Children's Online Privacy Protection Rule
Federal Register, Volume 78 Issue 12 (Thursday, January 17, 2013)
Federal Register Volume 78, Number 12 (Thursday, January 17, 2013)
Rules and Regulations
Pages 3971-4014
From the Federal Register Online via the Government Printing Office www.gpo.gov
FR Doc No: 2012-31341
Page 3971
Vol. 78
Thursday,
No. 12
January 17, 2013
Part II
Federal Trade Commission
-----------------------------------------------------------------------
16 CFR Part 312
Children's Online Privacy Protection Rule; Final Rule
Page 3972
-----------------------------------------------------------------------
FEDERAL TRADE COMMISSION
16 CFR Part 312
RIN 3084-AB20
Children's Online Privacy Protection Rule
AGENCY: Federal Trade Commission (``FTC'' or ``Commission'').
ACTION: Final rule amendments.
-----------------------------------------------------------------------
SUMMARY: The Commission amends the Children's Online Privacy Protection Rule (``COPPA Rule'' or ``Rule''), consistent with the requirements of the Children's Online Privacy Protection Act, to clarify the scope of the Rule and strengthen its protections for children's personal information, in light of changes in online technology since the Rule went into effect in April 2000. The final amended Rule includes modifications to the definitions of operator, personal information, and Web site or online service directed to children. The amended Rule also updates the requirements set forth in the notice, parental consent, confidentiality and security, and safe harbor provisions, and adds a new provision addressing data retention and deletion.
DATES: The amended Rule will become effective on July 1, 2013.
ADDRESSES: The complete public record of this proceeding will be available at www.ftc.gov. Requests for paper copies of this amended Rule and Statement of Basis and Purpose (``SBP'') should be sent to: Public Reference Branch, Federal Trade Commission, 600 Pennsylvania Avenue NW., Room 130, Washington, DC 20580.
FOR FURTHER INFORMATION CONTACT: Phyllis H. Marcus or Mamie Kresses, Attorneys, Division of Advertising Practices, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW., Washington, DC 20580, (202) 326-2854 or (202) 326-2070.
SUPPLEMENTARY INFORMATION:
Statement of Basis and Purpose
-
Overview and Background
-
Overview
This document states the basis and purpose for the Commission's decision to adopt certain amendments to the COPPA Rule that were proposed and published for public comment on September 27, 2011 (``2011 NPRM''),\1\ and supplemental amendments that were proposed and published for public comment on August 6, 2012 (``2012 SNPRM'').\2\ After careful review and consideration of the entire rulemaking record, including public comments submitted by interested parties, and based upon its experience in enforcing and administering the Rule, the Commission has determined to adopt amendments to the COPPA Rule. These amendments to the final Rule will help to ensure that COPPA continues to meet its originally stated goals to minimize the collection of personal information from children and create a safer, more secure online experience for them, even as online technologies, and children's uses of such technologies, evolve.
---------------------------------------------------------------------------
\1\ 2011 NPRM, 76 FR 59804, available at http://ftc.gov/os/2011/09/110915coppa.pdf.
\2\ 2012 SNPRM, 77 FR 46643, available at http://ftc.gov/os/2012/08/120801copparule.pdf.
---------------------------------------------------------------------------
The final Rule amendments modify the definitions of operator to make clear that the Rule covers an operator of a child-directed site or service where it integrates outside services, such as plug-ins or advertising networks, that collect personal information from its visitors; Web site or online service directed to children to clarify that the Rule covers a plug-in or ad network when it has actual knowledge that it is collecting personal information through a child-
directed Web site or online service; Web site or online service directed to children to allow a subset of child-directed sites and services to differentiate among users, and requiring such properties to provide notice and obtain parental consent only for users who self-
identify as under age 13; personal information to include geolocation information and persistent identifiers that can be used to recognize a user over time and across different Web sites or online services; and support for internal operations to expand the list of defined activities.
The Rule amendments also streamline and clarify the direct notice requirements to ensure that key information is presented to parents in a succinct ``just-in-time'' notice; expand the non-exhaustive list of acceptable methods for obtaining prior verifiable parental consent; create three new exceptions to the Rule's notice and consent requirements; strengthen data security protections by requiring operators to take reasonable steps to release children's personal information only to service providers and third parties who are capable of maintaining the confidentiality, security, and integrity of such information; require reasonable data retention and deletion procedures; strengthen the Commission's oversight of self-regulatory safe harbor programs; and institute voluntary pre-approval mechanisms for new consent methods and for activities that support the internal operations of a Web site or online service.
-
Background
The COPPA Rule, 16 CFR part 312, issued pursuant to the Children's Online Privacy Protection Act (``COPPA'' or ``COPPA statute''), 15 U.S.C. 6501 et seq., became effective on April 21, 2000. The Rule imposes certain requirements on operators of Web sites or online services directed to children under 13 years of age, and on operators of other Web sites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age (collectively, ``operators''). Among other things, the Rule requires that operators provide notice to parents and obtain verifiable parental consent prior to collecting, using, or disclosing personal information from children under 13 years of age.\3\ The Rule also requires operators to keep secure the information they collect from children, and prohibits them from conditioning children's participation in activities on the collection of more personal information than is reasonably necessary to participate in such activities.\4\ The Rule contains a ``safe harbor'' provision enabling industry groups or others to submit to the Commission for approval self-regulatory guidelines that would implement the Rule's protections.\5\
---------------------------------------------------------------------------
\3\ See 16 CFR 312.3.
\4\ See 16 CFR 312.7 and 312.8.
\5\ See 16 CFR 312.10.
---------------------------------------------------------------------------
The Commission initiated review of the COPPA Rule in April 2010 when it published a document in the Federal Register seeking public comment on whether the rapid-fire pace of technological changes to the online environment over the preceding five years warranted any changes to the Rule.\6\ The Commission's request for public comment examined each aspect of the COPPA Rule, posing 28 questions for the public's consideration.\7\ The Commission also held a public roundtable to discuss in detail several of the areas where public comment was sought.\8\
---------------------------------------------------------------------------
\6\ See Request for Public Comment on the Federal Trade Commission's Implementation of the Children's Online Privacy Protection Rule (``2010 FRN''), 75 FR 17089 (Apr. 5, 2010).
\7\ Id.
\8\ Information about the June 2010 public roundtable is located at http://www.ftc.gov/bcp/workshops/coppa/index.shtml.
---------------------------------------------------------------------------
The Commission received 70 comments from industry representatives, advocacy groups, academics, technologists, and
Page 3973
individual members of the public in response to the April 5, 2010 request for public comment.\9\ After reviewing the comments, the Commission issued the 2011 NPRM, which set forth several proposed changes to the COPPA Rule.\10\ The Commission received over 350 comments in response to the 2011 NPRM.\11\ After reviewing these comments, and based upon its experience in enforcing and administering the Rule, in the 2012 SNPRM, the Commission sought additional public comment on a second set of proposed modifications to the Rule.
---------------------------------------------------------------------------
\9\ Public comments in response to the Commission's 2010 FRN are located at http://www.ftc.gov/os/comments/copparulerev2010/index.shtm. Comments cited herein to the Federal Register Notice are designated as such, and are identified by commenter name, comment number, and, where applicable, page number.
\10\ See supra note 1.
\11\ Public comments in response to the 2011 NPRM are located at http://www.ftc.gov/os/comments/copparulereview2011/. Comments cited herein to the 2011 NPRM are designated as such, and are identified by commenter name, comment number, and, where applicable, page number.
---------------------------------------------------------------------------
The 2012 SNPRM proposed modifying the definitions of both operator and Web site or online service directed to children to allocate and clarify the responsibilities under COPPA when independent entities or third parties, e.g., advertising networks or downloadable software kits (``plug-ins''), collect information from users through child-directed sites and services. In addition, the 2012 SNPRM proposed to further modify the definition of Web site or online service directed to children to permit Web sites or online services that are directed both to children and to a broader audience to comply with COPPA without treating all users as children. The Commission also proposed modifying the definition of screen or user name to cover only those situations where a screen or user name functions in the same manner as online contact information. Finally, the Commission proposed to further modify the revised definitions of support for internal operations and persistent identifiers. The Commission received 99 comments in response to the 2012 SNPRM.\12\ After reviewing these additional comments, the Commission now announces this final amended COPPA Rule.
---------------------------------------------------------------------------
\12\ Public comments in response to the 2012 SNPRM are available online at http://ftc.gov/os/comments/copparulereview2012/index.shtm. Comments cited herein to the SNPRM are designated as such, and are identified by commenter name, comment number, and, where applicable, page number.
---------------------------------------------------------------------------
-
-
Modifications to the Rule
-
Section 312.2: Definitions
1. Definition of Collects or Collection
-
Collects or Collection, Paragraph (1)
In the 2011 NPRM, the Commission proposed amending paragraph (1) to change the phrase ``requesting that children submit personal information online'' to ``requesting, prompting, or encouraging a child to submit personal information online.'' The proposal was to clarify that the Rule covers the online collection of personal information both when an operator requires it to participate in an online activity, and when an operator merely prompts or encourages a child to provide such information.\13\ The comments received divided roughly equally between support of and opposition to the proposed change to paragraph (1). Those in favor cited the increased clarity of the revised language as compared to the existing language.\14\
---------------------------------------------------------------------------
\13\ One commenter, Go Daddy, expressed concern that the definition of collects or collection is silent as to personal information acquired from children offline that is uploaded, stored, or distributed to third parties by operators. Go Daddy (comment 59, 2011 NPRM), at 2. However, Congress limited the scope of COPPA to information that an operator collects online from a child; COPPA does not govern information collected by an operator offline. See 15 U.S.C. 6501(8) (defining the personal information as ``individually identifiable information about an individual collected online * * *.''); 144 Cong. Rec. S11657 (Oct. 7, 1998) (Statement of Sen. Bryan) (``This is an online children's privacy bill, and its reach is limited to information collected online from a child.'').
\14\ See Institute for Public Representation (comment 71, 2011 NPRM), at 19; kidSAFE Seal Program (comment 81, 2011 NPRM), at 5; Alexandra Lang (comment 87, 2011 NPRM), at 1.
---------------------------------------------------------------------------
Several commenters opposed the revised language of paragraph (1). For example, the National Cable and Telecommunications Association (``NCTA'') expressed concern that the revised language suggests that ``COPPA obligations are triggered even without the actual or intended collection of personal information.'' \15\ NCTA asked the Commission to clarify that ``prompting'' or ``encouraging'' does not trigger COPPA unless an operator actually collects personal information from a child.\16\
---------------------------------------------------------------------------
\15\ NCTA (comment 113, 2011 NPRM), at 17-18.
\16\ Id.
---------------------------------------------------------------------------
The Rule defines collection as ``the gathering of any personal information from a child by any means,'' and the terms ``prompting'' and ``encouraging'' are merely exemplars of the means by which an operator gathers personal information from a child.\17\ This change to the definition of collects or collection is intended to clarify the longstanding Commission position that an operator that provides a field or open forum for a child to enter personal information will not be shielded from liability merely because entry of personal information is not mandatory to participate in the activity. It recognizes the reality that such an operator must have in place a system to provide notice to and obtain consent from parents to deal with the moment when the information is ``gathered.'' \18\ Otherwise, once the child posts the personal information, it will be too late to obtain parental consent.
---------------------------------------------------------------------------
\17\ See 16 CFR 312.2: ``Collects or collection means the gathering of any personal information from a child by any means, including but not limited to * * * ''
\18\ Several other commenters raised concern that the language ``prompting, or encouraging'' could make sites or services that post third-party ``Like'' or ``Tweet This'' buttons subject to COPPA. See Association for Competitive Technology (comment 5, 2011 NPRM), at 6; Direct Marketing Association (``DMA'') (comment 37, 2011 NPRM), at 6; see also American Association of Advertising Agencies (comment 2, 2011 NPRM), at 2-3; Interactive Advertising Bureau (``IAB'') (comment 73, 2011 NPRM), at 12. The collection of personal information by plug-ins on child-directed sites is addressed fully in the discussion regarding changes to the definition of operator. See Part II.A.4.a., infra.
---------------------------------------------------------------------------
After reviewing the comments, the Commission has decided to modify paragraph (1) of the definition of collects or collection as proposed in the 2011 NPRM.
-
Collects or Collection, Paragraph (2)
Section 312.2(b) of the Rule defines ``collects or collection'' to cover enabling children to publicly post personal information (e.g., on social networking sites or on blogs), ``except where the operator deletes all individually identifiable information from postings by children before they are made public, and also deletes such information from the operator's records.'' \19\ This exception, often referred to as the ``100% deletion standard,'' was designed to enable sites and services to make interactive content available to children, without providing parental notice and obtaining consent, provided that all personal information was deleted prior to posting.\20\
---------------------------------------------------------------------------
\19\ Under the Rule, operators who offered services such as social networking, chat, and bulletin boards and who did not pre-
strip (i.e., completely delete) such information were deemed to have ``disclosed'' personal information under COPPA's definition of disclosure. See 16 CFR 312.2.
\20\ See P. Marcus, Remarks from COPPA's Exceptions to Parental Consent Panel at the Federal Trade Commission's Roundtable: Protecting Kids' Privacy Online 310 (June 2, 2010), available at http://www.ftc.gov/bcp/workshops/coppa/COPPARuleReview_Transcript.pdf.
---------------------------------------------------------------------------
The 2010 FRN sought comment on whether to change the 100% deletion standard, whether automated systems used to review and post child content could meet this standard, and whether
Page 3974
the Commission had provided sufficient guidance on the deletion of personal information.\21\ In response, several commenters urged a new standard, arguing that the 100% deletion standard, while well-
intentioned, was an impediment to operators' implementation of sophisticated automated filtering technologies that may actually aid in the detection and removal of personal information.\22\
---------------------------------------------------------------------------
\21\ See 75 FR at 17090, Question 9.
\22\ See Entertainment Software Association (``ESA'') (comment 20, 2010 FRN), at 13-14; R. Newton (comment 46, 2010 FRN), at 4; Privo, Inc. (comment 50, 2010 FRN), at 5; B. Szoka (comment 59, 2010 FRN), at 19; see also Wired Safety (comment 68, 2010 FRN), at 15.
---------------------------------------------------------------------------
In the 2011 NPRM, the Commission stated that the 100% deletion standard set an unrealistic hurdle to operators' implementation of automated filtering systems that could promote engaging and appropriate online content for children, while ensuring strong privacy protections by design. To address this, the Commission proposed replacing the 100% deletion standard with a ``reasonable measures'' standard. Under this approach, an operator would not be deemed to have collected personal information if it takes reasonable measures to delete all or virtually all personal information from a child's postings before they are made public, and also to delete such information from its records.''\23\
---------------------------------------------------------------------------
\23\ See 76 FR at 59808.
---------------------------------------------------------------------------
Although the Institute for Public Representation raised concerns about the effectiveness of automated filtering techniques,\24\ most comments were resoundingly in favor of the ``reasonable measures'' standard. For example, one commenter stated that the revised language would enable the use of automated procedures that could provide ``increased consistency and more effective monitoring than human monitors,''\25\ while another noted that it would open the door to ``cost-efficient and reliable means of monitoring children's communications.''\26\ Several commenters noted that the proposed reasonable measures standard would likely encourage the creation of more rich, interactive online content for children.\27\ Another commenter noted that the revised provision, by offering greater flexibility for technological solutions, should help minimize the burden of COPPA on children's free expression.\28\
---------------------------------------------------------------------------
\24\ See Institute for Public Representation (comment 71, 2011 NPRM), at 19.
\25\ See NCTA (comment 113, 2011 NPRM), at 8.
\26\ DMA (comment 37, 2011 NPRM), at 7.
\27\ See DMA id.; Institute for Public Representation (comment 71, 2011 NPRM), at 3; kidSAFE Seal Program (comment 81, 2011 NPRM), at 5; NCTA (comment 113, 2011 NPRM), at 8; Toy Industry Association (comment 163, 2011 NPRM), at 8.
\28\ See TechFreedom (comment 159, 2011 NPRM), at 6.
---------------------------------------------------------------------------
The Commission is persuaded that the 100% deletion standard should be replaced with a reasonable measures standard. The reasonable measures standard strikes the right balance in ensuring that operators have effective, comprehensive measures in place to prevent public online disclosure of children's personal information and ensure its deletion from their records, while also retaining the flexibility operators need to innovate and improve their mechanisms for detecting and deleting such information. Therefore, the final Rule amends paragraph (2) of the definition of collects or collection to adopt the reasonable measures standard proposed in the 2011 NPRM.
-
Collects or Collection, Paragraph (3)
In the 2011 NPRM, the Commission proposed to modify paragraph (3) of the Rule's definition of collects or collection to clarify that it includes all means of passively collecting personal information from children online, irrespective of the technology used. The Commission sought to accomplish this by removing from the original definition the language ``or use of any identifying code linked to an individual, such as a cookie.''\29\
---------------------------------------------------------------------------
\29\ 76 FR at 59808.
