05-8159. Children's Online Privacy Protection Rule

AGENCY:

Federal Trade Commission.

ACTION:

Final rule amendment.

SUMMARY:

The Federal Trade Commission (“the Commission”) issues a final amendment to the Children's Online Privacy Protection Rule (“the Rule”), to extend the sliding scale mechanism which allows Web site operators to use e-mail, coupled with additional steps, to obtain verifiable parental consent for the collection of personal information from children for internal use by the Web site operator, until the conclusion of the Commission's proceeding to undertake a comprehensive review of the Rule. As explained in a separate document being published elsewhere in this issue of the Federal Register, the Commission is requesting additional comment on the sliding scale mechanism.

DATES:

Effective April 21, 2005.

ADDRESSES:

Requests for copies of the amended Rule and the Statement of Basis and Purpose should be sent to: Public Reference Branch, Federal Trade Commission, Room H-130, 600 Pennsylvania Avenue, NW., Washington, DC 20580.

FOR FURTHER INFORMATION CONTACT:

Karen Muoio, [phone], or Rona Kelner, [phone], Federal Trade Commission, 600 Pennsylvania Avenue, NW., Mail Drop NJ-3212, Washington, DC 20580.

Statement of Basis and Purpose

I. Introduction

As part of the effort to protect children's online privacy, Congress enacted the Children's Online Privacy Protection Act of 1998 (“COPPA”), 15 U.S.C. 6501-6508, to prohibit unfair or deceptive acts or practices in connection with the collection, use, or disclosure of personally identifiable information from children on the Internet. On October 20, 1999, the Commission issued its final Rule implementing COPPA, which became effective on April 21, 2000.^[1] The Rule imposes certain requirements on operators of Web sites or online services directed to children under 13 years of age, and on operators of other Web sites or online services that have actual knowledge that they are collecting information from a child under 13 years of age. Among other things, the Rule requires that Web site operators obtain verifiable parental consent prior to collecting, using, or disclosing personal information from children under 13 years of age.

The Rule provides that “[a]ny method to obtain verifiable parental consent must be reasonably calculated, in light of available technology, to ensure that the person providing consent is the child's parent.” ^[2] Prior to issuing the Rule, the Commission studied extensively the state of available parental consent technologies.^[3] In July 1999, the Commission held a workshop on parental consent, which revealed that more reliable electronic methods of verification were not widely available and affordable.^[4] In making its initial determination to adopt the sliding scale mechanism in 1999, the Commission balanced the costs imposed by the method of obtaining parental consent and the risks associated with the intended uses of information.^[5] Because of the limited availability and affordability of the more reliable methods of obtaining consent—including electronic methods of verification—the Commission found that these methods should only be required when obtaining consent for uses of information that posed the greatest risks to children.^[6] Accordingly, the Commission implemented the sliding scale, noting that it would “provide[] operators with cost-effective options until more reliable electronic methods became available and affordable, while providing parents with the means to protect their children.” ^[7]

Therefore, the Rule sets forth a sliding scale approach to obtaining verifiable parental consent. If the Web site operator is collecting personal information for its internal use only, the Rule allows verifiable parental consent to be obtained through the use of an e-mail message to the parent, coupled with additional steps to provide assurances that the person providing the consent is, in fact, the parent. Such additional steps include: sending a delayed confirmatory e-mail to the parent after receiving consent or obtaining a postal address or telephone number from the parent and confirming the parent's consent by letter or telephone call.^[8]

In contrast, for uses of personal information that involve disclosing the information to the public or third parties, the Rule requires that Web site operators use more reliable methods of obtaining verifiable parental consent. These methods include: using a print-and-send form that can be faxed or mailed back to the Web site operator; requiring a parent to use a credit card in connection with a transaction; having a parent call a toll-free telephone number staffed by trained personnel; using a digital certificate that uses public key technology; and using e-mail accompanied by a PIN or password obtained through one of the above methods.^[9] As noted in the Rule's Statement of Basis and Purpose, “the record shows that disclosures to third parties are among the most sensitive and potentially risky uses of children's personal information.” ^[10]

At the time it issued the Rule, the Commission anticipated that the sliding scale was necessary only in the short term because more reliable methods of obtaining verifiable parental consent would soon be widely available and affordable.^[11] Accordingly, the sliding scale was originally set to expire on April 21, 2002, two years after the Rule went into effect.^[12] However, when public comment revealed that the expected progress in available technology had not occurred, the Commission in 2002 extended the sliding scale for an additional three years until April 21, 2005.^[13]

With the sliding scale mechanism scheduled to sunset this year, the Commission again undertook a review of the sliding scale. On January 14, 2005, the Commission published a Notice of Proposed Rulemaking and Request for Public Comment in the Federal Register proposing to make the sliding scale mechanism for obtaining parental consent a permanent feature of the Rule.^[14] The Commission noted that the expected progress in available technology still does not appear to have transpired. The Commission requested public comment on the proposed amendment. It also posed several questions regarding: (1) The current and anticipated availability and affordability of more secure electronic mechanisms or infomediaries for obtaining parental consent; (2) the effect of the sliding scale mechanism on the incentive to develop and deploy more secure electronic mechanisms; (3) the effect of the sliding scale on operators' incentives to disclose children's personal information to third parties or the public; and (4) any evidence the sliding scale is being misused or not working effectively.

