Children's Online Privacy Protection Rule, 21104-21106 [05-8159]

Agencies

• FEDERAL TRADE COMMISSION

[Federal Register Volume 70, Number 77 (Friday, April 22, 2005)]
[Rules and Regulations]
[Pages 21104-21106]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 05-8159]



[[Page 21103]]

-----------------------------------------------------------------------

Part IV





Federal Trade Commission





-----------------------------------------------------------------------



16 CFR Part 312



Children's Online Privacy Protection Rule; Request for Comments; Final 
Rule and Proposed Rule

Federal Register / Vol. 70, No. 77 / Friday, April 22, 2005 / Rules 
and Regulations

[[Page 21104]]


-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION

16 CFR Part 312


Children's Online Privacy Protection Rule

AGENCY: Federal Trade Commission.

ACTION: Final rule amendment.

-----------------------------------------------------------------------

SUMMARY: The Federal Trade Commission (``the Commission'') issues a 
final amendment to the Children's Online Privacy Protection Rule (``the 
Rule''), to extend the sliding scale mechanism which allows Web site 
operators to use e-mail, coupled with additional steps, to obtain 
verifiable parental consent for the collection of personal information 
from children for internal use by the Web site operator, until the 
conclusion of the Commission's proceeding to undertake a comprehensive 
review of the Rule. As explained in a separate document being published 
elsewhere in this issue of the Federal Register, the Commission is 
requesting additional comment on the sliding scale mechanism.

DATES: Effective April 21, 2005.

ADDRESSES: Requests for copies of the amended Rule and the Statement of 
Basis and Purpose should be sent to: Public Reference Branch, Federal 
Trade Commission, Room H-130, 600 Pennsylvania Avenue, NW., Washington, 
DC 20580.

FOR FURTHER INFORMATION CONTACT: Karen Muoio, (202) 326-2491, or Rona 
Kelner, (202) 326-2752, Federal Trade Commission, 600 Pennsylvania 
Avenue, NW., Mail Drop NJ-3212, Washington, DC 20580.

Statement of Basis and Purpose

I. Introduction

    As part of the effort to protect children's online privacy, 
Congress enacted the Children's Online Privacy Protection Act of 1998 
(``COPPA''), 15 U.S.C. 6501-6508, to prohibit unfair or deceptive acts 
or practices in connection with the collection, use, or disclosure of 
personally identifiable information from children on the Internet. On 
October 20, 1999, the Commission issued its final Rule implementing 
COPPA, which became effective on April 21, 2000.\1\ The Rule imposes 
certain requirements on operators of Web sites or online services 
directed to children under 13 years of age, and on operators of other 
Web sites or online services that have actual knowledge that they are 
collecting information from a child under 13 years of age. Among other 
things, the Rule requires that Web site operators obtain verifiable 
parental consent prior to collecting, using, or disclosing personal 
information from children under 13 years of age.
---------------------------------------------------------------------------

    \1\ 64 FR 59888 (1999).
---------------------------------------------------------------------------

    The Rule provides that ``[a]ny method to obtain verifiable parental 
consent must be reasonably calculated, in light of available 
technology, to ensure that the person providing consent is the child's 
parent.'' \2\ Prior to issuing the Rule, the Commission studied 
extensively the state of available parental consent technologies.\3\ In 
July 1999, the Commission held a workshop on parental consent, which 
revealed that more reliable electronic methods of verification were not 
widely available and affordable.\4\ In making its initial determination 
to adopt the sliding scale mechanism in 1999, the Commission balanced 
the costs imposed by the method of obtaining parental consent and the 
risks associated with the intended uses of information.\5\ Because of 
the limited availability and affordability of the more reliable methods 
of obtaining consent--including electronic methods of verification--the 
Commission found that these methods should only be required when 
obtaining consent for uses of information that posed the greatest risks 
to children.\6\ Accordingly, the Commission implemented the sliding 
scale, noting that it would ``provide[] operators with cost-effective 
options until more reliable electronic methods became available and 
affordable, while providing parents with the means to protect their 
children.'' \7\
---------------------------------------------------------------------------

    \2\ 16 CFR 312.5(b)(1).
    \3\ See, e.g., public comments received on the initial 1999 
rulemaking, available on the FTC's Web site at https://www.ftc.gov/
privacy/comments/.
    \4\ See press release announcing workshop and transcript of 
workshop, available on the FTC's Web site at https://www.ftc.gov/opa/
1999/06/kidswork.htm and https://www.ftc.gov/privacy/
chonlpritranscript.pdf.
    \5\ 64 FR 59901, 59902 (1999).
    \6\ Id.
    \7\ Id. at 59902.
---------------------------------------------------------------------------