---------------------------------------------------------------------------
The Commission received several comments supporting,\30\ and several comments opposing,\31\ this proposed change. Those opposing the change generally believed that this change somehow expanded the definition of personal information. As support for their argument, these commenters also referenced the Commission's proposal to include persistent identifiers within the definition of personal information.
---------------------------------------------------------------------------
\30\ Privacy Rights Clearinghouse indicated its belief that this change would give operators added incentive to notify parents of their information collection practices, particularly with regard to online tracking and behavioral advertising. See Privacy Rights Clearinghouse (comment 131, 2011 NPRM), at 2; see also Consumers Union (comment 29, 2011 NPRM), at 2; kidSAFE Seal Program (comment 81, 2011 NPRM), at 6.
\31\ See DMA (comment 37, 2011 NPRM), at 9-10; IAB (comment 73, 2011 NPRM), at 12; NCTA (comment 113, 2011 NPRM), at 17-18; National Retail Federation (comment 114, 2011 NPRM), at 2-3; TechAmerica (comment 157, 2011 NPRM), at 5-6.
---------------------------------------------------------------------------
The Commission believes that paragraph (3), as proposed in the 2011 NPRM, is sufficiently understandable. The paragraph does nothing to alter the fact that the Rule covers only the collection of personal information. Moreover, the final Rule's exception for the limited use of persistent identifiers to support internal operations--312.5(c)(7)--
clearly articulates the specific criteria under which an operator will be exempt from the Rule's notice and consent requirements in connection with the passive collection of a persistent identifier.\32\ Accordingly, the Commission adopts the definition of collects or collection as proposed in the 2011 NPRM.
---------------------------------------------------------------------------
\32\ See Part II.C.10.g., infra.
---------------------------------------------------------------------------
2. Definition of Disclose or Disclosure
In the 2011 NPRM, the Commission proposed making several minor modifications to Section 312.2 of the Rule's definition of disclosure, including broadening the title of the definition to disclose or disclosure to clarify that in every instance in which the Rule refers to instances where an operator ``discloses'' information, the definition of disclosure shall apply.\33\ In addition, the Commission proposed moving the definitions of release of personal information and support for the internal operations of the Web site or online service contained within the definition of disclosure to make them stand-alone definitions within Section 312.2 of the Rule.\34\
---------------------------------------------------------------------------
\33\ See 2011 NPRM, 76 FR at 59809.
\34\ The Commission intended this change to clarify what was meant by the terms release of personal information and support for the internal operations of the Web site or online service, where those terms are referenced elsewhere in the Rule and are not directly connected with the terms disclose or disclosure.
---------------------------------------------------------------------------
One commenter asked the Commission to modify paragraph (2) of the proposed definition by adding an opening clause linking it to the definition of collects or collection.\35\ While this commenter did not state its reasons for the proposed change, the Commission believes that the language of paragraph (2) is sufficiently clear so as not to warrant making the change suggested. Therefore, the Commission modifies the definition of disclosure or disclosure as proposed in the 2011 NPRM.
---------------------------------------------------------------------------
\35\ See kidSAFE Seal Program (comment 81, 2011 NPRM), at 8 (``Paragraph (b) under the definition of ``disclose or disclosure'' should have the following opening clause: Subject to paragraph (b) under the definition of ``collects or collection,'' making personal information collected by an operator from a child publicly available * * *.'').
---------------------------------------------------------------------------
3. Definition of Online Contact Information
Section 312.2 of the Rule defines online contact information as ``an email address or any other substantially similar identifier that permits direct contact with a person online.'' The 2011 NPRM proposed clarifications to the definition to flag that the term broadly covers all identifiers that permit direct
Page 3975
contact with a person online and to ensure consistency between the definition of online contact information and the use of that term within the definition of personal information.\36\ The proposed revised definition identified commonly used online identifiers, including email addresses, instant messaging (``IM'') user identifiers, voice over Internet protocol (``VOIP'') identifiers, and video chat user identifiers, while also clarifying that the list of identifiers was non-exhaustive and would encompass other substantially similar identifiers that permit direct contact with a person online.\37\ The Commission received few comments addressing this proposed change.
---------------------------------------------------------------------------
\36\ The Rule's definition of personal information included the sub-category ``an email address or other online contact information, including but not limited to an instant messaging user identifier, or a screen name that reveals an individual's email address.'' The 2011 NPRM proposed replacing that sub-category of personal information with online contact information.
\37\ 76 FR at 59810.
---------------------------------------------------------------------------
One commenter opposed the modification, asserting that IM, VOIP, and video chat user identifiers do not function in the same way as email addresses. The commenter's rationale for this argument was that not all IM identifiers reveal the IM system in use, which information is needed to directly contact a user.\38\ The Commission does not find this argument persuasive. While an IM address may not reveal the IM program provider in every instance, it very often does. Moreover, several IM programs allow users of different messenger programs to communicate across different messaging platforms. Like email, instant messaging is a communications tool that allows people to communicate one-to-one or in groups B sometimes in a faster, more real-time fashion than through email. The Commission finds, therefore, that IM identifiers provide a potent means to contact a child directly.
---------------------------------------------------------------------------
\38\ See DMA (comment 37, 2011 NPRM), at 11.
---------------------------------------------------------------------------
Another commenter asked the Commission to expand the definition of online contact information to include mobile phone numbers. The commenter noted that, given the Rule's coverage of mobile apps and web-
based text messaging programs, operators would benefit greatly from collecting a parent's mobile phone number (instead of an email address) in order to initiate contact for notice and consent.\39\ The Commission recognizes that including mobile phone numbers within the definition of online contact information could provide operators with a useful tool for initiating the parental notice process through either SMS text or a phone call. It also recognizes that there may be advantages to parents for an operator to initiate contact via SMS text B among them, that parents generally have their mobile phones with them and that SMS text is simple and convenient.\40\ However, the statute did not contemplate mobile phone numbers as a form of online contact information, and the Commission therefore has determined not to include mobile phone numbers within the definition.\41\ Thus, the final Rule adopts the definition of online contact information as proposed in the 2012 SNPRM.
---------------------------------------------------------------------------
\39\ kidSAFE Seal Program (comment 81, 2011 NPRM), at 7. Acknowledging the Commission's position that cell phone numbers are outside of the statutory definition of online contact information, kidSAFE advocates for a statutory change, if needed, to enable mobile app operators, in particular, to reach parents using contact information ``relevant to their ecosystem.''
\40\ At the same time, the Commission believes it may be impractical to expect children to correctly distinguish between mobile and land-line phones when asked for their parents' mobile numbers.
\41\ Moreover, given that the final Rule's definition of online contact information encompasses a broad, non-exhaustive list of online identifiers, operators will not be unduly burdened by the Commission's determination that cell phone numbers are not online contact information.
---------------------------------------------------------------------------
4. Definitions of Operator and Web Site or Online Service Directed to Children
In the 2012 SNPRM, the Commission proposed modifying the definitions of both operator and Web site or online service directed to children to allocate and clarify the responsibilities under COPPA when independent entities or third parties, e.g., advertising networks or downloadable plug-ins, collect information from users through child-
directed sites and services. Under the proposed revisions, the child-
directed content provider would be strictly liable for personal information collected by third parties through its site. The Commission reasoned that, although the child-directed site or service may not own, control, or have access to the personal information collected, such information is collected on its behalf due to the benefits it receives by adding more attractive content, functionality, or advertising revenue. The Commission also noted that the primary-content provider is in the best position to know that its site or service is directed to children, and is appropriately positioned to give notice and obtain consent.\42\ By contrast, if the Commission failed to impose obligations on the content providers, there would be no incentive for child-directed content providers to police their sites or services, and personal information would be collected from young children, thereby undermining congressional intent. The Commission also proposed imputing the child-directed nature of the content site to the entity collecting the personal information only if that entity knew or had reason to know that it was collecting personal information through a child-directed site.\43\
---------------------------------------------------------------------------
\42\ 2012 SNPRM, 77 FR at 46644. The Commission acknowledged that this decision reversed a previous policy choice to place the burden of notice and consent entirely upon the information collection entity.
\43\ In so doing, the Commission noted that it believed it could hold the information collection entity strictly liable for such collection because, when operating on child-directed properties, that portion of an otherwise general audience service could be deemed directed to children. 2012 SNPRM, 77 FR at 46644-46645.
---------------------------------------------------------------------------
Most of the comments opposed the Commission's proposed modifications. Industry comments challenged the Commission's statutory authority for both changes and the breadth of the language, and warned of the potential for adverse consequences. In essence, many industry comments argued that the Commission may not apply COPPA where independent third parties collect personal information through child-
directed sites,\44\ and that even if the Commission had some authority, exercising it would be impractical because of the structure of the ``online ecosystem.''\45\ Many privacy and children's advocates agreed with the 2012 SNPRM proposal to hold child-directed content providers strictly liable, but some expressed concern about holding plug-ins and advertising networks to a lesser standard.\46\
---------------------------------------------------------------------------
\44\ See, e.g., Facebook (comment 33, 2012 SNPRM), at 3-4.
\45\ See Microsoft (comment 66, 2012 SNPRM), at 6; IAB (comment 49, 2012 SNPRM), at 5; DMA (comment 28, 2012 SNPRM), at 5.
\46\ See, e.g., Institute for Public Representation (comment 52, 2012 SNPRM), at 20; Common Sense Media (comment 20, 2012 SNPRM), at 6.
---------------------------------------------------------------------------
For the reasons discussed below, the Commission, with some modifications to the proposed Rule language, will retain the strict liability standard for child-directed content providers that allow other online services to collect personal information through their sites. The Commission will deem a plug-in or other service to be a covered co-operator only where it has actual knowledge that it is collecting information through a child-directed site.
-
Strict Liability for Child-Directed Content Sites: Definition of Operator
Implementing strict liability as described above requires modifying the current definition of operator. The Rule, which mirrors the statutory language, defines operator in pertinent part, as
Page 3976
``any person who operates a Web site located on the Internet or an online service and who collects or maintains personal information from or about the users of or visitors to such Web site or online service, or on whose behalf such information is collected or maintained, where such Web site or online service is operated for commercial purposes, including any person offering products or services for sale through that Web site or online service, involving commerce * * *'' \47\
---------------------------------------------------------------------------
\47\ 15 U.S.C. 6501(2). The Rule's definition of operator reflects the statutory language. See 16 CFR 312.2.
---------------------------------------------------------------------------
In the 2012 SNPRM, the Commission proposed adding a proviso to that definition stating that personal information is collected or maintained on behalf of an operator where it is collected in the interest of, as a representative of, or for the benefit of, the operator.
Industry, particularly online content publishers, including app developers, criticized this proposed change.\48\ Industry comments argued that the phrase ``on whose behalf'' in the statute applies only to agents and service providers,\49\ and that the Commission lacks the authority to interpret the phrase more broadly to include any incidental benefit that results when two parties enter a commercial transaction.\50\ Many commenters pointed to an operator's post-
collection responsibilities under COPPA, e.g., mandated data security and affording parents deletion rights, as evidence that Congress intended to cover only those entities that control or have access to the personal information.\51\
---------------------------------------------------------------------------
\48\ See, e.g., Application Developers Alliance (comment 5, 2012 SNPRM), at 3-4; Association of Competitive Technology (comment 7, 2012 SNPRM), at 4-5; IAB (comment 49, 2012 SNPRM), at 5-6; Online Publishers Association (comment 72, 2012 SNPRM), at 10-11; Magazine Publishers of America (comment 61, 2012 SNPRM), at 3-5; The Walt Disney Co. (comment 96, 2012 SNPRM), at 4-5; S. Weiner (comment 97, 2012 SNPRM), at 1-2; WiredSafety (comment 98, 2012 SNPRM), at 3.
\49\ See DMA (comment 28, 2012 SNPRM), at 12; Internet Commerce Coalition (comment 53, 2012 SNPRM), at 5; TechAmerica (comment 87, 2012 SNPRM), at 2-3.
\50\ See, e.g., Gibson, Dunn & Crutcher (comment 39, 2012 SNPRM), at 7-9; Facebook (comment 33, 2012 SNPRM), at 6 (entities acting primarily for their own benefit not considered to be acting on behalf of another party).
\51\ See, e.g., Business Software Alliance (comment 12, 2012 SNPRM), at 2-4; Internet Commerce Coalition (comment 53, 2012 SNPRM), at 5; see also, e.g., IAB (comment 49, 2012 SNPRM), at 5; DMA (comment 28, 2012 SNPRM), at 6; Online Publishers Association (comment 72, 2012 SNPRM), at 10-11; The Walt Disney Co. (comment 96, 2012 SNPRM), at 3-5.
---------------------------------------------------------------------------
Commenters also raised a number of policy objections. Many argued that child-directed properties, particularly small app developers, would face unreasonable compliance costs and that the proposed revisions might choke off their monetization opportunities,\52\ thus decreasing the incentive for developers to create engaging and educational content for children.\53\ They also argued that a strict liability standard is impractical given the current online ecosystem, which does not rely on close working relationships and communication between content providers and third parties that help monetize that content.\54\ Some commenters urged the Commission to consider a safe harbor for content providers that exercise some form of due diligence regarding the information collection practices of plug-ins present on their site.\55\
---------------------------------------------------------------------------
\52\ See Center for Democracy & Technology (``CDT'') (comment 15, 2012 SNPRM), at 4-5; DMA (comment 28, 2012 SNPRM), at 5; Google (comment 41, 2012, SNPRM), at 3-4; Lynette Mattke (comment 63, 2012 SNPRM).
\53\ See Google (comment 41, 2012 SNPRM), at 3; Application Developers Alliance (comment 5, 2012 SNPRM), at 5; Association for Competitive Technology (comment 6, 2012 SNPRM), at 5; The Walt Disney Co. (comment 96, 2012 SNPRM), at 4; ConnectSafely (comment 21, 2012 SNPRM), at 2.
\54\ See Application Developers Alliance (comment 5, 2012 SNPRM), at 3; Online Publishers Association (comment 72, 2012 SNPRM), at 11; The Walt Disney Co. (comment 96, 2012 SNPRM), at 4; DMA (comment 28, 2012 SNPRM), at 4.
\55\ See, e.g., Online Publishers Association (comment 72, 2012 SNPRM), at 11 (publisher should be entitled to rely on third party's representations about its information practices); The Walt Disney Co. (comment 96, 2012 SNPRM), at 5 (operator of a site directed to children should be permitted to rely on the representations made by third parties regarding their personal information collection practices, as long as the operator has undertaken reasonable efforts to limit any unauthorized data collection); Internet Commerce Coalition (comment 53, 2012 SNPRM), at 6 (the Commission should state that operators whose sites or services are targeted to children should bind third party operators whom they know are collecting personal information through their sites or services to comply with COPPA with regard to that information collection).
---------------------------------------------------------------------------
Privacy organizations generally supported imposing strict liability on content providers. They agreed with the Commission's statement in the 2012 SNPRM that the first-party content provider is in a position to control which plug-ins and software downloads it integrates into its site and that it benefits by allowing information collection by such third parties.\56\ They also noted how unreasonable it would be for parents to try to decipher which entity might actually be collecting data through the child-directed property.\57\
---------------------------------------------------------------------------
\56\ See Institute for Public Representation (comment 52, 2012 SNPRM), at 18-19; Common Sense Media (comment 20, 2012 SNPRM), at 4-
6; EPIC (comment 31, 2012 SNPRM), at 5-6; Catholic Bishops (comment 92, 2012 SNPRM), at 3; CDT (comment 15, 2012 SNPRM), at 3.
\57\ See Institute for Public Representation (comment 52, 2012 SNPRM), at 19; Common Sense Media (comment 20, 2012 SNPRM), at 5.
---------------------------------------------------------------------------
Finally, many commenters expressed concern that the language describing ``on whose behalf'' reaches so broadly as to cover not only child-directed content sites, but also marketplace platforms such as Apple's iTunes App Store and Google's Android market (now Google Play) if they offered child-directed apps on their platforms.\58\ These commenters urged the Commission to revise the language of the Rule to exclude such platforms.
---------------------------------------------------------------------------
\58\ See CDT (comment 15, 2012 SNPRM), at 5; Apple (comment 4, 2012 SNPRM), at 3-4; Assert ID (comment 6, 2012 SNPRM), at 5.
---------------------------------------------------------------------------
After considering the comments, the Commission retains a strict liability standard for child-directed sites and services that allow other online services to collect personal information through their sites.\59\ The Commission disagrees with the views of commenters that this is contrary to Congressional intent or the Commission's statutory authority. The Commission does not believe Congress intended the loophole advocated by many in industry: Personal information being collected from children through child-directed properties with no one responsible for such collection.
---------------------------------------------------------------------------
\59\ Although this issue is framed in terms of child-directed content providers integrating plug-ins or other online services into their sites because that is by far the most likely scenario, the same strict liability standard would apply to a general audience content provider that allows a plug-in to collect personal information from a specific user when the provider has actual knowledge the user is a child.
