[Federal Register Volume 63, Number 161 (Thursday, August 20, 1998)]
[Notices]
[Pages 44624-44626]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 98-22444]
=======================================================================
-----------------------------------------------------------------------
FEDERAL TRADE COMMISSION
[File No. 982-3015]
GeoCities; Analysis to Aid Public Comment
AGENCY: Federal Trade Commission.
ACTION:Proposed Consent Agreement.
-----------------------------------------------------------------------
SUMMARY: The consent agreement in this matter settles alleged
violations of federal law prohibiting unfair or deceptive acts or
practices or unfair methods of competition. The attached Analysis to
Aid Public Comment describes both the allegations in the draft
complaint that accompanies the consent agreement and the terms of the
consent order--embodied in the consent agreement--that would settle
these allegations.
DATES: Comments must be received on or before October 19, 1998.
ADDRESSES: Comments should be directed to: FTC/Office of the Secretary,
Room 159, 6th St. and Pa. Ave., NW., Washington, DC 20580.
FOR FURTHER INFORMATION CONTACT: Lee Peeler or Joel Winston, FTC/S-
4002, Washington, DC 20580. (202) 326-3090 or 326-3153.
SUPPLEMENTARY INFORMATION: Pursuant to Section 6(f) of the Federal
Trade Commission Act, 38 Stat. 721, 15 U.S.C. 46 and Section 2.34 of
the Commission's Rules of Practice (16 CFR 2.34), notice is hereby
given that the above-captioned consent agreement containing a consent
order to cease and desist, having been filed with and accepted, subject
to final approval, by the Commission, has been placed on the public
record for a period of sixty (60) days. The following Analysis to Aid
Public Comment describes the terms of the consent agreement, and the
allegations in the complaint. An electronic copy of the full text of
the consent agreement package can be obtained from the FTC Home Page
(for August 13, 1998), on the World Wide Web, at ``http://www.ftc.gov/
os/actions97.htm.'' A paper copy can be obtained from the FTC Public
Reference Room, Room H-130, Sixth Street and Pennsylvania Avenue, N.W.,
Washington, DC 20580, either in person or by calling (202) 326-3627.
Public comment is invited. Such comments or views will be considered by
the Commission and will be available for inspection and copying at its
principal office in accordance with Section 4.9(b)(6)(ii) of the
Commission's Rules of Practice (16 CFR 4.9(b)(6)(ii)).
Analysis of Proposed Consent Order to Aid Public Comment
The Federal Trade Commission has accepted, subject to final
approval, an agreement containing a consent order from GeoCities, the
operator of a Web site on the World Wide Web (``Web''), located at
http://www.geocities.com.
The proposed consent order has been placed on the public record for
sixty (60) days for reception of comments by interested persons.
Comments received during this period will become part of the public
record. After sixty (60) days, the Commission will again review the
agreement and the comments received and will decide whether it should
withdraw from the agreement or make final the agreement's proposed
order.
The GeoCities Web site is a ``virtual community'' consisting of
members' personal home pages organized into 40 themed areas, called
``neighborhoods,'' One such neighborhood is the ``Enchanted Forest''
described as a ``community for and by kids.'' GeoCities provides
numerous services to its members, including free and fee-based personal
home pages, free e-mail service, contests, and children's clubs, among
other activities. Persons wishing to become a member of GeoCities must
complete an application form. The
[[Page 44625]]
application form requests certain mandatory personally identifiable
information about the applicant and certain other information it
designates as ``optional.'' The form also asks applicants to designate
whether they wish to receive specific ``special offers'' from
advertisers, and specific products or services from individual
companies.
The Commission's complaint in this matter alleges that GeoCities
engaged in three deceptive practices in connection with its collection
and use of personal identifying information from consumers. First, the
complaint alleges that GeoCities falsely represented that the personal
identifying information it collects through the membership application
form is used only to provide members the specific advertising offers
and products or services they request. In fact, according to the
complaint, that information has been sold, rented or otherwise
disclosed to third parties who have used it for purposes other than
those for which members have given permission.
Second, the complaint alleges that GeoCities falsely represented
that the ``optional information'' it collects through the application
form is not disclosed to third parties without the member's permission.
In fact, the complaint alleges, GeoCities has disclosed this
information to third parties who have used it to target advertising
back to the member.
The third allegation relates to two specific activities in the
Enchanted Forest neighborhood. GeoCities promotes the Official
GeoCities' GeoKidz Club; children wishing to join are required to
complete the Membership Request Form that solicits personal identifying
information. GeoCities also promotes certain Enchanted Forest contests;
children wishing to participate are required to complete an entry form
that solicits personal identifying information. The complaint alleges
that GeoCities has falsely represented that it collects and maintains
the children's personal identifying information collected through the
GeoKidz Club Membership Request Form and the Enchanted Forest Contest
Entry form. In fact, the Club and contest are run by third party
``community leaders'' hosted on the GeoCities Web site, and those third
parties actually collect and maintain the children's information.
Part I of the proposed order prohibits GeoCities from making any
misrepresentation about its collection or use of personal identifying
information from or about consumers, including what information will be
disclosed to third parties and how the information will be used. The
order defines ``personal identifying information'' as including but not
limited to, ``first and last name, home or other physical address (e.g.
school), e-mail address, telephone number, or any information that
identifies a specific individual, or any information which when tied to
the above becomes identifiable to a specific individual.''
