned: “Children's Online Privacy Protection Rule Amendment—Comment, P994504.” Comments will be posted on the Commission's website: http://www.ftc.gov.

FOR FURTHER INFORMATION CONTACT:

Elizabeth Delaney, [phone], Mamie Kresses, [phone], or Kial Young, [phone], Division of Advertising Practices, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580.

SUPPLEMENTARY INFORMATION:

Section A. Background

As part of the effort to protect children's online privacy, Congress enacted the Children's Online Privacy Protection Act of 1998, 15 U.S.C. 6501 et seq. (“COPPA”), to prohibit unfair or deceptive acts or practices in connection with the collection, use, or disclosure of personally identifiable information from children on the Internet. On October 20, 1999, the Commission issued its final Rule implementing COPPA, which became effective on April 21, 2000.^[1] The Rule imposes certain requirements on operators of websites or online services directed to children under 13 years of age, or other websites or online services that have actual knowledge that they have collected information from a child under 13 years of age. Among other things, the Rule requires that website operators obtain verifiable parental consent prior to collecting, using, or disclosing personal information from children under 13 years of age.

Section B. Obtaining Verifiable Parent Consent

The Rule provides that, “[a]ny method to obtain verifiable parental consent must be reasonably calculated, in light of available technology, to ensure that the person providing consent is the child's parent.” ^[2] In order to allow time for reliable electronic methods of verification to become widely available and affordable, the Rule sets forth a sliding scale approach to obtaining verifiable parental consent. For uses of personal information that will involve disclosing the information to the public or third parties, the Rule requires that website operators use the more reliable methods of obtaining verifiable parental consent. These methods include: using a print-and-send form that can be faxed or mailed back to the website operator; requiring a parent to use a credit card in connection with a transaction; having a parent call a toll-free telephone number staffed by trained personnel; using a digital certificate that uses public key technology; and using e-mail accompanied by a PIN or password obtained through one of the above methods.^[3]

In contrast, if the website operator is collecting personal information for its internal use only, the Rule allows verifiable parental consent to be obtained through the use of an e-mail message from the parent, coupled with additional steps. Such additional steps are designed to provide assurances that the person providing the consent is the parent and include: sending a confirmatory e-mail to the parent after receiving consent; or obtaining a postal address or telephone number from the parent and confirming the parent's consent by letter or telephone call. The sliding scale is set to expire on April 21, 2002, at which time website operators must obtain verifiable parental consent using the more reliable methods for all uses of personal information.^[4]

At the time it issued the final Rule, the Commission anticipated that the sliding scale was necessary only in the short term because the more reliable methods of obtaining verifiable parental consent would soon be widely available and affordable.^[5] At the present time, however, it appears that the expected progress in available technology has not occurred. The Commission therefore proposes to amend the Rule to extend the sliding scale mechanism for an additional two years to April 21, 2004 and requests public comment on this proposed extension of time.

Section C. Invitation To Comment

Before adopting this amendment as final, the Commission will give consideration to any written comments submitted to the Secretary of the Commission on or before November 30, 2001. Comments submitted will be available for public inspection in accordance with the Freedom of Information Act (5 U.S.C. 552) and Commission regulations, on normal business days between the hours of 8:30 a.m. and 5 p.m. at the Public Reference Section, Room 130, Federal Trade Commission, 600 Pennsylvania Avenue NW., Washington, DC 20580. Comments will also be posted on the Commission website, http://www.ftc.gov.

Section D. Communications by Outside Parties to Commissioners or Their Advisors

Written communications and summaries or transcripts of oral communications respecting the merits of this proceeding from any outside party to any Commissioner or Commissioner's advisor will be placed on the public record. See 16 CFR 1.26(b)(5).

Section E. Regulatory Flexibility Act

The provision of the Regulatory Flexibility Act requiring an initial regulatory flexibility analysis (5 U.S.C. 605) does not apply because it is believed that the proposed amendment to the Rule will not have a significant economic impact on a substantial number of small entities (5 U.S.C. 605). This notice also serves as certification to the Small Business Administration of that determination.