---------------------------------------------------------------------------
Nor is the Commission persuaded by comments arguing that the phrase ``on whose behalf'' must be read extremely narrowly, encompassing only an agency relationship. Case law supports a broader interpretation of that phrase.\60\ Even some commenters opposed to the Commission's interpretation have
Page 3977
acknowledged that the Commission's proposal is based on ``an accurate recognition that online content monetization is accomplished through a complex web of inter-related activities by many parties,'' and have noted that to act on behalf of another is to do what that person would ordinarily do herself if she could.\61\ That appears to be precisely the reason many first-party content providers integrate these services. As one commenter pointed out, content providers ``have chosen to devote their resources to develop great content, and to let partners help them monetize that content. In part, these app developers and publishers have made this choice because collecting and handling children's data internally would require them to take on liability risk and spend compliance resources that they do not have.'' \62\ Moreover, content-
providing sites and services often outsource the monetization of those sites ``to partners'' because they do not have the desire to handle it themselves.\63\
---------------------------------------------------------------------------
\60\ National Organization for Marriage v. Daluz, 654 F.3d 115, 121 (1st Cir. 2011) (statute requiring expenditure reports by independent PAC to the treasurer of the candidate ``on whose behalf'' the expenditure was made meant to the candidate who stands to benefit from the independent expenditure's advocacy); accord American Postal Workers Union v. United States Postal Serv., 595 F. Supp 1352 (D.D.C. 1984) (Postal Union's activities held to be ``on behalf of'' a political campaign where evidence showed union was highly politicized, with goal of electing a particular candidate); Sedwick Claims Mgmt. Servs. v. Barrett Business Servs., Inc., 2007 WL 1053303 (D. Or. 2007) (noting that 9th Circuit has interpreted the phrase ``on behalf of'' to include both ``to the benefit of'' and in a representative capacity); United States v. Dish Network, LLC, 2010 U.S. Dist. LEXIS 8957, 10 (C.D. Ill. Feb. 3, 2010) (reiterating the court's previous opinion that the plain meaning of the phrases ``on whose behalf'' or ``on behalf of'' is an act by a representative of, or an act for the benefit of, another).
\61\ Application Developers Alliance (comment 5, 2012 SNPRM), at 2; see also Gibson, Dunn & Crutcher (comment 39, 2012 SNPRM), at 7.
\62\ Application Developers Alliance (comment 5, 2012 SNPRM), at 4.
\63\ Id.; see also Association for Competitive Technology (comment 7, 2012 SNPRM), at 5; see generally DMA (comment 28, 2012 SNPRM), at 5; Facebook (comment 33, 2012 SNPRM), at 3; Online Publishers Association (comment 72, 2012 SNPRM), at 11.
---------------------------------------------------------------------------
In many cases, child-directed properties integrate plug-ins to enhance the functionality or content of their properties or gain greater publicity through social media in an effort to drive more traffic to their sites and services. Child-directed properties also may obtain direct compensation or increased revenue from advertising networks or other plug-ins. These benefits to child-directed properties are not merely incidental; as the comments point out, the benefits may be crucial to their continued viability.\64\
---------------------------------------------------------------------------
\64\ Id.
---------------------------------------------------------------------------
The Commission recognizes the potential burden that strict liability places on child-directed content providers, particularly small app developers. The Commission also appreciates the potential for discouraging dynamic child-directed content. Nevertheless, when it enacted COPPA, Congress imposed absolute requirements on child-directed sites and services regarding restrictions on the collection of personal information; those requirements cannot be avoided through outsourcing offerings to other operators in the online ecosystem. The Commission believes that the potential burden on child-directed sites discussed by the commenters in response to the 2012 SNPRM will be eased by the more limited definition of persistent identifiers, the more expansive definition of support for internal operations adopted in the Final Rule, and the newly-created exception to the Rule's notice and parental consent requirements that applies when an operator collects only a persistent identifier and only to support the operator's internal operations.\65\
---------------------------------------------------------------------------
\65\ See Part II.A.5.b., infra (discussion of persistent identifiers and support of internal operations).
---------------------------------------------------------------------------
The Commission considered including the ``due-diligence'' safe harbor for child-directed content providers that many of the comments proposed.\66\ Nevertheless, as many other comments pointed out, it cannot be the responsibility of parents to try to pierce the complex infrastructure of entities that may be collecting their children's personal information through any one site.\67\ For child-directed properties, one entity, at least, must be strictly responsible for providing parents notice and obtaining consent when personal information is collected through that site. The Commission believes that the primary-content site or service is in the best position to know which plug-ins it integrates into its site, and is also in the best position to give notice and obtain consent from parents.\68\ Although the Commission, in applying its prosecutorial discretion, will consider the level of due diligence a primary-content site exercises, the Commission will not provide a safe harbor from liability.
---------------------------------------------------------------------------
\66\ The type of due diligence advocated ranged from essentially relying on a plug-in or advertising network's privacy policy to requiring an affirmative contract. See, e.g., The Walt Disney Co. (comment 96, 2012 SNPRM), at 5 (operator should be able to rely on third party's representations about its information collection practices, if operator makes reasonable efforts to limit unauthorized data collection); Gibson, Dunn & Crutcher (comment 39, 2012 SNPRM), at 23-24 (provide a safe harbor for operators that certify they do not receive, own, or control any personal information collected by third parties; alternatively, grant a safe harbor for operators that also certify they do not receive a specific benefit from the collection, or that obtain third party's certification of COPPA compliance); Internet Commerce Coalition (comment 53, 2012 SNPRM), at 6-7 (provide a safe harbor for operators whose policies prohibit third party collection on their sites).
\67\ See Common Sense Media (comment 20, 2012 SNPRM), at 4-5; EPIC (comment 31, 2012 SNPRM), at 6; Institute for Public Representation (comment 52, 2012 SNPRM), at 18-19.
\68\ Some commenters, although not conceding the need to impose strict liability on any party, noted that if the burden needed to fall on either the primary content provider or the plug-in, it was better to place it on the party that controlled the child-directed nature of the content. See, e.g., CTIA (comment 24, 2012 SNPRM), at 8-9; CDT (comment 15, 2012 SNPRM), at 4-5. Not surprisingly, industry members primarily in the business of providing content did not share this view. See, e.g., Association for Competitive Technology (comment 7, 2012 SNPRM), at 4-5; Business Software Alliance (comment 12, 2012 SNPRM), at 2-4; Entertainment Software Association (comment 32, 2102 SNPRM), at 9; Online Publishers Association (comment 72, 2012 SNPRM), at 10-11; The Walt Disney Co. (comment 96, 2012 SNPRM), at 6.
---------------------------------------------------------------------------
When it issued the 2012 SNPRM, the Commission never intended the language describing ``on whose behalf'' to encompass platforms, such as Google Play or the App Store, when such stores merely offer the public access to someone else's child-directed content. In these instances, the Commission meant the language to cover only those entities that designed and controlled the content, i.e., the app developer or site owner. Accordingly, the Commission has revised the language proposed in the 2012 SNPRM to clarify that personal information will be deemed to be collected on behalf of an operator where it benefits by allowing another person to collect personal information directly from users of such operator's site or service, thereby limiting the provision's coverage to operators that design or control the child-directed content.\69\ Accordingly, the Final Rule shall state that personal information is collected or maintained on behalf of an operator when it is collected or maintained by an agent or service provider of the operator; or the operator benefits by allowing another person to collect personal information directly from users of such operator's Web site or online service.
---------------------------------------------------------------------------
\69\ This clarification to the term ``on behalf of'' is intended only to address platforms in instances where they function as an conduit to someone else's content. Platforms may well wear multiple hats and are still responsible for complying with COPPA if they themselves collect personal information directly from children.
---------------------------------------------------------------------------
-
Operators Collecting Personal Information Through Child-Directed Sites and Online Services: Moving to an Actual Knowledge Standard
In the 2012 SNPRM, the Commission proposed holding responsible as a co-operator any site or online service that ``knows or has reason to know'' it is collecting personal information through a host Web site or online service directed to children. Many commenters criticized this standard. Industry comments contended that such a standard is contrary to the statutory mandate that general audience services be liable only if they have actual knowledge they are collecting information from a child.\70\ They further
Page 3978
argued that the standard is vague because it is impossible to determine what type of notification would provide a ``reason to know.'' Thus, the commenters argued that the standard triggers a duty to inquire.\71\ In addition, commenters stated that even after inquiring, it might be impossible to determine which sites are truly directed to children (particularly in light of the Commission's revised definition of Web site directed to children to include those sites that are likely to attract a disproportionate percentage of children under 13).\72\ Conversely, many privacy advocates believed it is necessary to impose some duty of inquiry, or even strict liability, on the entity collecting the personal information.\73\
---------------------------------------------------------------------------
\70\ See Business Software Alliance (comment 12, 2012 SNPRM), at 4-5; Digital Advertising Alliance (comment 27, 2012 SNPRM), at 2; Google (comment 41, 2012 SNPRM), at 4; Internet Commerce Coalition (comment 53, 2012 SNPRM), at 7; Magazine Publishers of America (comment 61, 2012 SNPRM), at 8; Toy Industry Association (comment 89, 2012 SNPRM), at 10-11; see also ACLU (comment 3, 2012 SNPRM), at 2-3; TechAmerica (comment 87, 2012 SNPRM), at 3.
\71\ See CDT (comment 15, 2012 SNPRM), at 2; CTIA (comment 24, 2012 SNPRM), at 10; Entertainment Software Association (comment 32, 2012 SNPRM), at 9; Marketing Research Association (comment 62, 2012 SNPRM), at 2; Tangman (comment 85, 2012 SNPRM).
\72\ See DMA (comment 28, 2012 SNPRM), at 9; Magazine Publishers of America (comment 61, 2012 SNPRM), at 8; Menessec (comment 65, 2012 SNPRM); Privo (comment 76, 2012 SNPRM), at 8.
\73\ See Common Sense Media (comment 20, 2012 SNPRM), at 6; Institute for Public Representation (comment 52, 2012 SNPRM), at 20-
22.
---------------------------------------------------------------------------
After considering the comments, the Commission has decided that while it is appropriate to hold an entity liable under COPPA for collecting personal information on Web sites or online services directed to children, it is reasonable to hold such entity liable only where it has actual knowledge that it is collecting personal information directly from users of a child-directed site or service. In striking this balance by moving to an actual knowledge standard, the Commission recognizes that this is still contrary to the position advocated by many industry comments: That a plug-in or advertising network that collects personal information from users of both general audience and child-directed sites must be treated monolithically as a general audience service, liable only if it has actual knowledge that it is collecting personal information from a specific child.\74\ However, the COPPA statute also defines Web site or online service directed to children to include ``that portion of a commercial Web site or online service that is targeted to children.'' Where an operator of an otherwise general audience site or online service has actual knowledge it is collecting personal information directly from users of a child-directed site, and continues to collect that information, then, for purposes of the statute, it has effectively adopted that child-
directed content as its own and that portion of its service may appropriately be deemed to be directed to children.\75\
---------------------------------------------------------------------------
\74\ See Digital Advertising Alliance (comment 27, 2012 SNPRM), at 2; DMA (comment 28, 2012 SNPRM), at 8-9; Entertainment Software Association (comment 32, 2012 SNPRM), at 13-14.
\75\ Similarly, when a behavioral advertising network offers age-based advertising segments that target children under 13, that portion of its service becomes an online service directed to children. Contra DMA (comment 28, 2012 SNPRM), at 12. The Commission also believes that narrowing the definition of persistent identifiers and further revisions to the definition of Web site or online service directed to children ease (although not entirely eliminate) many of the concerns expressed in industry comments. See, e.g., CDT (comment 15, 2012 SNPRM), at 3; Digital Advertising Alliance (comment 27, 2012 SNPRM), at 2; Entertainment Software Association (comment 32, 2012 SNPRM), at 14 (combination of reason to know standard and expanded definition of persistent identifiers creates an unworkable result).
---------------------------------------------------------------------------
Commenters urged that, whatever standard the Commission ultimately adopts, it provide guidance as to when a plug-in or advertising network would be deemed to have knowledge that it is collecting information through a child-directed site or service.\76\ Knowledge, by its very nature, is a highly fact-specific inquiry. The Commission believes that the actual knowledge standard it is adopting will likely be met in most cases when: (1) A child-directed content provider (who will be strictly liable for any collection) directly communicates the child-directed nature of its content to the other online service; or (2) a representative of the online service recognizes the child-directed nature of the content. The Commission does not rule out that an accumulation of other facts would be sufficient to establish actual knowledge, but those facts would need to be analyzed carefully on a case-by-case basis.
---------------------------------------------------------------------------
\76\ See Microsoft (comment 66, 2012 SNPRM), at 2; TRUSTe (comment 90, 2012 SNPRM), at 4; see also Association for Competitive Technology (comment 7, 2012 SNPRM), at 3-4; Google (comment 41, 2012 SNPRM), at 4; DMA (comment 28, 2012 SNPRM), at 7; Viacom (comment 95, 2012 SNPRM), at 8-9.
---------------------------------------------------------------------------
5. Definition of Personal Information
-
Screen or User Names
The Rule defines personal information as including ``a screen name that reveals an individual's email address.'' \77\ In the 2011 NPRM, the Commission proposed to modify this definition to include ``a screen or user name where such screen or user name is used for functions other than or in addition to support for the internal operations of the Web site or online service.'' \78\ The Commission intended this change to address scenarios in which a screen or user name could be used by a child as a single credential to access multiple online properties, thereby permitting him or her to be directly contacted online, regardless of whether the screen or user name contained an email address.\79\
---------------------------------------------------------------------------
\77\ See 16 CFR 312.2 (paragraph (n), definition of personal information).
\78\ 2011 NPRM, 76 FR at 59810.
\79\ Id.
---------------------------------------------------------------------------
Some commenters expressed concern that the Commission's screen-name proposal would unnecessarily inhibit functions that are important to the operation of child-directed Web sites and online services.\80\ In response to this concern, the 2012 SNPRM proposed covering screen names as personal information only in those instances in which a screen or user name rises to the level of online contact information. In such cases, the Commission reasoned, a screen or user name functions much like an email address, an instant messaging identifier, or ``any other substantially similar identifier that permits direct contact with a person online.'' \81\
---------------------------------------------------------------------------
\80\ See DMA (comment 37, 2011 NPRM), at 15-16; ESA (comment 47, 2011 NPRM), at 9; NCTA (comment 113, 2011 NPRM), at 12; Scholastic (comment 144, 2011 NPRM), at 12; A. Thierer (comment 162, 2011 NPRM), at 6; TRUSTe (comment 164, 2011 NPRM), at 3; The Walt Disney Co. (comment 170, 2011 NPRM), at 21.
\81\ See 2011 NPRM, 76 FR at 59810 (proposed definition of online contact information).
---------------------------------------------------------------------------
The Commission received a number of comments in support of this change from industry associations and advocacy groups.\82\ Commenters recognized the change as providing operators with the flexibility to use screen or user names both for internal administrative purposes and across affiliated sites, services, or platforms without requiring prior parental notification or verifiable parental consent.\83\
---------------------------------------------------------------------------
\82\ See Common Sense Media (comment 20, 2012 SNPRM), at 7; Information Technology Industry Council (comment 51, 2012 SNPRM), at 2; Marketing Research Association (comment 62, 2012 SNPRM), at 3; Promotion Marketing Association (comment 77, 2012 SNPRM), at 8; TechAmerica (comment 87, 2012 SNPRM), at 5-6.
\83\ See, e.g., Promotion Marketing Association, id.
---------------------------------------------------------------------------
A number of commenters, however, despite clear language otherwise in the 2012 SNPRM, continued to express concern that the Commission's proposed revision would limit operators' use of anonymized screen names in place of children's real names in filtered chat, moderated interactive forums, or as log-in credentials providing users with seamless access to content across multiple platforms and devices.\84\ Some of these commenters
Page 3979
urged the Commission to refine the definition further, for example, by explicitly recognizing that the use of screen names for activities such as moderated chat will not be deemed as permitting ``direct contact'' with a child online and therefore will not require an operator using anonymous screen names to notify parents or obtain their consent.\85\ Others suggested a return to the Commission's original definition of screen or user names, i.e., only those that reveal an individual's online contact information (as newly defined).\86\ Yet others hoped to see the Commission carve out from the definition of screen or user name uses to support an operator's internal operations (such as using screen or user names to enable moderated or filtered chat and multiplayer game modes).\87\
---------------------------------------------------------------------------
\84\ See DMA (comment 28, 2012 SNPRM), at 16; ESA (comment 32, 2012 SNPRM), at 5; kidSAFE Seal Program (comment 56, 2012 SNPRM), at 5; NCTA (comment 69, 2012 SNPRM), at 4-5; Online Publishers Association (comment 72, 2012 SNPRM), at 12; Toy Industry Association (comment 89, 2012 SNPRM), at 13; TRUSTe (comment 90, 2012 SNPRM), at 5-6.
\85\ See Online Publishers Association (comment 72, 2012 SNPRM), at 12; TRUSTe TRUSTe (comment 90, 2012 SNPRM), at 5-6.