    Therefore, the Rule sets forth a sliding scale approach to 
obtaining verifiable parental consent. If the Web site operator is 
collecting personal information for its internal use only, the Rule 
allows verifiable parental consent to be obtained through the use of an 
e-mail message to the parent, coupled with additional steps to provide 
assurances that the person providing the consent is, in fact, the 
parent. Such additional steps include: sending a delayed confirmatory 
e-mail to the parent after receiving consent or obtaining a postal 
address or telephone number from the parent and confirming the parent's 
consent by letter or telephone call.\8\
---------------------------------------------------------------------------

    \8\ Id.
---------------------------------------------------------------------------

    In contrast, for uses of personal information that involve 
disclosing the information to the public or third parties, the Rule 
requires that Web site operators use more reliable methods of obtaining 
verifiable parental consent. These methods include: using a print-and-
send form that can be faxed or mailed back to the Web site operator; 
requiring a parent to use a credit card in connection with a 
transaction; having a parent call a toll-free telephone number staffed 
by trained personnel; using a digital certificate that uses public key 
technology; and using e-mail accompanied by a PIN or password obtained 
through one of the above methods.\9\ As noted in the Rule's Statement 
of Basis and Purpose, ``the record shows that disclosures to third 
parties are among the most sensitive and potentially risky uses of 
children's personal information.'' \10\
---------------------------------------------------------------------------

    \9\ 16 CFR 312.5(b)(2).
    \10\ 64 FR 59899 (1999).
---------------------------------------------------------------------------

    At the time it issued the Rule, the Commission anticipated that the 
sliding scale was necessary only in the short term because more 
reliable methods of obtaining verifiable parental consent would soon be 
widely available and affordable.\11\ Accordingly, the sliding scale was 
originally set to expire on April 21, 2002, two years after the Rule 
went into effect.\12\ However, when public comment revealed that the 
expected progress in available technology had not occurred, the 
Commission in 2002 extended the sliding scale for an additional three 
years until April 21, 2005.\13\
---------------------------------------------------------------------------

    \11\ 64 FR 59902 (1999).
    \12\ 16 CFR 312.5(b)(2).
    \13\ 67 FR 18818 (2002).
---------------------------------------------------------------------------

    With the sliding scale mechanism scheduled to sunset this year, the 
Commission again undertook a review of the sliding scale. On January 
14, 2005, the Commission published a Notice of Proposed Rulemaking and 
Request for Public Comment in the Federal Register proposing to make 
the sliding scale mechanism for obtaining parental consent a permanent 
feature of the Rule.\14\ The Commission noted that the expected 
progress in available technology still does not appear to have 
transpired. The Commission requested public comment on the proposed 
amendment. It also posed several questions regarding: (1) The current 
and anticipated availability and affordability of more secure 
electronic mechanisms or infomediaries for obtaining parental

[[Page 21105]]

consent; (2) the effect of the sliding scale mechanism on the incentive 
to develop and deploy more secure electronic mechanisms; (3) the effect 
of the sliding scale on operators' incentives to disclose children's 
personal information to third parties or the public; and (4) any 
evidence the sliding scale is being misused or not working effectively.
---------------------------------------------------------------------------

    \14\ 70 FR 2580 (2005).
---------------------------------------------------------------------------

    The public comment period closed on February 14, 2005. The 
Commission received a total of 91 comments.\15\ Those submitting 
comments included: FTC-approved COPPA safe harbor programs; companies 
operating Web sites or Internet-related businesses; marketing, 
advertising, media, Internet-related, and other trade groups; privacy-
related organizations; credit unions; educational organizations; and 
consumers.
---------------------------------------------------------------------------

    \15\ A list of the commenters and their comments appear on the 
FTC's Web site at https://www.ftc.gov/os/publiccomments.htm.
---------------------------------------------------------------------------

    The comments evidence public interest in the effectiveness of and 
need for the sliding scale. The Commission therefore has decided it 
would be beneficial to accept additional comments during the regulatory 
review comment period and to extend the sliding scale until it 
completes its review of the full Rule.