Part II of the proposed order prohibits GeoCities from
misrepresenting either the identity of a party collecting any personal
identifying information or the sponsorship of any activity on its Web
site.
Part III prohibits GeoCities from collecting personal identifying
information from any child if GeoCities has actual knowledge that the
child does not have a parent's permission to provide the information.
The order defines ``child'' as ages twelve and under.
Parts IV and V of the order are designed as fencing-in provisions
to prevent violations of consumers' information privacy in the future.
Part IV orders GeoCities to post a clear and prominent notice on its
Web Site explaining GeoCities' practices with regard to its collection
and use of personal identifying information. The notice must include
the following:
(a) What information is being collected;
(b) Its intended use(s);
(c) The third parties to whom it will be disclosed;
(d) How the consumer can obtain access to the information; and
(e) How the consumer can have the information removed from
GeoCities' databases.
The notice must appear on the Web site's home page and at each
location on the site at which such information is collected, although
the collection of so-called ``tracking'' information need only be
disclosed on the home page.
Part IV includes a ``safe harbor'' provision that deems a specified
procedure to be in compliance with this Part. It would allow GeoCities
to post a Privacy Notice on its home page along with a clear and
prominent hyperlink to that notice at each location on the site at
which personal identifying information is collected. The hyperlink
would be accompanied by the following statement:
NOTICE: We collect personal information on this site. To learn more
about how we use your information click here.
Part V of the proposed order sets forth the principles of parental
choice and control. This Part requires GeoCities to implement a
procedure to obtain ``express parental consent'' prior to collection
and using children's identifying information, a procedure commonly
referred to as ``opt-in''. The proposed order provides GeoCities with
flexibility in designing its procedures, so long as they meet the
objective of ensuring prior parental consent. This flexibility reflects
the likelihood of future technological developments to facilitate
parental consent in the online medium.
In addition, this Part includes a ``safe harbor'' procedure. Under
it, GeoCities may collect certain, limited screening information from
prospective site registrants to identify those twelve and under. Prior
to collecting any further information, GeoCities will then send the
parent an e-mail providing notice of the child's interest in
registering and instructing the parent to go to a specified location on
the site to register the child and provide consent to GeoCities'
collection and use of the information. The order provides several means
by which GeoCities may obtain express parental consent, including (1) a
statement signed by the parent that is mailed or faxed to GeoCities,
(2) a credit card authorization, (3) e-mail from the parent with an
electronically verifiable signature, (4) a procedure authorized by
statute, rule or FTC guideline, or (5) any other procedure that ensures
verified parental consent and the parent's identity. GeoCities must
hold secure all screening information and may use it only to provide
notice to the child or parent, or to block the child from further
attempts to register without parental consent.
Part VI addresses the information that GeoCities previously
collected from consumers. It requires GeoCities to notify all such
consumers (in the case of children, their parents) and to give them an
opportunity to have their information removed from GeoCities' and third
parties' databases. Those over the age of twelve will be given notice
and the opportunity to remove their information (commonly referred to
as ``opt-out''). For children, GeoCities must remove all such
information (including home pages and e-mail accounts) unless a parent
grants express consent to its continued retention and use (``opt-in'')
GeoCities' information removal obligations also include the
responsibility to contact third parties to whom it previously has
disclosed the information and to request that those parties delete that
information as well. GeoCities must obtain a statement from all such
third parties that they intend to comply with the above requirements,
and must cease doing business with any such party that refuses to
provide the statement or who
[[Page 44626]]
GeoCities knows or has reason to know is failing to delete the
information upon request. GeoCities must also provide consumers with a
reasonable and secure means to access the information that GeoCities
previously collected from them.
Part VII permits GeoCities to retain certain personally
identifiable information in its ``archived database'' for the limited
purposes of site maintenance, computer file back-up, blocking a child's
attempt to register without parental consent, or to respond to requests
for such information from law enforcement agencies or pursuant to
judicial process. GeoCities must disclose its retention of information
in the archived database in its privacy notice.
Part VIII is a consumer education provision. It requires that for
five years GeoCities place a clear and prominent hyperlink within its
privacy notice directing visitors to the FTC's Web site to view
educational material on consumer privacy. Currently, the FTC site
contains a brochure entitled: ``Site-Seeing on the Internet,'' which
can be found at www.ftc.gov/bcp/conline/pubs/online/sitesee/index.html.
Part IX outlines GeoCities' recordkeeping requirements under the
proposed order. Part X requires GeoCities to deliver a copy of the
order to certain company officers and personnel. Part XI requires
GeoCities to establish an ``information practices training program''
for employees and GeoCities Community Leaders, volunteers who provide a
variety of services to GeoCities' members. The program must include
training about GeoCities' privacy policies, information security
procedures, and disciplinary procedures for violations of its privacy
policies.
Parts XII and XIII require GeoCities to notify the Commission of
any change in its corporate structure that might affect compliance with
the order; and to file compliance reports with the Commission. Part XIV
is a ``sunset'' provision, dictating that the order will terminate in
twenty years absent certain circumstances.
The purpose of this analysis is to facilitate public comment on the
proposed order. It is not intended to constitute an official
interpretation of the agreement and proposed order or to modify in any
way their terms.
By direction of the Commission.
Benjamin I. Berman,
Acting Secretary.
[FR Doc. 98-22444 Filed 8-19-98; 8:45 am]
BILLING CODE 6750-01-M