\86\ See kidSAFE Seal Program (comment 56, 2012 SNPRM), at 5.
\87\ See ESA (comment 32, 2012 SNPRM), at 5.
---------------------------------------------------------------------------
The Commission sees no need to qualify further the proposed description of screen or user name. The description identifies precisely the form of direct, private, user-to-user contact the Commission intends the Rule to cover--i.e., ``online contact that can now be achieved via several methods besides electronic mail.'' \88\ The Commission believes the description permits operators to use anonymous screen and user names in place of individually identifiable information, including use for content personalization, filtered chat, for public display on a Web site or online service, or for operator-to-
user communication via the screen or user name. Moreover, the definition does not reach single log-in identifiers that permit children to transition between devices or access related properties across multiple platforms. For these reasons, the Commission modifies the definition of personal information, as proposed in the 2012 SNPRM, to include ``a screen or user name where it functions in the same manner as online contact information, as defined in this Section.''
---------------------------------------------------------------------------
\88\ See Common Sense Media (comment 20, 2012 SNPRM), at 7.
---------------------------------------------------------------------------
-
Persistent Identifiers and Support for Internal Operations
Persistent identifiers have long been covered by the COPPA Rule, but only where they are associated with individually identifiable information.\89\ In the 2011 NPRM, and again in the 2012 SNPRM, the Commission proposed broader Rule coverage of persistent identifiers.
---------------------------------------------------------------------------
\89\ See 16 CFR 312.2 of the existing Rule (paragraph (f), definition of personal information).
---------------------------------------------------------------------------
First, in the 2011 NPRM, the Commission proposed covering persistent identifiers in two scenarios--(1) where they are used for functions other than or in addition to support for the internal operations of the Web site or online service, and (2) where they link the activities of a child across different Web sites or online services.\90\ After receiving numerous comments on the proposed inclusion of persistent identifiers within the definition of personal information,\91\ the Commission refined its proposal in the 2012 SNPRM.
---------------------------------------------------------------------------
\90\ See 2011 NPRM, 76 FR at 59812 (proposed definition of personal information, paragraphs (g) and (h)).
\91\ Those comments are discussed in the 2012 SNPRM, 77 FR at 46647.
---------------------------------------------------------------------------
In the Commission's refined proposal in the 2012 SNPRM, the definition of personal information would include a persistent identifier ``that can be used to recognize a user over time, or across different Web sites or online services, where such persistent identifier is used for functions other than or in addition to support for the internal operations of the Web site or online service.'' \92\ The Commission also proposed to set forth with greater specificity the types of permissible activities that would constitute support for internal operations.\93\ The proposed revision to this latter definition was intended to accomplish three goals: (1) To incorporate into the Rule text many of the types of activities--user authentication, maintaining user preferences, serving contextual advertisements,\94\ and protecting against fraud or theft--that the Commission initially discussed as permissible in the 2011 NPRM; (2) to specifically permit the collection of persistent identifiers for functions related to site maintenance and analysis, and to perform network communications that many commenters viewed as crucial to their ongoing operations;\95\ and (3) to make clear that none of the information collected may be used or disclosed to contact a specific individual, including through the use of behavioral advertising.\96\
---------------------------------------------------------------------------
\92\ Id.
\93\ The proposed definition of support for internal operations was published at 77 FR 46648.
\94\ Contextual advertising is ``the delivery of advertisements based upon a consumer's current visit to a Web page or a single search query, without the collection and retention of data about the consumer's online activities over time.'' See Preliminary FTC Staff Report, ``Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers,'' (Dec. 2010), at 55 n.134, available at http://ftc.gov/os/2010/12/101201privacyreport.pdf. Such advertising is more transparent and presents fewer privacy concerns as compared to the aggregation and use of data across sites and over time for marketing purposes. See id.
\95\ For example, the term ``personalize the content on the Web site or online service'' was intended to permit operators to maintain user-driven preferences, such as game scores, or character choices in virtual worlds.
\96\ Id.
---------------------------------------------------------------------------
Most of the commenters who responded to the 2012 SNPRM opposed the Commission's refinement. Many continued to argue, as they had done in response to the 2011 NPRM, that because persistent identifiers only permit contact with a device, not a specific individual, the Commission was exceeding its statutory authority by defining them as personal information.\97\ Others argued strenuously for the benefits to children, parents, operators, and commerce of collecting anonymous information on, and delivering advertisements to, unknown or unnamed users.\98\ Some commenters maintained that, to comply with COPPA's notice and consent requirements in the context of persistent identifiers, sites would be forced to collect more personal information on their users, contrary to COPPA's goals of data minimization.\99\
---------------------------------------------------------------------------
\97\ 15 U.S.C. 6501(8)(F) defines personal information to include ``any other identifier that the Commission determines permits the physical or online contacting of a specific individual.'' See, e.g., Gibson Dunn & Crutcher (comment 39, 2012 SNPRM), at 20 (``This expansion of the definition of `personal information' is inconsistent with the text of COPPA, which limits `personal information' to categories of information that by themselves can be used to identify and contact a specific individual. Every category of information that COPPA enumerates--
name, physical address, email address, telephone number, and Social Security number--as well as the catch-all for `any other identifier that the Commission determines permits the physical or online contacting of a specific individual,' 15 U.S.C. Sec. 6501(8)(A)-
(F)--is information that makes it possible to identify and contact a specific individual''); see also Business Software Alliance (comment 12, 2012 SNPRM), at 5-6; CTIA (comment 24, 2012 SNPRM), at 14-17; Chappell (comment 18, 2012 SNPRM), at 1; DMA (comment 28, 2012 SNPRM), at 10; Facebook (comment 33, 2012 SNPRM), at 9; Information Technology Industry Council (comment 51, 2012 SNPRM), at 2; Internet Commerce Coalition (comment 53, 2012 SNPRM), at 11-13; Microsoft (comment 66, 2012 SNPRM), at 3; NetChoice (comment 70, 2012 SNPRM), at 7; TechFreedom (comment 88, 2012 SNPRM), at 5-6.
\98\ See Application Developers Alliance (comment 5, 2012 SNPRM), at 6; Business Software Alliance (comment 12, 2012 SNPRM), at 6); Information Technology and Innovation Foundation (comment 50, 2012 SNPRM), at 6-7; NetChoice (comment 70, 2012 SNPRM), at 6.
\99\ Facebook (comment 33, 2012 SNPRM), at 9-10; Google (comment 41, 2012 SNPRM), at 5; J. Holmes (comment 47, 2012 SNPRM).
---------------------------------------------------------------------------
Because the proposed definition of persistent identifiers ran hand-
in-hand with the proposed carve-out for
Page 3980
permissible activities, most commenters also opined on the proposed scope of the definition of support for internal operations.\100\ Unsurprisingly, these commenters urged the Commission to broaden the definition either to make the list of permissible activities non-
exhaustive,\101\ or to clarify that activities such as ensuring legal and regulatory compliance, intellectual property protection, payment and delivery functions, spam protection, statistical reporting, optimization, frequency capping, de-bugging, market research, and advertising and marketing more generally would not require parental notification and consent on COPPA-covered sites or services.\102\ Other commenters expressed confusion about which entities operating on or through a property could take advantage of the support for internal operations exemption.\103\ Children's advocacy groups, by contrast, expressed fear that the proposed definition was already ``so broad that it could exempt the collection of many persistent identifiers used to facilitate targeted marketing.''\104\
---------------------------------------------------------------------------
\100\ Association for Competitive Technology (comment 7, 2012 SNPRM), at 5; Business Software Alliance (comment 12, 2012 SNPRM), at 6-7; CTIA (comment 24, 2012 SNPRM), at 17-18; DMA (comment 28, 2012 SNPRM), at 10-12; Internet Commerce Coalition (comment 53, 2012 SNPRM), at 12; Microsoft (comment 66, 2012 SNPRM), at 3-5; NetChoice (comment 70, 2012 SNPRM), at 8-9.
\101\ See DMA (comment 28, 2012 SNPRM), at 11 (warning that an exhaustive list is likely to have unintended consequences if companies are not afforded flexibility as technologies evolve); Digital Advertising Alliance (comment 27, 2012 SNPRM), at 3; Internet Commerce Coalition (comment 53, 2012 SNPRM), at 3-4, 12 (``The definition of `support for the internal operations' of a Web site is too narrow. * * * This list of `exempt' collections is incomplete and risks quickly becoming outmoded.''); Magazine Publishers of America (comment 61, 2012 SNPRM), at 11; Online Publishers Association (comment 72, 2012 SNPRM), at 8; Promotion Marketing Association (comment 77, 2012 SNPRM), at 7; Computer and Communications Industry Association (comment 27, 2011 NPRM), at 4 (the exceptions are narrow and ``immobile short of another rulemaking'').
\102\ See, e.g., Association for Competitive Technology (comment 7, 2012 SNPRM), at 5; IAB (comment 49, 2012 SNPRM), at 4; TechFreedom (comment 88, 2012 SNPRM), at 11; Toy Industry Association (comment 89, 2012 SNPRM), at 15; Viacom Inc. (comment 95, 2012 SNPRM), at 13.
\103\ CDT (comment 15, 2012 SNPRM), at 6-7; Google (comment 41, 2012 SNPRM), at 5; Toy Industry Association (comment 89, 2012 SNPRM), at 14.
\104\ Institute for Public Representation (comment 52, 2012 SNPRM), at 13.
---------------------------------------------------------------------------
Several commenters supported the Commission's premise that the collection of certain persistent identifiers permits the physical or online contacting of a specific individual, but asked the Commission to take a different tack to regulating such identifiers. Rather than cover all persistent identifiers and then carve out permissible uses, these commenters suggested a simpler approach: the Commission should apply the Rule only to those persistent identifiers used for the purposes of contacting a specific child, including through online behavioral advertising.\105\
---------------------------------------------------------------------------
\105\ See CDT (comment 15, 2012 SNPRM), at 6 (``We do, however, agree with the Commission that behavioral targeting of children using unique identifiers should trigger COPPA compliance obligations''); Internet Commerce Coalition (comment 53, 2012 SNPRM), at 12; see also AT&T (comment 8, 2011 NPRM), at 7; Future of Privacy Forum (comment 55, 2011 NPRM), at 2; WiredTrust (comment 177, 2011 NPRM), at 9; Visa Inc. (comment 168, 2011 NPRM), at 2.
---------------------------------------------------------------------------
The Commission continues to believe that persistent identifiers permit the online contacting of a specific individual. As the Commission stated in the 2011 NPRM, it is not persuaded by arguments that persistent identifiers only permit the contacting of a device.\106\ This interpretation ignores the reality that, at any given moment, a specific individual is using that device. Indeed, the whole premise underlying behavioral advertising is to serve an advertisement based on the perceived preferences of the individual user.\107\
---------------------------------------------------------------------------
\106\ See 2011 NPRM, 76 FR at 59811.
\107\ See J. Bowman, ``Real-time Bidding--How It Works and How To Use It,'' Warc Exclusive (Feb. 2011), available at http://www.improvedigital.com/en/wp-content/uploads/2011/09/Warc-RTB-Feb11.pdf (``With real-time bidding, advertisers can decide to put a specific ad in front of a specific individual web user on a given site, bid for that impression and--if they win the bid--serve the ad, all in the time it takes for a page to load on the target consumer's computer.''); L. Fisher, ``eMarketer's Guide to the Digital Advertising Ecosystem: Mapping the Display Advertising Purchase Paths and Ad Serving Process'' (Oct. 2012), available at http://www.emarketer.com/Corporate/reports (media buyers can deliver personalized, impression-by-impression, ads based on what is known about individual viewer attributes, behaviors, and site context).
---------------------------------------------------------------------------
Nor is the Commission swayed by arguments noting that multiple individuals could be using the same device. Multiple people often share the same phone number, the same home address, and the same email address, yet Congress still classified these, standing alone, as ``individually identifiable information about an individual.'' \108\ For these reasons, and the reasons stated in the 2011 NPRM, the Commission will retain persistent identifiers within the definition of personal information.
---------------------------------------------------------------------------
\108\ 15 U.S.C. 6501(8).
---------------------------------------------------------------------------
However, the Commission recognizes that persistent identifiers are also used for a host of functions that have little or nothing to do with contacting a specific individual, and that these uses are fundamental to the smooth functioning of the Internet, the quality of the site or service, and the individual user's experience. It was for these reasons that the Commission proposed to expand the definition of support for internal operations in the 2012 SNPRM.
The Commission has determined to retain the approach suggested in the 2011 NPRM and refined in the 2012 SNPRM, with certain revisions. First, the final Rule modifies the proposed definition of persistent identifier to cover ``a persistent identifier that can be used to recognize a user over time and across different Web sites or online services.'' This modification takes into account concerns several commenters raised that using a persistent identifier within a site or service over time serves an important function in conducting site performance assessments and supporting intra-site preferences.\109\ However, in this context, not every Web site or service with a tangential relationship will be exempt--the term ``different'' means either sites or services that are unrelated to each other, or sites or services where the affiliate relationship is not clear to the user.\110\
---------------------------------------------------------------------------
\109\ See Toy Industry Association (comment 89, 2012 SNPRM), at 14; see also ESA (comment 32, 2012 SNPRM), at 8; NetChoice (comment 70, 2012 SNPRM), at 7-8.
\110\ This interpretation of affiliate relationships is consistent with prior Commission articulations. See FTC Report, Protecting Consumer Privacy in an Era of Rapid Change (March 2012), at 41-42, available at http://ftc.gov/os/2012/03/120326privacyreport.pdf (``The Commission maintains the view that affiliates are third parties, and a consumer choice mechanism is necessary unless the affiliate relationship is clear to consumers''); see also kidSAFE Seal Program (comment 56, 2012 SNPRM), at 5 (asking the Commission to clarify what is meant by the phrase `` `across different Web sites or online services' in the context of persistent identifiers'').
---------------------------------------------------------------------------
Second, the Commission has determined that the carve-out for use of a persistent identifier to provide support for the internal operations of a Web site or online service is better articulated as a separate exception to the Rule's requirements. For this reason, it has amended Section 312.5(c) (``Exceptions to prior parental consent'') to add a new exception providing that where an operator collects only a persistent identifier for the sole purpose of providing support for its internal operations, the operator will have no notice or consent obligations under the Rule. This is a change in organization, rather than a substantive change, from the Commission's earlier proposals.
In addition, in response to the arguments made in a number of comments, the Commission has further modified the 2012 SNPRM proposed definition of support for internal operations to add frequency capping of advertising and legal or regulatory compliance to the permissible uses
Page 3981
enumerated therein.\111\ The Commission declines to add certain other language proposed by commenters, such as intellectual property protection, payment and delivery functions, spam protection, optimization, statistical reporting, or de-bugging, because it believes that these functions are sufficiently covered by the definitional language permitting activities that ``maintain or analyze'' the functions of the Web site or service, or protect the ``security or integrity'' of the site or service. Under this revised definition, most of the activities that commenters cite to as important to permitting the smooth and optimal operation of Web sites and online services will be exempt from COPPA coverage.
---------------------------------------------------------------------------
\111\ See, e.g., Digital Advertising Alliance (comment 27, 2012 SNPRM), at 3; DMA (comment 28, 2012 SNPRM), at 11; IAB (comment 73, 2011 NPRM), at 10-11; Magazine Publishers of America (comment 61, 2012 SNPRM), at 11; Microsoft (comment 66, 2012 SNPRM), at 5; Online Publishers Association (comment 123, 2011 NPRM), at 4-5; Viacom Inc. (comment 95, 2012 SNPRM), at 14.
---------------------------------------------------------------------------
The Commission also is cognizant that future technical innovation may result in additional activities that Web sites or online services find necessary to support their internal operations. Therefore, the Commission has created a voluntary process--new Section 312.12(b)--
whereby parties may request Commission approval of additional activities to be included within the definition of support for internal operations. Any such request will be placed on the public record for notice and comment, and the Commission will act on it within 120 days.
The final amended language makes clear that operators may only engage in activities ``necessary'' to support the covered functions. The Commission agrees with commenter EPIC that ``the presence of the word `necessary' in the statute * * * indicates that the use of persistent identifiers is to be limited to the above activities, and that these activities are to be narrowly construed.'' \112\ Moreover, operators may not use persistent identifiers that fall within the Rule's definition of personal information for any purposes other than those listed within the definition of support for internal operations. Accordingly, the Rule will require operators to obtain parental consent for the collection of persistent identifiers where used to track children over time and across sites or services. Without parental consent, operators may not gather persistent identifiers for the purpose of behaviorally targeting advertising to a specific child. They also may not use persistent identifiers to amass a profile on an individual child user based on the collection of such identifiers over time and across different Web sites in order to make decisions or draw insights about that child, whether that information is used at the time of collection or later.\113\
---------------------------------------------------------------------------
\112\ See EPIC (comment 31, 2012 SNPRM), at 9. The Commission disagrees with the contention by certain commenters that the word ``necessary'' is confusing and unduly restrictive. See Online Publishers Association (comment 72, 2012 SNPRM), at 9. In this context, the term means that an operator may collect a covered persistent identifier if it uses it for the purposes listed in the definition of support for internal operations. The operator need not demonstrate that collection of the identifier was the only means to perform the activity.