II. Regulatory Flexibility Act

    The Regulatory Flexibility Act (``RFA''), 5 U.S.C. 601-612, 
requires that the Commission provide an Initial Regulatory Flexibility 
Analysis (``IRFA'') with a proposed rule and a Final Regulatory 
Flexibility Analysis (``FRFA''), if any, with the final rule, unless 
the Commission certifies that the rule will not have a significant 
economic impact on a substantial number of small entities.\16\
---------------------------------------------------------------------------

    \16\ 5 U.S.C. 603-605.
---------------------------------------------------------------------------

    The Commission hereby certifies that the final Rule amendment will 
not have a significant impact on a substantial number of small business 
entities. The final Rule amendment extends a sliding scale mechanism 
that is already in place. The final Rule amendment does not alter the 
status quo, and postpones the potential economic impact, if any, of the 
expiration of the sliding scale mechanism. Thus, the economic impact of 
the amendment to the Rule is expected to be comparatively minimal.
    Accordingly, this document serves as notice to the Small Business 
Administration of the agency's certification of no effect. Nonetheless, 
the Commission has decided to publish a Final Regulatory Flexibility 
Analysis with this final Rule amendment.
Therefore, the Commission has prepared the following analysis:
A. Need for and Objectives of the Rule Amendment
    The Rule's sliding scale mechanism for obtaining parental consent 
is scheduled to expire on April 21, 2005. At the time it issued the 
final Rule, the Commission anticipated that the sliding scale was 
necessary only in the short term because more reliable electronic 
methods of obtaining verifiable parental consent would soon be widely 
available at a reasonable cost. The existing record indicates that 
there is public interest in the effectiveness of and need for the 
sliding scale. Therefore, the Commission is amending the Rule to extend 
the sliding scale mechanism for obtaining verifiable parental consent 
to solicit additional data, if any are available, in the larger context 
of the Rule's overall effectiveness.
B. Significant Issues Raised by Public Comment, Summary of the Agency's 
Assessment of These Issues, and Changes, if Any, Made in Response to 
Such Comments
    The Commission received few comments in response to its IRFA. These 
commenters noted that the amendment to make permanent the sliding scale 
mechanism for obtaining verifiable parental consent would be beneficial 
to small businesses.\17\ The sliding scale allows commercial operators 
of Web sites and online services who collect personal information from 
children for internal uses only to obtain verifiable parental consent 
through the use of e-mail, coupled with additional steps, instead of 
having to use the more reliable (and more costly) methods required when 
information will be disclosed to third parties or the public. 
Commenters noted that small businesses benefit by having this cost-
effective option.\18\ Commenters also noted that allowing the sliding 
scale to sunset after companies have made investments to implement this 
mechanism would pose financial burdens and have negative consequences 
that would especially harm small businesses.\19\ The Commission agrees 
that continuing the use of the sliding scale mechanism may be 
beneficial to small businesses.
---------------------------------------------------------------------------

    \17\ Children's Advertising Review Unit (``CARU'') at 2; Mattel, 
Inc. at 1; Motion Picture Association of America (``MPAA'') at 3-4; 
Software and Information Industry Association (``SIIA'') at 3.
    \18\ CARU at 2; IT Law Group at 1; Mattel at 1.
    \19\ IT Law Group at 1; MPAA at 3-4; SIIA at 3.
---------------------------------------------------------------------------

C. Description and Estimate of Number of Small Entities Subject to the 
Rule Amendment or Explanation of Why No Estimate Is Available
    As described above, the Rule amendment applies to any commercial 
operator of a Web site or online service, including operators who are 
small entities, who collects personal information from children for 
internal uses only. The Commission is unable to ascertain a precise 
estimate of the number of small entities that are affected by the 
amendment and received no specific comments to the IRFA that allow it 
to estimate the number of small entities that will be affected.
D. Description of the Projected Reporting, Recordkeeping, and Other 
Compliance Requirements of the Rule Amendment, Including an Estimate of 
the Classes of Small Entities That Will Be Subject to the Rule 
Amendment and the Type of Professional Skills That Will Be Necessary To 
Comply
    The Rule does not directly impose any ``reporting'' or 
``recordkeeping'' requirements within the meaning of the Paperwork 
Reduction Act, but does require that operators make certain third-party 
disclosures to the public, i.e., provide parents with notice of their 
information practices. The final Rule amendment to extend the sliding 
scale mechanism for obtaining parental consent does not impose any 
additional reporting or recordkeeping requirements. The Rule does 
contain certain compliance requirements, including the requirement to 
obtain verifiable parental consent to collect personal information from 
children. This obligation does not require operators to file reports or 
maintain records within the meaning of the Paperwork Reduction Act, 
although the Commission recognizes that there are potential compliance 
costs associated with this requirement. For example, an employee may be 
needed to review parental responses to the operator's requests for 
consent. The Commission has not previously determined the estimated 
costs of complying with this obligation in terms of burden hours, and 
did not receive any quantitative data in this rulemaking to determine 
what these costs might be. Importantly, however, the final Rule 
amendment does not impose any additional compliance costs, as it is 
merely extending a sliding scale mechanism that has been in place since 
the Rule went into effect. If anything, the final Rule amendment may 
reduce costs of complying because it allows qualified Web site 
operators, including small entities, to obtain