The economic impact of the proposed amendment to the Rule is not anticipated to be significant because it is only extending, for a two-year period, a sliding scale mechanism that is already in place. The proposed amendment does not alter the status quo, and would postpone the potential economic impact, if any, of the expiration of the sliding scale mechanism. Thus, the economic impact of the amendment to the Rule is expected to be comparatively minimal.

Nonetheless, to ensure that no significant economic impact on a substantial number of small entities is overlooked, the Commission hereby requests public comment on the effect of the proposed amendment to the Rule on the costs, profitability, and competitiveness of, and employment in, small entities. After considering such comments, if any, the Commission will determine whether preparation of a final regulatory flexibility analysis (pursuant to 5 U.S.C. 605) is required.

Section F. Paperwork Reduction Act

This amendment would not amend any information collection requirements that have previously been reviewed and approved by the Office of Management and Budget pursuant to the Paperwork Reduction Act, as amended, 44 U.S.C. 3501 et seq.

Section G. Questions on the Proposed Amendment

Members of the public are invited to comment on any issues or concerns they believe are relevant or appropriate to the Commission's consideration of the proposed amendment to the Children's Online Privacy Protection Rule. The Commission proposes to extend the sliding scale mechanism for obtaining verifiable parental consent for two years until April 21, 2004. The Commission is particularly interested in comments addressing the following questions:

(1) Are secure electronic mechanisms now widely available to facilitate verifiable parental consent at a reasonable cost? Please include comments on the following:

(a) Digital signature technology;

(b) Digital certificate technology;

(c) Other digital credentialing technology;

(d) P3P technology; and

(e) Other secure electronic technologies.

(2) Are infomediary services now widely available to facilitate verifiable parental consent at a reasonable cost?

(3) Is this proposed extension an adequate amount of time considering the current development of secure electronic mechanisms and/or infomediary services for obtaining verifiable parental consent at a reasonable cost? Please include comments on the following:

(a) The anticipated availability of secure electronic mechanisms and/or infomediary services;

(b) The anticipated affordability of secure electronic mechanisms and/or infomediary services; and

(c) The likelihood and timeframe of consumer adoption of secure electronic mechanisms and/or infomediary services.

(4) Should the extension be longer than two years?

(5) Rather than be extended, should the sliding scale mechanism be kept in place indefinitely, until the development of secure electronic mechanisms and/or infomediary services become widely available to facilitate verifiable parental consent at a reasonable cost?

(6) What, if any, will be the negative impact of extending the time period for the sliding scale mechanism for obtaining verifiable parental consent? Please include comments on whether the extension will serve as a disincentive for industry to develop secure electronic mechanisms and/or infomediary services to facilitate verifiable parental consent at a reasonable cost.

List of Subjects in 16 CFR Part 312

• Children
• Communications
• Consumer protection
• Electronic mail
• E-mail
• Internet
• Online service
• Privacy
• Record retention
• Safety
• Science and technology
• Trade practices
• Website
• Youth

Accordingly, the Federal Trade Commission proposes to amend 16 CFR Part 312 as follows:

PART 312—CHILDREN'S ONLINE PRIVACY PROTECTION RULE

1. The authority citation for part 312 continues to read as follows:

Authority: 15 U.S.C. 6501 et seq.

2. Amend § 312.5 by revising the second sentence of paragraph (b)(2) to read as follows:

§ 312.5

Parental consent.

* * * * *

(b) * * *

(2) * * * Provided that: For the period until April 21, 2004, methods to obtain verifiable parental consent for uses of information other than the “disclosures” defined by § 312.2 may also include use of e-mail coupled with additional steps to provide assurances that the person providing the consent is the parent. * * *

* * * * *

By direction of the Commission.

Donald S. Clark,

Secretary.

Footnotes

1.  64 FR 59888 (1999).

2.  16 CFR 312.5(b)(1).

3.  16 CFR 312.5(b)(2).

4.  Id.

5.  64 FR 59902 (1999).