\113\ 144 Cong. Rec. S8482 (Statement of Sen. Bryan (1998)).
---------------------------------------------------------------------------
Several commenters sought clarification of whether a party's status as a first party or a third party would affect its ability to rely upon the support for internal operations definition.\114\ To the extent that a child-directed content site or service engages service providers to perform functions encompassed by the definition of support for internal operations, those functions will be covered as support for the content-
provider's internal operations. If a third party collecting persistent identifiers is deemed an operator under the Rule (e.g., because it has actual knowledge it is collecting personal information from users of a child-directed site or service, or it has actual knowledge it is collecting personal information from a child through a general audience site or service), that operator may rely on the Rule's support for internal operations definition when it uses persistent identifier information for functions that fall within it.
---------------------------------------------------------------------------
\114\ See, e.g., Association for Competitive Technology (comment 7, 2012 SNPRM), at 5; IAB (comment 73, 2011 NPRM), at 11.
---------------------------------------------------------------------------
-
Photographs, Videos, and Audio Files
The Rule's existing definition of personal information includes photographs only when they are combined with ``other information such that the combination permits physical or online contacting.'' Given the prevalence and popularity of posting photos, videos, and audio files online, in the 2011 NPRM, the Commission reevaluated the privacy and safety implications of such practices as they pertain to children. The Commission determined that the inherently personal nature of photographs, and the fact that they may contain information such as embedded geolocation data, or can be paired with facial recognition technology, makes them identifiers that ``permit the physical or online contacting of a specific individual.'' \115\ The Commission found the same risks attendant with the online uploading of video and audio files.\116\ Accordingly, the Commission proposed creating a new category within the definition of personal information covering a photograph, video, or audio file where such file contains a child's image or voice.
---------------------------------------------------------------------------
\115\ See 2011 NPRM, 76 FR at 59813.
\116\ Id.
---------------------------------------------------------------------------
Some commenters supported this proposal. For example, the Institute for Public Representation, on behalf of a group of children's privacy advocates, stated that ``because photographs, videos, and audio files can convey large amounts of information about children that can make them more vulnerable to behavioral advertising, and possibly put their personal safety at risk as well, these types of information should be included in the definition of personal information.''\117\
---------------------------------------------------------------------------
\117\ Institute for Public Representation (comment 71, 2011 NPRM), at 33; Privacy Rights Clearinghouse (comment 131, 2011 NPRM), at 2.
---------------------------------------------------------------------------
Several commenters criticized the Commission's proposal, claiming that the effect would limit children's participation in online activities involving ``user-generated content.'' \118\ Several commenters issued blanket statements that photos, videos, and audio files, in and of themselves, do not permit operators to locate or contact a child.\119\ Other commenters stated that the Commission's proposal is premature, arguing that facial recognition technologies are only in their nascent stages.\120\ Finally, several commenters argued that the Commission should narrow the scope of its proposal, exempting from coverage photos, videos, or audio files that have been prescreened to remove any metadata or other individually identifiable information.\121\ Others asked the Commission to carve out from coverage photos or videos where used to
Page 3982
support internal operations of a site or service.\122\ Commenter WiredSafety urged the Commission to adopt a standard that would permit operators to blur images of children before uploading them, thereby reducing the risks of exposure.\123\
---------------------------------------------------------------------------
\118\ See DMA (comment 37, 2011 NPRM), at 17; Promotion Marketing Association (comment 133, 2011 NPRM), at 12; NCTA (comment 113, 2011 NPRM), at 16. Certain commenters interpreted the Commission's proposal as inapplicable to user-generated content, but applicable to an operator's own use of children's images or voices. See CTIA (comment 32, 2011 NPRM), at 12; National Retail Federation (comment 114, 2011 NPRM), at 4; F. Page (comment 124, 2011 NPRM).
\119\ See American Association of Advertising Agencies (comment 2, 2011 NPRM), at 4; Internet Commerce Coalition (comment 74, 2011 NPRM), at 5; Promotion Marketing Association (comment 133, 2011 NPRM), at 12; see also DMA (comment 37, 2011 NPRM), at 17.
\120\ See Intel Corp. (comment 72, 2011 NPRM), at 6-7; Motion Picture Association of America (``MPAA'') (comment 109, 2011 NPRM), at 13.
\121\ See Privo (comment 76, 2012 SNPRM), at 7; DMA (comment 37, 2011 NPRM), at 17-18; Promotion Marketing Association (comment 133, 2011 NPRM), at 12; WiredSafety (comment 177, 2011 NPRM), at 10.
\122\ ESA (comment 47, 2011 NPRM), at 14 n.21; kidSAFE Seal Program (comment 81, 2011 NPRM), at 11.
\123\ See WiredSafety (comment 177, 2011 NPRM), at 10 (``the risk of using a preteen's clear image in still photos or in video formats is obvious''); see also Intel (comment 72, 2011 NPRM), at 7 (``we propose limiting the Commission's new definition to `a photograph, video or audio file where such file contains a child's image or voice which may reasonably allow identification of the child' ''). The Commission believes that operators who choose to blur photographic images of children prior to posting such images would not be in violation of the Rule.
---------------------------------------------------------------------------
The Commission does not dispute that uploading photos, videos, and audio files can be entertaining for children. Yet, it is precisely the very personal nature of children's photographic images, videos, and voice recordings that leads the Commission to determine that such files meet the standard for ``personal information'' set forth by Congress in the COPPA statute. That is, in and of themselves, such files ``permit the physical or online contacting of a specific individual.'' \124\ As the Privacy Rights Clearinghouse stated, ``as facial recognition advances, photos and videos have the potential to be analyzed and used to target and potentially identify individuals.'' \125\ Given these risks, the Commission continues to believe it is entirely appropriate to require operators who offer young children the opportunity to upload photos, videos, or audio files containing children's images or voices to obtain parental consent beforehand.\126\ Therefore, the Commission adopts the modification of the definition of personal information regarding photos, videos, and audio files as proposed in the 2011 NPRM, without qualification.
---------------------------------------------------------------------------
\124\ 15 U.S.C. 6501(8)(F) (italics added).
\125\ Privacy Rights Clearinghouse (comment 131, 2011 NPRM), at 2; see also TRUSTe (comment 164, 2011 NPRM), at 7 (``biometrics such as those provided in a photo, video or audio recording are personal information and greater protections need to be provided'').
\126\ The Commission notes that this amendment would not apply to uploading photos or videos on general audience sites such as Facebook or YouTube, absent actual knowledge that the person uploading such files is a child.
---------------------------------------------------------------------------
-
Geolocation Information
In the 2011 NPRM, the Commission stated that, in its view, existing paragraph (b) of the definition of personal information already covered any geolocation information that provides precise enough information to identify the name of a street and city or town.\127\ However, because geolocation information can be presented in a variety of formats (e.g., coordinates or a map), and in some instances can be more precise than street name and name of city or town, the Commission proposed making geolocation information a stand-alone category within the definition of personal information.\128\
---------------------------------------------------------------------------
\127\ 76 FR at 59813.
\128\ Id. Adding new paragraph (10) to the definition of personal information in 16 CFR 312.2.
---------------------------------------------------------------------------
Similar to the comments raised in response to the 2010 FRN, a number of commenters opposed this change. These commenters argued that anonymous, technical geolocation information, without the addition of any other identifier, was insufficient to contact an individual child.\129\ The Internet Commerce Coalition stated that in identifying geolocation information ``sufficient to identify a street name and name of city or town'' as personal information, the Commission has missed the key to what makes an address ``personal,'' namely the street number.\130\ Accordingly, such commenters asked the Commission to clarify that geolocation information will only be deemed personal information if, when combined with some other information or identifier, it would permit contacting an individual.\131\
---------------------------------------------------------------------------
\129\ See AT&T (comment 8, 2011 NPRM), at 5; see also American Association of Advertising Agencies (comment 2, 2011 NPRM), at 4; CTIA (comment 32, 2011 NPRM), at 9; DMA (comment 37, 2011 NPRM), at 17; Promotion Marketing Association (comment 133, 2011 NPRM), at 13; Software & Information Industry Association (``SIIA'') (comment 150, 2011 NPRM), at 8; Verizon (comment 167, 2011 NPRM), at 6.
\130\ See Internet Commerce Coalition (comment 74, 2011 NPRM), at 5; see also AT&T (comment 8, 2011 NPRM), at 5-6.
\131\ See, e.g., CTIA (comment 32, 2011 NPRM), at 9; Future of Privacy Forum (comment 55, 2011 NPRM), at 5; Verizon (comment 167, 2011 NPRM), at 6 (``Consistent with Congressional intent, geolocation information should be treated as personal information only when the data is tied to a specific individual.'').
---------------------------------------------------------------------------
These commenters overlook that the COPPA statute does not require the submission of a street number to make address information ``personal.'' Nor is it limited to home address, primary residence, or even a static address. Rather, Congress chose to use the words ``or other physical address, including street name and name of city or town.'' \132\ This word choice not only permits the inclusion of precise mobile (i.e., moving) location information, it may very well mandate it.\133\ As commenter Consumers Union stated, ``since a child's physical address is already considered personal information under COPPA, geolocation data, which provides precise information about a child's whereabouts at a specific point in time, must also necessarily be covered.'' \134\
---------------------------------------------------------------------------
\132\ 15 U.S.C. 6501(8)(B).
\133\ For this reason, the Commission finds those comments focusing on the potential to capture a large geographic area to be inapposite. See IAB (comment 73, 2011 NPRM), at 6 (``without an address or other additional data to identify a household or individual, a street name and city could encompass a large geographic area and as many as 1,000 households. For example, Sepulveda Boulevard, in the Los Angeles area, is over 40 miles long'').
\134\ See Consumers Union (comment 29, 2011 NPRM), at 3; see also EPIC (comment 41, 2011 NPRM), at 8-9 (``As with IP addresses and user names, geolocation information can be used to track a particular device, which is usually linked to a particular individual.'').
---------------------------------------------------------------------------
In addition, the Commission disagrees with those commenters who state that geolocation information, standing alone, does not permit the physical or online contacting of an individual within the meaning of COPPA.\135\ Just as with persistent identifiers, the Commission rejects the notion that precise geolocation information allows only contact with a specific device, not the individual using the device. By that same flawed reasoning, a home or mobile telephone number would also only permit contact with a device.
---------------------------------------------------------------------------
\135\ See American Association of Advertising Agencies (comment 2, 2011 NPRM), at 4; AT&T (comment 8, 2011 NPRM), at 6; DMA (comment 37, 2011 NPRM), at 17; Promotion Marketing Association (comment 133, 2011 NPRM), at 13; Verizon (comment 167, 2011 NPRM), at 6.
---------------------------------------------------------------------------
Several commenters asked the Commission to refine the Rule's coverage of geolocation so that it targets particular uses. Commenter CTIA, citing photo-sharing services as an example, asked that geolocation information embedded in metadata (as often is the case with digital photographs) be excluded from the Rule's coverage.\136\ Arguing that there should be a legal difference between using geolocation information for convenience or to protect a child's safety and to market to a child, commenter kidSAFE Seal Program suggested that geolocation data only be considered ``personal information'' when it is being used for marketing purposes.\137\ Finally, commenter TRUSTe asked that the Commission amend the definition to cover ``precise geolocation data that can be used to identify a child's actual physical location at a given point in time.''\138\
---------------------------------------------------------------------------
\136\ CTIA (comment 32, 2011 NPRM), at 9.
\137\ kidSAFE Seal Program (comment 81, 2011 NPRM), at 11.
\138\ TRUSTe (comment 164, 2011 NPRM), at 3.
---------------------------------------------------------------------------
The Commission sees no basis for making the suggested revisions. With respect to excluding geolocation
Page 3983
information in metadata, the Commission notes that in the 2011 NPRM, it specifically cited such geolocation metadata as one of the bases for including photographs of children within the definition of personal information.\139\ With respect to the comment from kidSAFE Seal Program, the statute does not distinguish between information collected for marketing as opposed to convenience; therefore, the Commission finds no basis for making such a distinction for geolocation information. Finally, the Commission sees little to no practical distinction between ``geolocation data that can be used to identify a child's actual physical location at a given point in time'' and geolocation information ``sufficient to identify street name and name of a city or town,'' and it prefers to adhere to the statutory language. Accordingly, the Commission modifies the definition of personal information as proposed in the 2011 NPRM, and covered operators will be required to notify parents and obtain their consent prior to collecting geolocation information from children.
---------------------------------------------------------------------------
\139\ See 76 FR at 59813 n.87.
---------------------------------------------------------------------------
6. Definition of Release of Personal Information
In the 2011 NPRM, the Commission proposed to define the term release of personal information separately from the definition of disclosure, since the term applied to provisions of the Rule that did not solely relate to disclosures.\140\ The Commission also proposed technical changes to clarify that the term ``release of personal information'' addresses business-to-business uses of personal information, not public disclosures, of personal information.\141\ The Commission received little comment on this issue and therefore adopts the proposed changes.
---------------------------------------------------------------------------
\140\ See 2011 NPRM, 76 FR at 59804, 59809. The Commission originally proposed to define release of personal information as ``the sharing, selling, renting, or any other means of providing personal information to any third party.'' The Commission's revised definition removes the phrase ``or any other means of providing personal information'' to avoid confusion and overlap with the second prong of the definition of disclosure governing an operator making personal information collected from a child publicly available, e.g., through a social network, a chat room, or a message board. See 16 CFR 312.2 (definition of disclosure).
\141\ Id.
---------------------------------------------------------------------------
7. Definition of Web Site or Online Service Directed to Children
In the 2012 SNPRM, the Commission proposed revising the definition of Web site or online service directed to children to allow a subset of sites falling within that category an option not to treat all users as children. The proposed revision was sparked by a comment from The Walt Disney Company that urged the Commission to recognize that sites and services directed to children fall along a continuum and that those sites targeted to both children and others should be permitted to differentiate among users. Noting that Disney's suggestion in large measure reflected the prosecutorial discretion already applied by the Commission in enforcing COPPA, the Commission proposed revisions to implement this concept. The Commission received numerous comments on this proposal. Although many commenters expressed support for the concept, the proposed implementing language was criticized.
Paragraphs (a) and (b) of the SNPRM's proposed revisions sought to define the subset of sites directed to children that would still be required to treat all users as children: those that knowingly target children under 13 as their primary audience, and those that, based on the overall content of the site, are likely to attract children under 13 as their primary audience. Paragraph (c) sought to describe those child-directed sites that would be permitted to age-screen to differentiate among users--namely those sites that, based on overall content, are likely to draw a disproportionate number of child users.
Although most commenters concurred that operators intentionally targeting children as their primary audience should be covered as Web sites directed to children,\142\ some worried about the precise contours of the term ``primary audience'' and sought guidance as to percentage thresholds.\143\ Some commenters also opposed any interpretation of COPPA that required child-directed Web sites to presume all users are children.\144\
---------------------------------------------------------------------------
\142\ See ACLU (comment 3, 2012 SNPRM), at 3; Online Publishers Association (comment 72, 2012 SNPRM), at 4.
\143\ See DMA (comment 28, 2012 SNPRM), at 13-14; Institute for Public Representation (comment 52, 2012 SNPRM), at 25-27; Privo (comment 76, 2012 SNPRM), at 3; TechFreedom (comment 88, 2012 SNPRM), at 3; Toy Industry Association (comment 89, 2012 SNPRM), at 12; WiredTrust and WiredSafety (comment 98, 2012 SNPRM), at 3-4.
\144\ See Facebook (comment 33, 2012 SNPRM), at 10; Viacom Inc. (comment 95, 2012 SNPRM), at 5.
---------------------------------------------------------------------------
Many commenters argued that the Commission exceeded its authority by defining Web site or online service directed to children based on criteria other than the sites' intent to target children. These commenters argued that Congress, by defining Web sites directed to children as those ``targeted'' to children, was imposing a subjective intent requirement.\145\ The Commission disagrees. The Commission believes that if Congress had wanted to require subjective intent on the part of an operator before its site or service could be deemed directed to children, it would have done so explicitly.\146\ Intent cannot be the only scenario envisioned by Congress whereby a site would be deemed directed to children.\147\ Certainly, a Web site or online service that has the attributes, look, and feel of a property targeted to children under 13 will be deemed to be a site or service directed to children, even if the operator were to claim that was not its intent.
---------------------------------------------------------------------------
\145\ See, e.g., Online Publishers Association (comment 72, 2012 SNPRM), at 4 (``The plain meaning of `targeted' in this context requires a deliberate selection of an audience of children.'').
\146\ See 15 U.S.C. 6501(10)(A) (``The term `Web site or online service directed to children' means--(i) a commercial Web site or online service that is targeted to children; or (ii) that portion of a commercial Web site or online service that is targeted to children.'').