The public comment period closed on February 14, 2005. The Commission received a total of 91 comments.^[15] Those submitting comments included: FTC-approved COPPA safe harbor programs; companies operating Web sites or Internet-related businesses; marketing, advertising, media, Internet-related, and other trade groups; privacy-related organizations; credit unions; educational organizations; and consumers.

The comments evidence public interest in the effectiveness of and need for the sliding scale. The Commission therefore has decided it would be beneficial to accept additional comments during the regulatory review comment period and to extend the sliding scale until it completes its review of the full Rule.

II. Regulatory Flexibility Act

The Regulatory Flexibility Act (“RFA”), 5 U.S.C. 601-612, requires that the Commission provide an Initial Regulatory Flexibility Analysis (“IRFA”) with a proposed rule and a Final Regulatory Flexibility Analysis (“FRFA”), if any, with the final rule, unless the Commission certifies that the rule will not have a significant economic impact on a substantial number of small entities.^[16]

The Commission hereby certifies that the final Rule amendment will not have a significant impact on a substantial number of small business entities. The final Rule amendment extends a sliding scale mechanism that is already in place. The final Rule amendment does not alter the status quo, and postpones the potential economic impact, if any, of the expiration of the sliding scale mechanism. Thus, the economic impact of the amendment to the Rule is expected to be comparatively minimal.

Accordingly, this document serves as notice to the Small Business Administration of the agency's certification of no effect. Nonetheless, the Commission has decided to publish a Final Regulatory Flexibility Analysis with this final Rule amendment.

Therefore, the Commission has prepared the following analysis:

A. Need for and Objectives of the Rule Amendment

The Rule's sliding scale mechanism for obtaining parental consent is scheduled to expire on April 21, 2005. At the time it issued the final Rule, the Commission anticipated that the sliding scale was necessary only in the short term because more reliable electronic methods of obtaining verifiable parental consent would soon be widely available at a reasonable cost. The existing record indicates that there is public interest in the effectiveness of and need for the sliding scale. Therefore, the Commission is amending the Rule to extend the sliding scale mechanism for obtaining verifiable parental consent to solicit additional data, if any are available, in the larger context of the Rule's overall effectiveness.

B. Significant Issues Raised by Public Comment, Summary of the Agency's Assessment of These Issues, and Changes, if Any, Made in Response to Such Comments

The Commission received few comments in response to its IRFA. These commenters noted that the amendment to make permanent the sliding scale mechanism for obtaining verifiable parental consent would be beneficial to small businesses.^[17] The sliding scale allows commercial operators of Web sites and online services who collect personal information from children for internal uses only to obtain verifiable parental consent through the use of e-mail, coupled with additional steps, instead of having to use the more reliable (and more costly) methods required when information will be disclosed to third parties or the public. Commenters noted that small businesses benefit by having this cost-effective option.^[18] Commenters also noted that allowing the sliding scale to sunset after companies have made investments to implement this mechanism would pose financial burdens and have negative consequences that would especially harm small businesses.^[19] The Commission agrees that continuing the use of the sliding scale mechanism may be beneficial to small businesses.

C. Description and Estimate of Number of Small Entities Subject to the Rule Amendment or Explanation of Why No Estimate Is Available

As described above, the Rule amendment applies to any commercial operator of a Web site or online service, including operators who are small entities, who collects personal information from children for internal uses only. The Commission is unable to ascertain a precise estimate of the number of small entities that are affected by the amendment and received no specific comments to the IRFA that allow it to estimate the number of small entities that will be affected.

D. Description of the Projected Reporting, Recordkeeping, and Other Compliance Requirements of the Rule Amendment, Including an Estimate of the Classes of Small Entities That Will Be Subject to the Rule Amendment and the Type of Professional Skills That Will Be Necessary To Comply

The Rule does not directly impose any “reporting” or “recordkeeping” requirements within the meaning of the Paperwork Reduction Act, but does require that operators make certain third-party disclosures to the public, i.e., provide parents with notice of their information practices. The final Rule amendment to extend the sliding scale mechanism for obtaining parental consent does not impose any additional reporting or recordkeeping requirements. The Rule does contain certain compliance requirements, including the requirement to obtain verifiable parental consent to collect personal information from children. This obligation does not require operators to file reports or maintain records within the meaning of the Paperwork Reduction Act, although the Commission recognizes that there are potential compliance costs associated with this requirement. For example, an employee may be needed to review parental responses to the operator's requests for consent. The Commission has not previously determined the estimated costs of complying with this obligation in terms of burden hours, and did not receive any quantitative data in this rulemaking to determine what these costs might be. Importantly, however, the final Rule amendment does not impose any additional compliance costs, as it is merely extending a sliding scale mechanism that has been in place since the Rule went into effect. If anything, the final Rule amendment may reduce costs of complying because it allows qualified Web site operators, including small entities, to obtain parental consent through lower-cost e-mail-based means.

