05-877. Children's Online Privacy Protection Rule

AGENCY:

Federal Trade Commission (FTC).

ACTION:

Notice of proposed rulemaking, request for comment.

SUMMARY:

The Federal Trade Commission proposes amending the Children's Online Privacy Protection Rule (“the Rule”) to permanently allow website operators and online services to obtain verifiable parental consent for the collection of personal information from children for internal use by the website operator through sending an e-mail message to parents coupled with additional steps.

DATES:

Comments must be received by February 14, 2005.

ADDRESSES:

Interested parties are invited to submit written comments. Comments should refer to “Sliding Scale 2005, Project No. P054503” to facilitate the organization of comments. A comment filed in paper form should include this reference both in the text and on the envelope, and should be mailed or delivered to the following address: Federal Trade Commission/Office of the Secretary, Room 159-H (Annex Y), 600 Pennsylvania Avenue, NW., Washington, DC 20580. Comments containing confidential material must be filed in paper form, must be clearly labeled “Confidential,” and must comply with Commission Rule 4.9(c). 16 CFR 4.9(c) (2004).^[1]

Comments filed in electronic form should be submitted by clicking on the following Web link: https://secure.commentworks.com/​ftcslidingscale/​ and following the instructions on the Web-based form. To ensure that the Commission considers an electronic comment, you must file it on the Web-based form at the https://secure.commentworks.com/​ftcslidingscale/​ Web link. You may also visit http://www.regulations.gov to read this notice of proposed rulemaking, and may file an electronic comment through that Web site. The Commission will consider all comments that regulations.gov forwards to it.

The FTC Act and other laws the Commission administers permit the collection of public comments to consider and use in this proceeding as appropriate. All timely and responsive public comments, whether filed in paper or electronic form, will be considered by the Commission, and will be available to the public on the FTC Web site, to the extent practicable, at http://www.ftc.gov/​privacy/​privacyinitiatives/​childrens_​lr.html. As a matter of discretion, the FTC makes every effort to remove home contact information for individuals from the public comments it receives before placing those comments on the FTC Web site. More information, including routine uses permitted by the Privacy Act, may be found in the FTC's privacy policy, at http://www.ftc.gov/​ftc/​privacy.htm.

FOR FURTHER INFORMATION CONTACT:

Rona Kelner, [phone], or Karen Muoio, [phone], Division of Advertising Practices, Bureau of Consumer Protection, Federal Trade Commission, 601 New Jersey Avenue NW., Washington, DC 20580.

SUPPLEMENTARY INFORMATION:

I. Background

On October 20, 1999, the Commission issued its final Rule ^[2] pursuant to the Children's Online Privacy Protection Act (“COPPA”), 15 U.S.C. 6501, et seq. The Rule imposes certain requirements on operators of websites or online services directed to children under 13 years of age, or other websites or online services that have actual knowledge that they have collected personal information from a child under 13 years of age. Among other things, the Rule requires that website operators or online services obtain verifiable parental consent prior to collecting, using, or disclosing personal information from children under 13 years of age.

II. The Sliding Scale

The Rule provides that, “[a]ny method to obtain verifiable parental consent must be reasonably calculated, in light of available technology, to ensure that the person providing consent is the child's parent.” ^[3] The Rule sets forth a sliding scale approach to obtaining verifiable parental consent. If the website operator is collecting personal information for its internal use only, the Rule allows verifiable parental consent to be obtained through the use of an e-mail message to the parent, coupled with additional steps to provide assurances that the parent is providing the consent. Such additional steps include: sending a confirmatory e-mail to the parent after receiving consent or obtaining a postal address or telephone number from the parent and confirming the parent's consent by letter or telephone call.^[4]

In contrast, for uses of personal information that will involve disclosing the information to the public or third parties, the Rule requires that website operators use more reliable methods of obtaining verifiable parental consent. These methods include: using a print-and-send form that can be faxed or mailed back to the website operator; requiring a parent to use a credit card in connection with a transaction; having a parent call a toll-free telephone number staffed by trained personnel; using a digital certificate that uses public key technology; and using e-mail accompanied by a PIN or password obtained through one of the above methods.^[5]

An effect of the sliding scale is that the relatively lower cost of seeking permission for internal use of children's information may encourage website operators to collect personal information for their internal use only, rather than for disclosure to third parties and the public. As noted in the Rule's Statement of Basis and Purpose, “the record shows that disclosures to third parties are among the most sensitive and potentially risky uses of children's personal information.” ^[6]

The sliding scale was originally set to expire on April 21, 2002, but was extended, following a notice and public comment period, for an additional three years.^[7] It is now scheduled to expire on April 21, 2005, at which time website operators would have to obtain verifiable parental consent using the more reliable (and costly) methods for all uses of personal information.^[8] At the time it issued the final Rule, the Commission anticipated that the sliding scale was necessary only in the short term because more reliable methods of obtaining verifiable parental consent would soon be widely available at a reasonable cost. At the present time, however, as in 2002, it appears that the expected progress in available technology has not occurred. The Commission therefore proposes to amend the Rule to make the sliding scale mechanism permanent.^[9] The Commission requests public comment on this proposed amendment.