\147\ See ACLU (comment 3, 2012 SNPRM), at 4 (``paragraphs (a) and (b) of the proposed definition are largely noncontroversial'').
---------------------------------------------------------------------------
Paragraph (c) sought to describe those child-directed sites that would be permitted to age-screen to differentiate among users, namely those sites that, based on overall content, are likely to draw a disproportionate number of child users. While a handful of comments supported this definition,\148\ for the most part, it was criticized by a spectrum of interests. On one side were advocates such Common Sense Media, EPIC, and the Institute for Public Representation. These advocates argued that recognizing a category of sites and services directed to mixed-audiences, targeted both to young children and others, would undercut the other revisions the Commission has proposed, thereby lessening privacy protections for children.\149\ Such advocates also argued that the proposed category might create incentives, or loopholes, for operators that currently provide child-directed Web sites or services to claim their online properties are covered by paragraph (c) of the definition and become exempt from COPPA by age-
gating.\150\
---------------------------------------------------------------------------
\148\ See, e.g., U.S. Conference of Catholic Bishops (comment 92, 2012 SNPRM), at 4.
\149\ Institute for Public Representation (comment 52, 2012 SNPRM), at (i).
\150\ Common Sense Media (comment 20, 2012 SNPRM), at 9; EPIC (comment 31, 2012 SNPRM), at 4-5; Institute for Public Representation, supra note 149, at 27-28.
---------------------------------------------------------------------------
On the other side were a number of commenters who feared that the proposal would significantly expand the range of Web sites and online services that fall within the ambit of COPPA's coverage, including both teen-oriented and general-audience sites and services that incidentally appeal to children as well as adults. Much of this fear appears
Page 3984
to have been driven by the specific language the Commission proposed; that is, sites or services that, based on their overall content, were ``likely to attract an audience that includes a disproportionately large percentage of children under age 13 as compared to the percentage of such children in the general population.'' Some argued that the use of the term ``disproportionate'' is vague,\151\ potentially unconstitutional,\152\ unduly expansive,\153\ or otherwise constitutes an unlawful shift from the statute's actual knowledge standard for general audience sites to one of constructive knowledge.\154\ Many worried that the Commission's proposal would lead to widespread age-
screening, or more intensive age-verification, across the entire body of Web sites and online services located on the Internet.\155\ Other commenters suggested that the Commission implement this approach through a safe harbor, not by revising a definition.\156\
---------------------------------------------------------------------------
\151\ See, e.g., P. Aftab (comment 1, 2012 SNPRM), at 6-7; NCTA (comment 69, 2012 SNPRM), at 14; Marketing Research Association (comment 62, 2012 SNPRM), at 2; NetChoice (comment 70, 2012 SNPRM), at 4-5; SIIA (comment 84, 2012 SNPRM), at 10.
\152\ See, e.g., CDT (comment 15, 2012 SNPRM), at 7-10; Family Online Safety Institute (comment 34, 2012 SNPRM), at 3; Internet Commerce Coalition (comment 53, 2012 SNPRM), at 9; T. Mumford (comment 68, 2012 SNPRM); Online Publishers Association (comment 72, 2012 SNPRM), at 6; Viacom (comment 95, 2012 SNPRM), at 5.
\153\ See, e.g., DMA (comment 28, 2012 SNPRM), at 14; Magazine Publishers of America (comment 61, 2012 SNPRM), at 6-7.
\154\ See CDT (comment 15, 2012 SNPRM), at 7.
\155\ See ACLU (comment 3, 2012 SNPRM), at 5; DMA (comment 28, 2012 SNPRM), at 14-15; Magazine Publishers of America (comment 61, 2012 SNPRM), at 8; Toy Industry Association (comment 89, 2012 SNPRM), at 7, 11.
\156\ Entertainment Software Association (comment 32, 2012 SNPRM), at 2; Online Publishers Association (comment 72, 2012 SNPRM), at 7-8; Viacom Inc. (comment 95, 2012 SNPRM), at 6.
---------------------------------------------------------------------------
The comments reflect a misunderstanding of the purpose and effect of the change proposed in the 2012 SNPRM. The Commission did not intend to expand the reach of the Rule to additional sites and services, but rather to create a new compliance option for a subset of Web sites and online services already considered directed to children under the Rule's totality of the circumstances standard.
To make clear that it will look to the totality of the circumstances to determine whether a site or service is directed to children (whether as its primary audience or otherwise), the Commission has revised and reordered the definition of Web site or online service directed to children as follows. Paragraph (1) of the definition contains the original Rule language setting forth several factors the Commission will consider in determining whether a site or service is directed to children. In addition, paragraph (1) amends this list of criteria to add musical content, the presence of child celebrities, and celebrities who appeal to children, as the Commission originally proposed in the 2011 NPRM.\157\ Although some commenters expressed concern that these additional factors might capture general audience sites,\158\ produce inconsistent results,\159\ or be overly broad (since musicians and celebrities often appeal both to adults and children),\160\ the Commission believes that these concerns are unfounded. The Commission reiterates that these factors are some among many that the Commission will consider in assessing whether a site or service is directed to children, and that no single factor will predominate over another in this assessment.
---------------------------------------------------------------------------
\157\ 2011 NPRM, 76 FR at 59814.
\158\ See DMA (comment 37, 2011 NPRM), at 18-19; MPAA (comment 109, 2011 NPRM), at 19.
\159\ See Verizon (comment 167, 2011 NPRM), at 10.
\160\ See SIIA (comment 150, 2011 NPRM), at 9.
---------------------------------------------------------------------------
Paragraph (2) of the definition sets forth the actual knowledge standard for plug-ins or ad networks, as discussed in Part II.A.4.b herein, whereby a plug-in, ad network, or other property is covered as a Web site or online service directed to children under the Rule when it has actual knowledge that it is collecting personal information directly from users of a child-directed Web site or online service.
The Commission amends paragraph (3) of the definition to clarify when a child-directed site would be permitted to age-screen to differentiate among users. This paragraph codifies the Commission's intention to first apply its ``totality of the circumstances'' standard to determine whether any Web site or online service falling under paragraph (3) is directed to children. The Commission then will assess whether children under age 13 are the primary audience for the site or service. Paragraph (3) codifies that a site or service that is directed to children, but that does not target children as its primary audience, may use an age screen in order to apply all of COPPA's protections only to visitors who self-identify as under age 13. As the Commission stated in the 2012 SNPRM, at that point, the operator will be deemed to have actual knowledge that such users are under 13 and must obtain appropriate parental consent before collecting any personal information from them and must also comply with all other aspects of the Rule.\161\
---------------------------------------------------------------------------
\161\ See 2012 SNPRM, 77 FR at 46646.
---------------------------------------------------------------------------
The Commission retains its longstanding position that child-
directed sites or services whose primary target audience is children must continue to presume all users are children and to provide COPPA protections accordingly.\162\ Some commenters contend that the Commission should permit this presumption to be rebutted, even on sites primarily targeting children, by the use of a simple age screen that distinguishes child users from other users.\163\ Although the Commission is now permitting this on sites or services that target children only as a secondary audience or to a lesser degree, the Commission believes adopting this standard for all child-directed sites would virtually nullify the statutory distinction between ``actual knowledge'' sites and those directed to children, creating a de facto actual knowledge standard for all operators.\164\
---------------------------------------------------------------------------
\162\ The Commission intends the word ``primary'' to have its common meaning, i.e., something that stands first in rank, importance, or value. This must be determined by the totality of the circumstances and not through a precise audience threshold cut-off. See definition of ``primary.'' Merriam-Webster.com (2012), available at http://www.merriam-webster.com (last accessed Nov. 5, 2012).
\163\ P. Aftab (comment 1, 2012 SNPRM), at 5; Facebook (comment 33, 2012 SNPRM), at 12-13; Future of Privacy Forum (comment 37, 2012 SNPRM), at 8.
\164\ See DMA (comment 28, 2012 SNPRM), at 8 (an operator's choice of content serves as a proxy for knowledge that its users are primarily children under 13).
---------------------------------------------------------------------------
Finally, paragraph (4) of the definition restates the statutory proviso that a site or service will not be deemed to be child-directed where it simply links to a child-directed property.
-
-
Section 312.4: Notice
1. Direct Notice to a Parent
In the 2011 NPRM, the Commission proposed refining the Rule requirements for the direct notice to ensure a more effective ``just-
in-time'' message to parents about an operator's information practices.\165\ As such, the Commission proposed to reorganize and standardize the direct notice requirement to set forth the precise items of information that must be disclosed in each type of direct notice the Rule requires. The proposed revised language of Sec. 312.4 specified, in each instance where the Rule requires direct notice, the precise information that operators must provide to parents regarding the items of personal information the operator already has obtained from the child (generally, the
Page 3985
parent's online contact information either alone or together with the child's online contact information); the purpose of the notification; action that the parent must or may take; and what use, if any, the operator will make of the personal information collected. The proposed revisions also were intended to make clear that each form of direct notice must provide a hyperlink to the operator's online notice of information practices.\166\
---------------------------------------------------------------------------
\165\ See 2011 NPRM, 76 FR at 59816.
\166\ Id.
---------------------------------------------------------------------------
In general, commenters supported the Commission's proposed changes as providing greater clarity and simplicity to otherwise difficult-to-
understand statements.\167\ These changes were viewed as especially important in an era of children's intense engagement with mobile applications accessed through a third-party app store and where an online notice might not be as readily accessible.\168\ Only one commenter objected to the concept of placing greater emphasis on the direct, rather than the online, notice, stating that the changes would unduly necessitate lengthy direct notices and would prove overwhelming for parents and challenging to implement in the mobile environment.\169\
---------------------------------------------------------------------------
\167\ See EPIC (comment 41, 2011 NPRM), at 9; Institute for Public Representation (comment 71, 2011 NPRM), at 40-41; kidSAFE Seal Program (comment 81, 2011 NPRM), at 12; NCTA (comment 113, 2011 NPRM), at 22.
\168\ AssertID (comment 6, 2012 SNPRM), at 2.
\169\ IAB (comment 73, 2011 NPRM), at 13.
---------------------------------------------------------------------------
The Commission also proposed adding a paragraph setting out the contours of a new direct notice in situations where an operator voluntarily chooses to collect a parent's online contact information from a child in order to provide parental notice about a child's participation in a Web site or online service that does not otherwise collect, use, or disclose children's personal information. The Commission's proposal for a voluntary direct notice in situations where an operator does not otherwise collect, use, or disclose personal information from a child garnered very little attention. Only one commenter sought clarification of the specific language the Commission proposed.\170\
---------------------------------------------------------------------------
\170\ N. Savitt (comment 142, 2011 NPRM), at 2.
---------------------------------------------------------------------------
Several commenters urged the Commission to use the occasion of the Rule review to develop a model COPPA direct notice form that operators voluntarily could adopt,\171\ to mandate that such notifications be optimized for the particular devices on which they are displayed,\172\ or to implement a Web site rating system.\173\ The Commission believes that these suggestions are better suited as ``best practices'' \174\ rather than as additions to the text of the Rule.
---------------------------------------------------------------------------
\171\ H. Valetk (comment 166, 2011 NPRM), at 3.
\172\ TRUSTe (comment 164, 2011 NPRM), at 10.
\173\ Lifelock (comment 93, 2011 NPRM), at 1.
\174\ For example, to be considered by the various Commission-
approved COPPA safe harbor programs.
---------------------------------------------------------------------------
The Commission has determined to retain in the final Rule the modifications proposed in the 2011 NPRM. However, the Commission has reorganized the paragraphs to provide a better flow and guidance for operators, and has clarified that the voluntary direct notice provision described above is, indeed, voluntary for operators who choose to use it.\175\
---------------------------------------------------------------------------
\175\ N. Savitt (comment 142, 2011 NPRM), at 2.
---------------------------------------------------------------------------
2. Notice on the Web Site or Online Service
In the 2011 NPRM, the Commission proposed several changes to the Rule's online notice requirement. First, the Commission proposed requiring all operators collecting, using, or disclosing information on a Web site or online service to provide contact information, including, at a minimum, the operator's name, physical address, telephone number, and email address.\176\ This proposal marked a change from the existing Rule's proviso that such operators could designate one operator to serve as the point of contact.
---------------------------------------------------------------------------
\176\ Id.
---------------------------------------------------------------------------
With the exception of the Institute for Public Representation,\177\ commenters who spoke to the issue opposed mandating that the online notice list all operators. Some objected to the sheer volume of potentially confusing information this would present to parents,\178\ and stated that the proposal provided no additional consumer benefit to parents, given that the existing Rule implies that the single operator designee should be prepared to ``respond to all inquiries from parents concerning the operators' privacy policies and use of children's information.'' \179\ Some also spoke to the burden on the primary operator of having to maintain a current list of all applicable operators' contact information,\180\ and expressed confusion as to which operators needed to be listed.\181\
---------------------------------------------------------------------------
\177\ Institute for Public Representation (comment 71, 2011 NPRM), at 38-39.
\178\ See Facebook (comment 50, 2011 NPRM), at 9; NCTA (comment 113, 2011 NPRM), at 22; Toy Industry Association (comment 89, 2012 SNPRM), at 6.
\179\ IAB (comment 73, 2011 NPRM), at 12.
\180\ DMA (comment 37, 2011 NPRM), at 20.
\181\ kidSAFE Seal Program (comment 81, 2011 NPRM), at 12 (``Would this rule apply to one-time joint sponsors of a promotion who co-collect information on a Web site?'').
---------------------------------------------------------------------------
The Commission believes that a requirement for the primary operator to provide specific, current, contact information for every operator that collects information on or through its Web site or service has the potential to confuse parents, for whom such online notices are intended to be accessible and useful. After considering the comments, the Commission has determined to retain the Rule's ``single operator designee'' proviso; that is, an operator will be required to list all operators collecting or maintaining personal information from children through the Web site or online service, but need only list the contact information for the one operator who will be responsible for responding to parents' inquiries.
In the 2011 NPRM, the Commission also proposed eliminating the Rule's current lengthy--yet potentially under-inclusive--recitation of an operator's information collection, use, and disclosure practices in favor of a simple statement of: (1) What information the operator collects from children, including whether the Web site or online service enables a child to make personal information publicly available; (2) how the operator uses such information; and (3) the operator's disclosure practices for such information.\182\ As a part of this revision, the Commission proposed removing the required statement that the operator may not condition a child's participation in an activity on the child's disclosing more personal information than is reasonably necessary to participate in such activity.\183\ This proposal was opposed by the Institute for Public Representation, which views the statement as a way to educate parents as to whether or not the operator actually complies with data minimization principles.\184\ This organization also asked the Commission to require operators to disclose information to parents on how the data they collect is secured from potential breaches.\185\ The Commission has considered this input but nevertheless adopts both of these changes in the final Rule.
---------------------------------------------------------------------------
\182\ 76 FR at 59815.
\183\ Id.
\184\ Institute for Public Representation (comment 71, 2011 NPRM), at 40.
\185\ Id.
---------------------------------------------------------------------------
The Commission sees great value for parents of streamlined online notices and continues to believe that the removal of extraneous information from such notices will further this goal.\186\
Page 3986
Accordingly, the Commission modifies the Rule as proposed in the 2011 NPRM to remove an operator's recitation in its online notice that it will not condition a child's participation on the provision of more information than is necessary. Again, however, the substantive requirement of Sec. 312.7 remains in place.\187\ In addition, and again in the interest of streamlining the online notices, the Commission declines to require operators to explain the measures they take to protect children's data. Nevertheless, the Rule's enhanced provisions on confidentiality and data security will help protect data collected from children online.
---------------------------------------------------------------------------
\186\ See 2011 NPRM, 76 FR at 59815 (``In the Commission's experience, this blanket statement, often parroted verbatim in operators' privacy policies, detracts from the key information of operators' actual information practices, and yields little value to a parent trying to determine whether to permit a child's participation.'').
\187\ Id.
---------------------------------------------------------------------------
Finally, focusing on the part of the Commission's proposal that would require operators of general audience sites or services that have separate children's areas to post links to their notices of children's information practices on the home or landing page or screen of the children's area, the Toy Industry Association asked the Commission to forgo mandating links in any location where mobile apps can be purchased or downloaded because, in their view, changing commercial relationships may make it difficult to frequently update privacy policies in apps marketplaces.\188\ The final amended Rule does not mandate the posting of such information at the point of purchase but rather on the app's home or landing screen. However, the Commission does see a substantial benefit in providing greater transparency about the data practices and interactive features of child-directed apps at the point of purchase and encourages it as a best practice.\189\
---------------------------------------------------------------------------
\188\ Toy Industry Association (Comment 163, 2011 NPRM), at 4.
\189\ FTC Staff Report, ``Mobile Apps for Kids: Disclosures Still Not Making the Grade'' (Dec. 2012), at 7 (``Mobile Apps for Kids II Report''), available at http://www.ftc.gov/os/2012/12/121210mobilekidsappreport.pdf (noting that ``information provided prior to download is most useful in parents' decision-making since, once an app is downloaded, the parent already may have paid for the app and the app already may be collecting and disclosing the child's information to third parties'').