E. Steps the Agency Has Taken To Minimize Any Significant Economic Impact on Small Entities, Consistent With the Stated Objectives of the Applicable Statutes, Including the Factual, Policy, and Legal Reasons for Selecting the Alternative(s) Finally Adopted, and Why Each of the Significant Alternatives, If Any, Was Rejected

The Commission has determined that the Rule amendment, which maintains the status quo, will not have a significant economic impact on small entities. If anything, the final Rule amendment benefits small entities in that it continues to permit qualified Web site operators, including small entities, to obtain parental consent through lower-cost e-mail-based means. One alternative to the final Rule amendment that was considered and rejected was allowing the sliding scale mechanism to sunset as scheduled on April 21, 2005. This alternative likely would be more burdensome for small entities. If the sliding scale were to expire on April 21, 2005, small businesses currently using this mechanism would have to revise their parental consent procedures to adopt one of the more costly means of obtaining parental consent—such as using a print and send form, processing a credit card transaction, or using a toll-free telephone number staffed by trained personnel—or cease their online offerings to children altogether. Accordingly, the Commission has determined that extending the sliding scale pending further review is appropriate.

Therefore, to the extent that small entities are affected by the Rule amendment, the Commission believes the public comments support its determination that the adoption of the Rule amendment will not impose more significant or costly compliance requirements on Web site operators than the Rule would otherwise impose if it were not amended. By adopting a final Rule amendment that extends currently effective compliance options, the Commission is preserving the status quo for all Web site operators, including any small entities, until the Commission completes its review of the full Rule. Thus, the change, if any, in the economic impact of the Rule resulting from the final Rule amendment, will be less than if the Commission did not amend the Rule and the more burdensome requirements of the Rule as originally promulgated were allowed to take effect. Accordingly, for these reasons, the Commission certifies under the Regulatory Flexibility Act that the final Rule amendment will not have a significant economic impact on a substantial number of small entities.^[20] This notice also serves as the required certification and statement of the Commission's determination to the Small Business Administration.

III. Paperwork Reduction Act

This final Rule amendment does not change any information collection requirements that have previously been reviewed and approved by the Office of Management and Budget pursuant to the Paperwork Reduction Act, as amended.^[21]

Final Rule

List of Subjects in 16 CFR Part 312

• Children
• Communications
• Consumer protection
• Electronic mail
• E-mail
• Internet
• Online service
• Privacy
• Record retention
• Safety
• Science and technology
• Trade practices
• Web site
• Youth

Accordingly, the Federal Trade Commission amends 16 CFR part 312 as follows:

PART 312—CHILDREN'S ONLINE PRIVACY PROTECTION RULE

1. Revise the authority citation for part 312 to read as follows:

Authority: 15 U.S.C. 6501-6508.

2. Amend § 312.5 by revising the second sentence of paragraph (b)(2) to read as follows:

§ 312.5

Parental consent.

* * * * *

(b) * * *

(2) * * * Provided that: Until the Commission otherwise determines, methods to obtain verifiable parental consent for uses of information other than the “disclosures” defined by § 312.2 may also include use of e-mail coupled with additional steps to provide assurances that the person providing the consent is the parent. * * *

* * * * *

By direction of the Commission, Commissioner Leibowitz not participating.

Donald S. Clark,

Secretary.

Footnotes

1.  64 FR 59888 (1999).

2.  16 CFR 312.5(b)(1).

3.  See, e.g., public comments received on the initial 1999 rulemaking, available on the FTC's Web site at http://www.ftc.gov/​privacy/​comments/​index.html.

4.  See press release announcing workshop and transcript of workshop, available on the FTC's Web site at http://www.ftc.gov/​opa/​1999/​06/​kidswork.htm and http://www.ftc.gov/​privacy/​chonlpritranscript.pdf.

5.  64 FR 59901, 59902 (1999).

6.  Id.

7.  Id. at 59902.

8.  Id.

9.  16 CFR 312.5(b)(2).

10.  64 FR 59899 (1999).

11.  64 FR 59902 (1999).

12.  16 CFR 312.5(b)(2).

13.  67 FR 18818 (2002).

14.  70 FR 2580 (2005).

15.  A list of the commenters and their comments appear on the FTC's Web site at http://www.ftc.gov/​os/​publiccomments.htm.

16.  5 U.S.C. 603-605.

17.  Children's Advertising Review Unit (“CARU”) at 2; Mattel, Inc. at 1; Motion Picture Association of America (“MPAA”) at 3-4; Software and Information Industry Association (“SIIA”) at 3.

18.  CARU at 2; IT Law Group at 1; Mattel at 1.

19.  IT Law Group at 1; MPAA at 3-4; SIIA at 3.

20.  5 U.S.C. 605.

21.  44 U.S.C. 3501-3520.