Children, Privacy and the Internet

Why do we need special protection for children?

1. Children are using technology with increasing frequency According to a 2001 study by the U.S. Department of Education 90% of children and adolescents ages 5-17 use computers (47 million) 59% of children and adolescents ages 5-17 use the internet (31 million)

2. Use begins at an early age 25% of five-year-olds use the internet By age nine, usage increases to 50% At ages 15-17, usage is over 75%

3. Children are an attractive segment for marketers Children spend billions of dollars a year and influence the expenditure of billions more It is estimated that in 1997  children aged 4 though 12 spent $24.4 billion themselves  Children aged 2 through 14 directly influenced spending by their parents of as much as $188 billion

One of the most attractive age groups is the “tweens”  Approximately 8-12 years old 30 million tweens in the US in 2003  Double the number 10 years ago Spend $10 billion annually Influence an additional $74 billion in family spending More than 50% of tweens use the internet

Commercial websites collect personal information from children FTC survey of 212 commercial web sites in 1998 found that almost 90% of children’s sites collected personal information Means used to collect this information include:  Registration pages  User surveys  Online contests  Electronic pen pal programs  Guest books  Application forms  Chat rooms

In the real world, such information would ordinarily be solicited from young children only with parental involvement However, of the sites visited by the FTC  Only 23% even told children to seek parental permission before providing personal information  7% said they would notify parents of their information practices  1% obtained parental permission prior to collecting such information

Some of the information might have serious consequences for financial and personal security One child-directed site identified by the FTC asked for the following information: Full name, postal address, , gender, and age Whether the child had received gifts in the form of stocks, cash, savings bonds, mutual funds, or CDs Who had given these gifts Whether the child had purchased mutual funds, stocks or bonds with monetary gifts Whether the child’s parents owned mutual funds

Children surfing the internet have experienced problems such as  Attempted password theft  Inappropriate advances by adults in children’s chat rooms According to the FBI, online services and bulletin boards are becoming the most prevalent sources used by pedophiles and other sexual predators to identify contact children

Industry self-regulation did not work In 1997, the Children’s Advertising Review Unit (CARU) of the BBB developed guidelines addressing online collection of personal information from children The Direct Marketing Association (DMA) proposed guidelines urging web sites to provide notice to parents and obtain parental consent before collecting and using children’s personal information However, the FTC’s survey indicated that the vast majority of child-oriented commercial sites did not implement these protections

FTC brought its first case internet privacy case against GeoCities, one of the most popular sites on the web FTC charged that Geocities had 1. Disclosed identifying information collected via its member registration application to third parties who used it to target members, including children, for solicitations beyond those that members had agreed to receive 2. Promoted children’s activities that solicited personal identifying information from children in a manner that suggested that it was collecting the information, when in fact the information was going directly to third parties

FTC concluded that passage of a comprehensive statute was preferable to bringing individual cases Supported COPPA because it places parents in control of the online collection and use of personal information from their children

Who is covered by COPPA? COPPA applies to operators of commercial websites and online services directed to children under 13 that collect personal information from children operators of general audience sites with actual knowledge that they are collecting information from children under 13

What are the requirements of COPPA? 1. post clear and comprehensive Privacy Policies on the website describing their information practices for personal information 2. provide notice to parents, and with limited exceptions, obtain verifiable parental consent before collecting personal information from children 3. give parents the choice to consent to the operator's collection and use of a child's information while prohibiting the operator from disclosing that information to third parties 4. provide parents access to their child's personal information to review and/or have it deleted 5. give parents the opportunity to prevent further collection or use of the information 6. maintain the confidentiality, security, and integrity of information they collect from children

The Rule also prohibits operators from conditioning a child's participation in an online activity on the child's providing more information than is reasonably necessary to participate in that activity

What determines whether a website is directed to children? The FTC considers a number of factors: subject matter language use of animated characters whether advertising appearing on the site is directed to children empirical evidence regarding the ages of the site's visitors

Why does COPPA apply only to children under 13? What about the privacy of teens? young children may not understand the safety and privacy issues created by the online collection of personal information, and are therefore particularly vulnerable age 13 has often been the standard for distinguishing adolescents from young children who may need special protections the FTC encourages operators to afford teens privacy protections, given the risks inherent in the disclosure of personal information for all ages

Will COPPA keep children from accessing pornography? COPPA is meant to give parents control over the collection of their children's personal information it does not limit children's access to information publicly available on the Internet. COPPA may help keep a child off lists COPA (Child Online Protection Act of 1998) was intended to regulate the content of information available on the internet prohibited publishing material that is "harmful to minors" COPA has been declared unconstitutional by federal courts

Do websites set up and run abroad have to comply with the Rule? Foreign-run websites must comply with COPPA if they are directed to children in the U.S. if they knowingly collect information from children in the U.S.

FTC enforcement of COPPA

2001 compliance survey FTC reviewed information collection practices of 144 children’s web sites Found much progress had been made since 1998 survey  90% of sites that collected information had privacy policies  Up from 23% in 1998 But many sites were still not in full compliance  About half the sites complied with notice requirements such as informing parents of their right to review information collected from their child, have it deleted and to refuse to allow further collection

Education and warnings To improve compliance, FTC published a booklet to assist operators of children’s web sites entitled “You, Your Privacy Policy and COPPA” Sent warning letters to more than 50 web site operators identified through the 2001 survey

FTC legal actions under COPPA 2002 settled case against Ohio Art Company, manufacturer of Etch-A-Sketch Collected personal information from children registering for “Etchy’s Birthday Club” Site directed children to “get your parent or guardian’s permission first” but collected information without obtaining parental consent first Collected more information than was necessary to participate in the “birthday club” activity Site also failed to provide parents the opportunity to review personal information collected from their children

2003 settled case with Mrs. Fields’ Cookies  Mrsfields.com  Pretzeltime.com  Pretzelmaker.com Sites offered birthday clubs to children 12 and under Provided birthday greetings and coupons for free cookies and pretzels Collected personal information from over 84,000 children  full name  address  address  birth date without obtaining parental consent first

2003 settled case with Hershey Foods Hershey operates over 30 websites Many candy-related and directed to children Method of obtaining parental permission was online parental consent form FTC alleged that Hershey  Made no effort to ensure that a parent or guardian saw or filled out the form  Collected information even if the form was not completed First case to challenge the method of obtaining parental consent