---------------------------------------------------------------------------
-
Section 312.5: Parental Consent
A central element of COPPA is its requirement that operators seeking to collect, use, or disclose personal information from children first obtain verifiable parental consent.\190\ ``Verifiable parental consent'' is defined in the statute as ``any reasonable effort (taking into consideration available technology), including a request for authorization for future collection, use, and disclosure, described in the notice.'' \191\ Accordingly, the Rule requires that operators must make reasonable efforts to obtain verifiable parental consent, taking into consideration available technology. Any method to obtain verifiable parental consent must be reasonably calculated in light of available technology to ensure that the person providing consent is the child's parent. Sec. 312.5(b)(1).
---------------------------------------------------------------------------
\190\ Paragraph (a) of Sec. 312.5 states that an operator is required to obtain verifiable parental consent before any collection, use, and/or disclosure of personal information from children, including consent to any material change in the collection, use, and/or disclosure practices to which the parent has previously consented. An operator must give the parent the option to consent to the collection and use of the child's personal information without consenting to disclosure of his or her personal information to third parties.
\191\ 15 U.S.C. 6501(9).
---------------------------------------------------------------------------
The Rule sets forth a non-exhaustive list of methods that meet the standard of verifiable parental consent.\192\ Specifically, paragraph (b)(2) states that methods to obtain verifiable parental consent that satisfy the requirements of the paragraph include: Providing a consent form to be signed by the parent and returned to the operator by postal mail or facsimile; requiring a parent to use a credit card in connection with a transaction; having a parent call a toll-free telephone number staffed by trained personnel; using a digital certificate that uses public key technology; and using email accompanied by a PIN or password obtained through one of the verification methods listed in the paragraph.\193\
---------------------------------------------------------------------------
\192\ See 16 CFR 312.5(b).
\193\ Paragraph (b)(2) also sets out the sliding scale ``email plus'' method for obtaining parental consent in the instance where an operator collects a child's personal information only for internal use. The Commission's determination to retain the email plus method is discussed in Part II.C.7, infra.
---------------------------------------------------------------------------
Participants at the Commission's June 2, 2010 COPPA roundtable \194\ and commenters to the 2010 FRN generally agreed that, while no one method provides complete certainty that the operator has reached and obtained consent from a parent, the methods listed in the Rule continue to have utility for operators and should be retained.\195\
---------------------------------------------------------------------------
\194\ See Federal Trade Commission's Roundtable: Protecting Kids' Privacy Online at 195, 208-71 (June 2, 2010), available at http://www.ftc.gov/bcp/workshops/coppa/COPPARuleReview_Transcript.pdf.
\195\ See DMA (comment 17, 2010 FRN), at 10, 12; Microsoft (comment 39, 2010 FRN), at 7; Toy Industry Association, Inc. (comment 63, 2010 FRN), at 3; WiredSafety.org. (comment 68, 2010 FRN), at 18.
---------------------------------------------------------------------------
A number of commenters urged the Commission to expand the list of acceptable mechanisms to incorporate newer technologies, or to otherwise modernize or simplify the Rule's mechanisms for parental consent.\196\ Suggested methods of obtaining parental consent included sending a text message to the parent's mobile phone number,\197\ offering online payment services other than credit cards,\198\ offering parental controls in gaming consoles,\199\ offering a centralized parental consent mechanism or parental opt-in list,\200\ and permitting electronic signatures.\201\
---------------------------------------------------------------------------
\196\ See, e.g., BOKU (comment 5, 2010 FRN); DMA (comment 17, 2010 FRN), at 11-12; EchoSign, Inc. (comment 18, 2010 FRN); ESA (comment 20, 2010 FRN), at 7-9; Facebook (comment 22, 2010 FRN), at 2; J. Hiller (comment 27, 2010 FRN), at 447-50; M. Hoal (comment 30, 2010 FRN); Microsoft (comment 39, 2010 FRN), at 4; MPAA (comment 42, 2010 FRN), at 12; RelyID (comment 53, 2010 FRN), at 3; TRUSTe (comment 64, 2010 FRN), at 3; H. Valetk (comment 66, 2010 FRN), at 6; WiredSafety.org (comment 68, 2010 FRN), at 7; S. Wittlief (comment 69, 2010 FRN).
\197\ See BOKU (comment 5, 2010 FRN); ESA (comment 20, 2010 FRN), at 11-12; TRUSTe (comment 64, 2010 FRN), at 3; H. Valetk (comment 66, 2010 FRN), at 6-7.
\198\ See WiredSafety.org (comment 68, 2010 FRN), at 24 (noting that operators are considering employing online financial accounts, such as iTunes, for parental consent).
\199\ See ESA (comment 20, 2010 FRN), at 9-10; Microsoft (comment 39, 2010 FRN), at 7.
\200\ See ESA (comment 20, 2010 FRN), at 12; Janine Hiller (comment at 27, 2010 FRN), at 447.
\201\ See DMA (comment 17, 2010 FRN), at 12; EchoSign (comment 18, 2010 FRN); ESA (comment 20, 2010 FRN), at 10; Toy Industry Association (comment 63, 2010 FRN), at 11.
---------------------------------------------------------------------------
In the 2011 NPRM, the Commission announced its determination that the record was sufficient to justify certain proposed mechanisms, but insufficient to adopt others. The 2011 NPRM proposed several significant changes to the mechanisms of verifiable parental consent set forth in paragraph (b) of Sec. 312.5, including: Adding several newly recognized mechanisms for parental consent; eliminating the sliding scale approach to parental consent; and adding two new processes for evaluation and pre-clearance of parental consent mechanisms.
1. Electronic Scans and Video Verification
In the 2011 NPRM, the Commission proposed including electronically scanned versions of signed parental consent forms and the use of video verification methods among the Rule's non-exhaustive list of acceptable consent mechanisms. The proposal received support from several commenters, including Yahoo!, the DMA, kidSAFE Seal Program, the
Page 3987
NCTA, and Facebook.\202\ Other commenters expressed reservations about whether these new methods would offer practical, economical, or scalable solutions for operators.\203\
---------------------------------------------------------------------------
\202\ See Yahoo! (comment 80, 2011 NPRM), at 4; DMA (comment 37, 2011 NPRM), at 23; kidSAFE Seal Program (comment 81, 2011 NPRM), at 16; NCTA (comment 113, 2011 NPRM), at 9; Facebook (comment 50, 2011 NPRM), at 8-9.
\203\ See K. Dennis (comment 34, 2011 NPRM), at 2; A. Thierer (comment 162, 2011 NPRM), at 9; R. Newton (comment 118, 2011 NPRM).
---------------------------------------------------------------------------
As stated in the 2011 NPRM, the Commission finds that electronic scans and video conferencing are functionally equivalent to the written and oral methods of parental consent originally recognized by the Commission in 1999. It does not find the concerns of some commenters, that operators are not likely to widely adopt these methods, a sufficient reason to exclude them from the Rule. The list of consent mechanisms is not exhaustive and operators remain free to choose the ones most appropriate to their individual business models. Therefore, Section 312.5(b) of the final Rule includes electronic scans of signed consent forms and video-conferencing as acceptable methods for verifiable parental consent.
2. Government-Issued Identification
The Commission also proposed in the 2011 NPRM to allow operators to collect a form of government-issued identification--such as a driver's license, or a segment of the parent's Social Security number--from the parent, and to verify the parent's identity by checking this identification against databases of such information, provided that the parent's identification is deleted from the operator's records promptly after such verification is complete. Some operators already use this method of obtaining parental consent, and it is one of several available verification methods offered by the COPPA safe harbor program Privo.\204\ In the NPRM, the Commission stated its recognition that information such as Social Security number, driver's license number, or another record of government-issued identification is sensitive data.\205\ In permitting operators to use government-issued identification as an approved method of parental verification, the Commission emphasized the importance of limiting the collection of such identification information to only those segments of information needed to verify the data.\206\ For example, the Commission noted that the last four digits of a person's Social Security number are commonly used by verification services to confirm a person's identity.\207\ The Commission also stated its belief that the requirement that operators immediately delete parents' government-issued identification information upon completion of the verification process provides further protection against operators' unnecessary retention, use, or potential compromise of such information. Commenters in favor of adding this mechanism pointed out that using available technology to check a driver's license number or partial Social Security number reasonably ensures that the person providing consent is the parent.\208\
---------------------------------------------------------------------------
\204\ See application of Privo, Inc. to become a Commission-
approved COPPA safe harbor program (Mar. 2004), available at http://www.ftc.gov/os/2004/04/privoapp.pdf, at 25.
\205\ The COPPA statute itself lists Social Security number among the items considered to be personal information. See 16 CFR 312.2. In other contexts, driver's licenses and social security numbers, among other things, have traditionally been considered by Commission staff to be personal, or sensitive, as well. See FTC Staff Report, ``Self-Regulatory Principles for Online Behavioral Advertising'' (Feb. 2009), at 20 n.47, 42, 44, available at http://www.ftc.gov/os/2009/02/P085400behavadreport.pdf.
\206\ The use of a driver's license to verify a parent, while not specifically enumerated in the Final Rule as an approved method of parental consent, was addressed in the Statement of Basis and Purpose in connection with a discussion of the methods to verify the identity of parents who seek access to their children's personal information under Sec. 312.6(a)(3) of the Rule. See 1999 Statement of Basis and Purpose, 64 FR at 59905. There, the Commission concluded that the use of a driver's license was an acceptable method of parental verification.
\207\ See, e.g., Privo, Inc., ``Request for Safe Harbor Approval by the Federal Trade Commission for Privo, Inc.'s Privacy Assurance Program under Section 312.10 of the Children's Online Privacy Protection Rule,'' 25 (Mar. 3, 2004), available at http://www.ftc.gov/os/2004/04/privoapp.pdf.
\208\ For instance, Facebook commented that this mechanism achieves the delicate balance of making it easy for the parent to provide consent, while making it difficult for the child to pose as the parent; when combined with responsible data disposal practices, this method also protects the parent's information against unauthorized use or disclosure. See Facebook (comment 50, 2011 NPRM), at 9; see also kidSAFE Seal Program (comment 81, 2011 NPRM), at 16.
---------------------------------------------------------------------------
Other commenters expressed concern that allowing operators to collect sensitive government identification information from parents raises serious privacy implications.\209\ Many commenters opined that the serious risks to parents' privacy outweighed the benefits of the proposal.\210\ Some further argued that normalizing the use of this sensitive data for such a purpose would diminish users' alertness against identity theft schemes and other potentially nefarious uses.\211\
---------------------------------------------------------------------------
\209\ Intel and the Marketing Research Association cautioned the Commission to avoid sending mixed messages about using such sensitive information while at the same time advising operators to adhere to principles of data minimization. Intel (comment 72, 2011 NPRM), at 7; Marketing Research Association (comment 97, 2011 NPRM), at 3.
\210\ See Institute for Public Representation (comment 71, 2011 NPRM), at 42; see also TechFreedom (comment 159, 2011 NPRM), at 8 (requiring users to go through an age verification process would lead to a loss of personal privacy); New York Intellectual Property Law Association (comment 117, 2011 NPRM), at 3 (parents' privacy rights should not needlessly be put at risk in order to protect their children's privacy).
\211\ See CDT (comment 17, 2011 NPRM), at 9; A. Thierer (comment 162, 2011 NPRM), at 8.
---------------------------------------------------------------------------
As the federal agency at the forefront of improving privacy protections for consumers, the Commission is sensitive to the privacy concerns raised by the comments. The Commission is also aware that both operators and parents benefit from having a choice of several acceptable methods for verifiable parental consent. Moreover, the Commission is not compelling any operator to use this method. The Commission believes that, on balance, government-issued ID provides a reliable and simple means of verifying that the person providing consent is likely to be the parent, and that the requirement that operators delete such data immediately upon verification substantially minimizes the privacy risk associated with that collection. Therefore, the Commission adopts this method among the Rule's non-exhaustive list of acceptable consent methods.\212\
---------------------------------------------------------------------------
\212\ kidSAFE Seal Program asked the Commission to consider whether operators can retain parents' verification information as proof that the verification occurred. See kidSAFE Seal Program (comment 81, 2011 NPRM), at 16. With regard to credit card information or government-issued identifiers, the Commission would consider whether an operator had retained a sufficiently truncated portion of the data as to make it recognizable to the parent but unusable for any other purpose.
---------------------------------------------------------------------------
3. Credit Cards
The 2011 NPRM also proposed including the term ``monetary'' to modify ``transaction'' in connection with use of a credit card to verify parental consent. This added language was intended to make clear the Commission's long-standing position that the Rule limits use of a credit card as a method of parental consent to situations involving actual monetary transactions.\213\ The Commission received one comment specifically addressing this proposed language; EPIC supported the change as correctly limiting the circumstances under which
Page 3988
credit cards can be used as verification. The final Rule incorporates this change, stating ``credit card in connection with a monetary transaction.'' \214\
---------------------------------------------------------------------------
\213\ See 71 FR at 13247, 13253, 13254 (Mar. 15, 2006) (requirement that the credit card be used in connection with a transaction provides extra reliability because parents obtain a transaction record, which is notice of the purported consent, and can withdraw consent if improperly given); Fed. Trade Comm'n, Frequently Asked Questions about the Children's Online Privacy Protection Rule, Question 33, available at http://www.ftc.gov/privacy/coppafaqs.shtm#consent.
\214\ But see Part II.C.4., infra. Several comments note that some alternative payment systems, such as the use of a username and password in the iTunes store, afford equal notice and protections to parents for both paid and unpaid transactions by providing the primary account holder with a separate, contemporaneous notification of each discrete transaction.
---------------------------------------------------------------------------
4. Alternative Online Payment Systems
At the outset of the Rule review, the Commission sought comment on whether to consider modifying the Rule to include alternative online payment systems, in addition to credit cards, as an acceptable means of verifying parental consent in connection with a monetary transaction. The Commission stated in the 2011 NPRM that, at such time, the record was insufficient to support a proposal to permit the use of alternative online payment systems for this purpose. The NPRM also indicated that the Commission was mindful of the potential for children's easy access to, and use of, alternative forms of payments (such as gift cards, debit cards, and online accounts). Thus, the Commission welcomed further discussion of the risks and benefits of using electronic payment methods as a consent mechanism.
Several commenters to the 2011 NPRM asked the Commission to reconsider its position that online payment systems are not yet reliable enough to provide verifiable parental consent, arguing that certain online payment options can meet the same stringent criteria as credit cards.\215\ In particular, Scholastic stressed the importance to operators, particularly in the context of digital apps and other downloadable content, of providing customers the flexibility to use various convenient electronic payment methods. Scholastic urged the Commission to amend the Rule to provide that payment methods other than credit cards, such as debit cards and electronic payment systems, can satisfy the Rule's consent mechanism requirements if they provide separate notification of each discrete monetary transaction to the primary account holder.\216\
---------------------------------------------------------------------------
\215\ See, e.g., Association for Competitive Technology (comment 5, 2011 NPRM), at 7; DMA (comment 37, 2011 NPRM), at 23; eBay (comment 40, 2011 NPRM), at 3-4; kidSAFE (comment 81, 2011 NPRM), at 16; Scholastic (comment 144, 2011 NPRM), at 9-10.
\216\ Other commenters similarly urged that the Rule permit the use of alternate payment systems, where such systems are tied to a valid credit card account, require the user to enter a password, and provide the primary account holder with clear notification of each transaction through email confirmation. See Association for Competitive Technology (comment 5, 2011 NPRM), at 7; kidSAFE (comment 81, 2011 NPRM), at 16; see also eBay (comment 40, 2011 NPRM), at 3-4 (indicating its interest in leveraging PayPal business model to implement a youth account program directly linking children's accounts to verified parent accounts).
---------------------------------------------------------------------------
The Commission, upon review of all of the relevant comments, is persuaded that it should allow the use of other payment systems, in addition to credit cards, provided that any such payment system can meet the same stringent criteria as a credit card. As Scholastic articulated in its comment, the Rule should allow operators to use any electronic or online payment system as an acceptable means of obtaining verifiable parental consent in connection with a monetary transaction where (just as with a credit card) the payment system is used in conjunction with a direct notice meeting the requirements of Sec. 312.4(c) and the operator provides notification of each discrete monetary transaction to the primary account holder. Accordingly, Sec. 312.5(b)(2) of the final Rule includes the following language ``requiring a parent, in connection with a monetary transaction, to use a credit card, debit card, or other online payment system that provides notification of each discrete transaction to the primary account holder.''
5. Electronic or Digital Signatures
In response to the 2010 FRN, several commenters recommended that the Commission accept electronic or digital signatures as a form of verifiable consent.\217\ In the 2011 NPRM, the Commission concluded that the term ``electronic signature'' has many meanings, ranging from ``an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record,'' \218\ to an electronic image of the stylized script associated with a person. The Commission determined that electronic signatures, without more indicia of reliability, were problematic in the context of COPPA's verifiable parental consent requirement.\219\ The NPRM welcomed further comment on how to enhance the reliability of these convenient methods.