III. Request for Comments

The Commission proposes to amend the Children's Online Privacy Protection Rule to make permanent the sliding scale mechanism for obtaining verifiable parental consent. Members of the public are invited to comment on any issues or concerns they believe are relevant or appropriate to the Commission's consideration of this proposed amendment, including written data, views, facts, and arguments addressing the proposed amendment to the Rule. All comments should be filed as prescribed in the ADDRESSES section above, and must be received by February 14, 2005. The Commission is particularly interested in comments addressing the following questions:

(1) Are secure electronic mechanisms now widely available to facilitate verifiable parental consent at a reasonable cost? Please include comments on the following:

(a) Digital signature technology;

(b) Digital certificate technology;

(c) Other digital credentialing technology;

(d) P3P technology; and

(e) Other secure electronic technologies.

(2) Are infomediary services now widely available to facilitate verifiable parental consent at a reasonable cost?

(3) When are secure electronic mechanisms and/or infomediary services for obtaining verifiable parental consent anticipated to become available at a reasonable cost? To what extent would the Commission's decision to eliminate, make permanent, or extend the sliding scale mechanism affect the incentive to develop and deploy these means of obtaining verifiable parental consent?

(4) What effect would eliminating the sliding scale have on the information collection and use practices of website operators? For example, would the elimination of the sliding scale mechanism encourage website operators to collect children's personal information for uses other than the operators' own internal use because the cost of obtaining parental consent would be the same for internal as well as external uses?

(5) Is there any evidence that the sliding scale mechanism is being misused, or is not working effectively?

(6) Should the sliding scale mechanism be extended? If so, why and for how long?

(7) Should the sliding scale mechanism be eliminated? If so, why?

(8) Should the sliding scale mechanism be made permanent? If so, why?

IV. Communications by Outside Parties to Commissioners or Their Advisors

Written communications and summaries of transcripts of oral communications respecting the merits of this proceeding from any outside party to any Commissioner or Commissioner's advisor will be placed on the public record. See 16 CFR 1.26(b)(5).

V. Paperwork Reduction Act

The proposed amendment to the Rule does not change any information collection requirements that have previously been reviewed and approved by the Office of Management and Budget pursuant to the Paperwork Reduction Act, 44 U.S.C. 3501 et seq.

VI. Regulatory Flexibility Act

The Regulatory Flexibility Act (“RFA”), 5 U.S.C. 601-612, requires that the Commission provide an Initial Regulatory Flexibility Analysis (“IRFA”) with a proposed rule and a Final Regulatory Flexibility Analysis (“FRFA”), if any, with the final rule, unless the Commission certifies that the rule will not have a significant economic impact on a substantial number of small entities. 5 U.S.C. 603-605.

The Commission does not anticipate that the proposed amendment to the Rule will have a significant economic impact on a substantial number of small entities. The proposed amendment is merely extending a sliding scale mechanism that is already in place. The proposed amendment does not alter the status quo, and would postpone the potential economic impact, if any, of the expiration of the sliding scale mechanism. Thus, the economic impact of the amendment to the Rule is expected to be comparatively minimal.

Accordingly, this document serves as notice to the Small Business Administration of the agency's certification of no effect. To ensure the accuracy of this certification, however, the Commission requests comment on whether the proposed amendment to the Rule will have a significant impact on a substantial number of small entities, including specific information on the effect of the proposed amendment on the costs, profitability, and competitiveness of, and employment in, small entities. Although the Commission certifies under the RFA that the amendment proposed in this notice would not, if promulgated, have a significant impact on a substantial number of small entities, the Commission has determined, nonetheless, that it is appropriate to publish an IRFA in order to inquire into the impact of the proposed Rule on small entities. Therefore, the Commission has prepared the following analysis:

A. Description of the Reasons That Action by the Agency Is Being Considered

The Rule's sliding scale mechanism for obtaining parental consent is scheduled to expire on April 21, 2005. At the time it issued the final Rule, the Commission anticipated that the sliding scale was necessary only in the short term because more reliable methods of obtaining verifiable parental consent would soon be widely available at a reasonable cost. At the present time, however, it appears that the expected progress in available technology has not occurred. Therefore, in this action, the Commission is proposing, and seeking comment on, a proposed amendment to the Rule that would make the sliding scale permanent.