[[Page 21106]]

parental consent through lower-cost e-mail-based means.
E. Steps the Agency Has Taken To Minimize Any Significant Economic 
Impact on Small Entities, Consistent With the Stated Objectives of the 
Applicable Statutes, Including the Factual, Policy, and Legal Reasons 
for Selecting the Alternative(s) Finally Adopted, and Why Each of the 
Significant Alternatives, If Any, Was Rejected
    The Commission has determined that the Rule amendment, which 
maintains the status quo, will not have a significant economic impact 
on small entities. If anything, the final Rule amendment benefits small 
entities in that it continues to permit qualified Web site operators, 
including small entities, to obtain parental consent through lower-cost 
e-mail-based means. One alternative to the final Rule amendment that 
was considered and rejected was allowing the sliding scale mechanism to 
sunset as scheduled on April 21, 2005. This alternative likely would be 
more burdensome for small entities. If the sliding scale were to expire 
on April 21, 2005, small businesses currently using this mechanism 
would have to revise their parental consent procedures to adopt one of 
the more costly means of obtaining parental consent--such as using a 
print and send form, processing a credit card transaction, or using a 
toll-free telephone number staffed by trained personnel--or cease their 
online offerings to children altogether. Accordingly, the Commission 
has determined that extending the sliding scale pending further review 
is appropriate.
    Therefore, to the extent that small entities are affected by the 
Rule amendment, the Commission believes the public comments support its 
determination that the adoption of the Rule amendment will not impose 
more significant or costly compliance requirements on Web site 
operators than the Rule would otherwise impose if it were not amended. 
By adopting a final Rule amendment that extends currently effective 
compliance options, the Commission is preserving the status quo for all 
Web site operators, including any small entities, until the Commission 
completes its review of the full Rule. Thus, the change, if any, in the 
economic impact of the Rule resulting from the final Rule amendment, 
will be less than if the Commission did not amend the Rule and the more 
burdensome requirements of the Rule as originally promulgated were 
allowed to take effect. Accordingly, for these reasons, the Commission 
certifies under the Regulatory Flexibility Act that the final Rule 
amendment will not have a significant economic impact on a substantial 
number of small entities.\20\ This notice also serves as the required 
certification and statement of the Commission's determination to the 
Small Business Administration.
---------------------------------------------------------------------------

    \20\ 5 U.S.C. 605.
---------------------------------------------------------------------------

III. Paperwork Reduction Act

    This final Rule amendment does not change any information 
collection requirements that have previously been reviewed and approved 
by the Office of Management and Budget pursuant to the Paperwork 
Reduction Act, as amended.\21\
---------------------------------------------------------------------------

    \21\ 44 U.S.C. 3501-3520.
---------------------------------------------------------------------------

Final Rule

List of Subjects in 16 CFR Part 312

    Children, Communications, Consumer protection, Electronic mail, E-
mail, Internet, Online service, Privacy, Record retention, Safety, 
Science and technology, Trade practices, Web site, Youth.


0
Accordingly, the Federal Trade Commission amends 16 CFR part 312 as 
follows:

PART 312--CHILDREN'S ONLINE PRIVACY PROTECTION RULE

0
1. Revise the authority citation for part 312 to read as follows:

    Authority: 15 U.S.C. 6501-6508.


0
2. Amend Sec.  312.5 by revising the second sentence of paragraph 
(b)(2) to read as follows:


Sec.  312.5  Parental consent.

* * * * *
    (b) * * *
    (2) * * * Provided that: Until the Commission otherwise determines, 
methods to obtain verifiable parental consent for uses of information 
other than the ``disclosures'' defined by Sec.  312.2 may also include 
use of e-mail coupled with additional steps to provide assurances that 
the person providing the consent is the parent. * * *
* * * * *

    By direction of the Commission, Commissioner Leibowitz not 
participating.
Donald S. Clark,
Secretary.
[FR Doc. 05-8159 Filed 4-21-05; 8:45 am]
BILLING CODE 6750-01-P