B. Statement of the Objectives of, and Legal Basis for, the Proposed Amendment to the Rule

The objective of the proposed amendment to the Rule is to allow operators of websites or online services who collect children's personal information for internal uses only to continue to have the option of using email-based parental consent, instead of having to use one of the more costly methods. The proposed amendment would continue the status quo instead of allowing the sliding scale to expire in April 2005. The proposed amendment is authorized by and based upon section 312.5 of the Children's Online Privacy Protection Rule, 16 CFR 312.5(b)(2), which in turn is based upon section 1303(b) of COPPA.

C. Small Entities to Which the Proposed Amendment to the Rule Will Apply

As described above, the proposed amendment to the Rule applies to any commercial operator of a website or online service, including operators who are small entities, who collects children's personal information for internal uses only. The Commission does not currently have sufficient information to determine the number of small entities that may be affected. The Commission invites comment and information on this issue.

D. Projected Reporting, Recordkeeping, and Other Compliance Requirements

The Rule does not directly impose any “reporting” or “recordkeeping” requirements within the meaning of the Paperwork Reduction Act, but does require that operators make certain third-party disclosures to the public, i.e., provide parents with notice of their privacy policies. The proposed amendment to make permanent the sliding scale mechanism for obtaining parental consent would not impose any additional reporting, recordkeeping, or other compliance requirements. In addition, the amendment would not affect the costs of complying with the Rule because it is merely extending a sliding scale mechanism that is already in place and that enables qualified website operators to obtain parental consent through lower-cost email-based means.

E. Duplicative, Overlapping, or Conflicting Federal Rules

The Commission has not identified any other federal statutes, rules, or policies that duplicate, overlap, or conflict with the proposed amendment to the Rule. The Commission invites comment and information on this issue.

F. Significant Alternatives to the Proposed Amendment to the Rule

Under the proposed amendment to the Rule, subject operators will continue to be able to choose email-based methods of obtaining parental consent instead of having to rely solely on the more costly methods. Therefore, the proposed amendment actually permits greater flexibility for small entities than would allowing the sliding scale to expire in April 2005. A delayed effective date was not considered here, because the regulatory uncertainty resulting from such a delay would not benefit small entities.

The Commission invites comment and information on the economic impact of the proposed amendment on small entities, including significant alternatives, if any, to the proposed amendment that would result in greater flexibility for small businesses, while meeting the objectives and requirements of COPPA and the Rule. After considering such comments, if any, the Commission will determine whether preparation of a final regulatory flexibility analysis (pursuant to 5 U.S.C. 605) is required.

List of Subjects in 16 CFR Part 312

• Children
• Communications
• Consumer protection
• Electronic mail
• E-mail
• Internet
• Online service
• Privacy
• Record retention
• Safety
• Science and technology
• Trade practices
• Website
• Youth

Accordingly, for the reasons stated in the preamble, the Federal Trade Commission proposes to amend 16 CFR Part 312 as follows:

PART 312—CHILDREN'S ONLINE PRIVACY PROTECTION RULE

1. The authority citation for Part 312 continues to read as follows:

Authority: 15 U.S.C. 6501 et seq.

2. Amend § 312.5 by revising the second sentence of paragraph (b)(2) to read as follows:

§ 312.5

Parental consent.

* * * * *

(b) * * *

(2) * * * Provided that: Methods to obtain verifiable parental consent for uses of information other than the “disclosures” defined by § 312.2 may also include use of e-mail coupled with additional steps to provide assurances that the person providing the consent is the parent. * * *

* * * * *

By direction of the Commission.

Donald S. Clark,

Secretary.

Footnotes

1.  The comment must be accompanied by an explicit request for confidential treatment, including the factual and legal basis for the request, and must identify the specific portions of the comment to be withheld from the public record. The request will be granted or denied by the Commission's General Counsel, consistent with applicable law and the public interest. See Commission Rule 4.9(c), 16 CFR 4.9(c).

2.  64 FR 59888 (1999).

3.  16 CFR 312.5(b)(1).

4.  Id.

5.  16 CFR 312.5(b)(2).

6.  64 FR 59899 (1999).

7.  See http://www.ftc.gov/​privacy/​privacyinitiatives/​childrens_​lr.html for notice and public comments.

8.  67 FR 18818 (2002).

9.  The Commission would continue to monitor developments in the technology available to obtain verifiable parental consent at a reasonable cost.