---------------------------------------------------------------------------
\217\ See DMA (comment 17, 2010 FRN), at 12; EchoSign (comment 18, 2010 FRN); ESA (comment 20, 2010 FRN), at 10; Toy Industry Association (comment 63, 2010 FRN), at 11. For instance, the ESA proposed that the Commission incorporate a ``sign and send'' method, given that numerous commonly available devices allow users to input data by touching or writing on the device's screen.
\218\ See Electronic Signatures in Global and National Commerce Act, 15 U.S.C. 7006(5).
\219\ See 2011 NPRM at 59818. (The Commission indicated several concerns about allowing electronic signatures, including that, given the proliferation of mobile devices among children and the ease with which children could sign and return an on-screen consent, such mechanisms may not ``ensure that the person providing consent is the child's parent.'' The Commission also noted that, although the law recognizes electronic signatures for the assertion that an individual signed a document, they do not necessarily confirm the underlying identity of the individual signing the document).
---------------------------------------------------------------------------
In commenting on the 2011 NPRM, several commenters asked the FTC to reconsider the utility of electronic signatures in the online world.\220\ The Commission has determined not to include electronic or digital signatures within the non-exhaustive list of acceptable consent mechanisms provided for in Sec. 312.5, given the great variability in the reliability of mechanisms that may fall under this description. For instance, the Commission believes that simple digital signatures, which only entail the use of a finger or stylus to complete a consent form, provide too easy a means for children to bypass a site or service's parental consent process, and thus do not meet the statutory standard of ``reasonably calculated, in light of available technology, to ensure that the person providing consent is the child's parent.'' \221\ However, the Rule would not prohibit an operator's acceptance of a digitally signed consent form where the signature provides other indicia of reliability that the signor is an adult, such as an icon, certificate, or seal of authenticity that accompanies the signature. At the same time, the Commission does not seek to limit or proscribe other types of digital signatures that may also meet the statutory standard. For these reasons, digital or electronic signatures are not included within the Rule's non-
Page 3989
exhaustive list of parental consent mechanisms.
---------------------------------------------------------------------------
\220\ See, e.g., DMA (comment 37, 2011 NPRM), at 23 (Congress passed ESIGN Act over a decade ago and consumers prefer completing transactions online with digital signatures over using cumbersome offline processes); ESA (comment 47, 2011 NPRM), at 22-23 (electronic sign-and-send method meets the statutory standard of ``reasonably calculated, in light of available technology, to ensure that the person providing consent is the child's parent,'' while accommodating parents' use of tablet, mobile device, and small-
screen technologies lacking computer peripherals such as printers or scanners); TechFreedom (comment 159, 2011 NPRM), at 8 (urging Commission to promote development of solutions such as electronic signatures now, rather than wait for next Rule revision).
\221\ While the Commission recognizes that some children also may circumvent the Rule's parental notice and consent mechanisms by signing and sending parental consent forms through mail, fax, or electronic scan, it believes these methods clearly are not as simple for the child as using a computer or handheld device to instantly pen and send a signature.
---------------------------------------------------------------------------
6. Platform Methods of Parental Consent
In response to the 2010 FRN, several commenters asked the Commission to consider whether, and in what circumstances, parental control features in game consoles, and presumably other devices, could be used to provide notice to parents and obtain verified consent under COPPA.\222\ In the 2011 NPRM, the Commission acknowledged that parental control features can offer parents a great deal of control over a child's user experience and can serve as a complement to COPPA's parental consent requirements. However, the Commission concluded that, at that time, it did not appear that any such systems were adequately designed to comply with COPPA, and that the record was insufficient for it to determine whether a hypothetical parental consent mechanism would meet COPPA's verifiable parental consent standard. The Commission, in the 2011 NPRM, encouraged continued exploration of the concept of using parental controls in gaming consoles and other devices to notify parents and obtain their prior verifiable consent.\223\
---------------------------------------------------------------------------
\222\ See ESA (comment 20, 2010 FRN), at 4; Microsoft (comment 39, 2010 FRN), at 7.
\223\ 2011 NPRM, 76 FR 59818 (Sept. 27, 2011), available at http://ftc.gov/os/2011/09/110915coppa.pdf.
---------------------------------------------------------------------------
In response to both the 2011 NPRM and the 2012 SNPRM, numerous stakeholders, including several platform providers, Web site and app developers, and child and privacy advocates, asked the Commission to consider modifications to the Rule to make clear that operators can choose to use a common mechanism--administered by a platform, gaming console, device manufacturer, COPPA safe harbor program,\224\ or other entity--for the purpose of providing notice and obtaining parental consent for multiple operators simultaneously.\225\
Commenters offered a variety of proposals. For instance, several commenters envisioned that platform providers could provide a general notice and obtain consent to collect personal information for those purposes specified in the general notice, and that app developers wanting to collect or use information in ways differing from the general notice would need to independently provide a second separate notice to parents and obtain their consent.\226\ Facebook proposed that operators may also use such common consent mechanisms to meet other COPPA obligations, such as providing parental access to children's data collected by operators.\227\ The Walt Disney Company proposed two possible mechanisms: a `` `Kids Privacy Portal'--through which parents can express privacy preferences in one place for multiple online activities,'' or a joint agreement between the platform operator and application providers ``that determines how data will be collected and used, and how parents exercise control.'' \228\ The Entertainment Software Association (``ESA'') proposed a similar program for video game platforms whereby consoles or hand-held device makers could leverage their existing parental controls technologies.\229\
---------------------------------------------------------------------------
\224\ The Commission notes that Privo, Inc., one of the approved COPPA safe harbors, offers the option to its members to have Privo administer notice and consent programs for member operators.
\225\ See, e.g., P. Aftab (comment 1, 2012 SNPRM), at 7; Association for Competitive Technology (comment 5, 2011 NPRM), at 7-
8 and (comment 7, 2012 SNPRM), at 8; Computer and Communications Industry Association (``CCIA'') (comment 27, 2011 NPRM), at 7-8; CDT (comment 15, 2012 SNPRM), at 5-6; Connect Safely (comment 21, 2012 SNPRM), at 3; ESA (comment 47, 2011 NPRM), at 21-26; Facebook (comment 33, 2012 SNPRM), at 18-20; Future of Privacy Forum (comment 55, 2011 NPRM), at 5-6 and (comment 37, 2012 SNPRM), at 3-6; Microsoft (comment 107, 2011 NPRM), at 13-15 and (comment 66, 2012 SNPRM), at 6; Novachi, Inc. (comment 119, 2011 NPRM); SIIA (comment 150, 2011 NPRM), at 10-12; TechFreedom (comment159, 2011 NPRM), at 7 and (comment 88, 2012 SNPRM), at 13; The Walt Disney Co. (comment 170, 2011 NPRM), at 17-19.
\226\ See, e.g., Association for Competitive Technology (comment 5, 2011 NPRM), at 7-8 and (comment 7, 2012 SNPRM), at 8; CCIA (comment 27, 2011 NPRM), at 7-8; Facebook (comment 33, 2012 SNPRM), at 18-20; Future of Privacy Forum (comment 55, 2011 NPRM), at 5-6 and (comment 37, 2011 SNPRM), at 3-6; Microsoft (comment 107, 2011 NPRM), at 13-15 and (comment 66, 2012 SNPRM), at 13; SIIA (comment 150, 2011 NPRM), at 10-12. Future of Privacy Forum's 2012 comment included proposed Rule language. See also NetChoice (comment 70, 2012 SNPRM), at 12 (proposing Rule language to clarify that COPPA allows for the use of common consent mechanisms).
\227\ Facebook (comment 33, 2012 SNPRM), at 18-19.
\228\ The Walt Disney Co. (comment 170, 2011 NPRM), at 18.
\229\ ESA contemplates that the platforms would provide a notice ``that makes it clear that the child's personal information will be disclosed to third-party game publishers and application providers who may collect, use, and disclose such information through the console or handheld in order to provide a joint or related service,'' and that parental consent ``might be effective across any of the console or handheld maker's related video game platforms and Web sites clearly referenced in the console or handheld maker's privacy policy.'' ESA (comment 47, 2011 NPRM), at 26. Other proposals for common consent mechanisms included outsourcing the process to identity management services, which operators could access through open technology standards. See Novachi (comment 119, 2011 NPRM). CDT acknowledged the potential utility of platform-based outsourcing notice and consent, provided that the Commission required additional safeguards for common consent mechanisms, including parental controls for the ongoing management of consent. CDT (comment 15, 2012 SNPRM), at 5-6.
---------------------------------------------------------------------------
Commenters cited several potential benefits of common consent mechanisms, including: (1) Encouraging the development of interactive content for children by easing the burden individualized notice and consent places on operators, especially in the context of mobile apps \230\; (2) focusing parental attention on one streamlined notice rather than on multiple, confusing, notices \231\; and (3) promoting privacy by eliminating the need for each of these other operators to separately collect online contact information from the child in order to obtain parental consent.\232\ The Center for Democracy and Technology acknowledges that, while not all parents may want to delegate to platforms the authority to get consent on behalf of individual operators, ``others may want to empower their kids to share and obtain information through certain applications without being forced to sign off on every interaction with a new web service.'' \233\
---------------------------------------------------------------------------
\230\ See, e.g., CCIA (comment 27, 2011 NPRM), at 7-8 (stating that platform-based consent programs would ``promote COPPA's goals'' by encouraging developers ``who do not have the resources to independently acquire verifiable parental consent'' to create content and services for children; see also ConnectSafely.org (comment 21, 2012 SNPRM), at 3; P. Aftab (comment 1, 2012 SNPRM), at 7; Tech Freedom (comment 159, 2011 NPRM), at 7.
\231\ For example, Microsoft stated that common consent mechanisms ``would benefit parents because requiring each third party separately to obtain parental consent could be confusing, overwhelming, and costly for parents.'' Microsoft (comment 66, 2012 SNPRM), at 6.
\232\ Microsoft, id.; see also CCIA (comment 27, 2011 NPRM), at 8; Facebook (comment 33, 2012 SNPRM), at 19 (``A rule that enables operators to leverage a common platform for notice and consent would substantially advance the Commission's goal of ensuring that parents receive clear, understandable, and manageable information; it would also minimize the practical and economic costs to parents as a result of multiple consent requests.''); TechAmerica (comment 87, 2012 SNPRM), at 8.
\233\ CDT (comment 15, 2012 SNPRM), at 6.
---------------------------------------------------------------------------
The Commission believes that common consent mechanisms, such as a platform, gaming console, or a COPPA safe harbor program, hold potential for the efficient administration of notice and consent for multiple operators. A well-designed common mechanism could benefit operators (especially smaller ones) and parents alike if it offers a proper means for providing notice and obtaining verifiable parental consent, as well as ongoing controls for parents to manage their children's accounts.\234\ The Commission believes
Page 3990
that such methods could greatly simplify operators' and parents' abilities to protect children's privacy.
---------------------------------------------------------------------------
\234\ Under the system proposed by the Future of Privacy Forum, parents would be apprised of a common set of information practices to which they could consent on an aggregate basis, then would receive individualized notices for additional practices that go beyond those outlined in the common notice. The platform would also ensure that parents have access to easy mechanisms through which to retract their consent to the child's use of any particular site or service. Future of Privacy Forum (comment 37, 2012 SNPRM), at 4-6.
---------------------------------------------------------------------------
Despite the potential benefits, the Commission declines, at this time, to adopt a specific provision for the following reasons. First, even without an express reference in the Rule to such a process, nothing forecloses operators from using a common consent mechanism so long as it meets the Rule's basic notice and consent requirements.\235\ Second, the Commission did not specifically seek comment on this precise issue; nor has it proposed any language in either the NPRM or the SNPRM to address this point. Accordingly, the Commission is reluctant to adopt specific language without the benefit of notice and comment on such language to explore all potential legal and practical challenges of using a common consent mechanism.\236\ Finally, the Commission believes that parties interested in using a common consent mechanism have the option to participate in the voluntary Commission approval process set forth in Section 312.5(3) of the final Rule.\237\ That process would enable the Commission to evaluate, and other interested parties to publicly comment upon, such proposals in an effort to bring to market sound and practical solutions that will serve a broad base of operators.
---------------------------------------------------------------------------
\235\ As noted in note 219, supra, one such common consent mechanism is currently provided by an approved COPPA safe harbor, and there may be others already in operation as well.
\236\ The Commission would want to explore further the difficulties of making sure the notice accurately reflects each individual operator's information practices; how to provide parents with a means to access the operator's privacy policy with regard to information collected from children; and giving parents controls sufficient to refuse to permit an operator's further use or future collection of their child's personal information, and to direct the operator to delete the child's personal information and or disable the child's account with that operator.
\237\ See Part II.C.8., infra.
---------------------------------------------------------------------------
7. The Sliding Scale (``Email Plus'') Method
In conducting the Rule review, the Commission sought comment on whether the sliding scale set forth in Sec. 312.5(b)(2) remains a viable approach to verifiable parental consent.\238\ Under the sliding scale, an operator, when collecting personal information only for its internal use, may obtain verifiable parental consent through an email from the parent, so long as the email is coupled with an additional step.\239\ Such an additional step has included obtaining a postal address or telephone number from the parent and confirming the parent's consent by letter or telephone call, or sending a delayed confirmatory email to the parent after receiving consent.\240\ The purpose of the additional step is to provide greater assurance that the person providing consent is, in fact, the parent. This consent method is often called ``email plus.'' \241\
---------------------------------------------------------------------------
\238\ See 2010 Rule Review, supra note 6, at 17091.
\239\ The sliding scale approach was adopted in the Rule in response to comments that stated that internal uses of information, such as marketing to children, presented less risk than external disclosures of the information to third parties or through public postings. See 1999 Statement of Basis and Purpose, 64 FR at 59901. Other internal uses of children's personal information may include sweepstakes, prize promotions, child-directed fan clubs, birthday clubs, and the provision of coupons.
\240\ The Commission notes that, assuming an operator has obtained a parent's mobile phone number from the parent in response to the first email, confirmation of a parent's consent may done via an SMS or MMS text to the parent.
\241\ By contrast, for uses of personal information that involve disclosing the information to the public or third parties, the Rule requires operators to use more reliable methods of obtaining verifiable parental consent, including but not limited to those identified in Sec. 312.5(b)(1).
---------------------------------------------------------------------------
In adopting the sliding scale approach in 1999, the Commission recognized that the email plus method was not as reliable as the other enumerated methods of verifiable parental consent.\242\ However, it believed that this lower cost option was acceptable as a temporary option, in place until the Commission determined that more reliable (and affordable) consent methods had adequately developed.\243\ In 2006, the Commission extended use of the sliding scale indefinitely, stating that the agency would continue to monitor technological developments and modify the Rule should an acceptable electronic consent technology develop.\244\
---------------------------------------------------------------------------
\242\ 64 FR at 59902 (``Email alone does not satisfy the COPPA because it is easily subject to circumvention by children.'').
\243\ See id. at 59901 (``The Commission believes it is appropriate to balance the costs imposed by a method against the risks associated with the intended uses of the information collected. Weighing all of these factors in light of the record, the Commission is persuaded that temporary use of a ``sliding scale'' is an appropriate way to implement the requirements of the COPPA until secure electronic methods become more available and affordable.'').
\244\ See 71 FR at 13247, 13255, 13254 (Mar. 15, 2006).
---------------------------------------------------------------------------
Email plus has enjoyed wide appeal among operators, who credit its simplicity.\245\ The Commission sought comment in response to the 2010 FRN and at the June 2010 public roundtable on whether to retain email plus in the final Rule. Numerous commenters to the 2010 FRN, including associations who represent operators, supported the continued retention of this method as a low-cost means to obtain parents' consent.\246\ At the same time, several commenters, including safe harbor programs and proponents of new parental consent mechanisms, challenged the method's reliability, given that operators have no real way of determining whether the email address a child provides is that of the parent, and there is no requirement that the parent's email response to the operator contain any additional information providing assurance that it is from a parent.\247\
---------------------------------------------------------------------------
\245\ See WiredSafety.org (comment 68, 2010 FRN), at 21 (``We all assumed email plus would be phased out once digital signatures became broadly used. But when new authentication models and technologies failed to gain in parental adoption, it was continued and is in broad use for one reason--it's simple.'').
\246\ See R. Newton, Remarks from Emerging Parental Verification Access and Methods Panel at the Federal Trade Commission's Roundtable: Protecting Kids' Privacy Online at 211-13 (June 2, 2010), available at http://www.ftc.gov/bcp/workshops/coppa/COPPARuleReview_Transcript.pdf; DMA (comment 17, 2010 FRN), at 10; IAB (comment 34, 2010 FRN), at 2; R. Newton (comment 46, 2010 FRN), at 3; PMA (comment 51, 2010 FRN), at 4-5; Toy Industry Association, Inc. (comment 63, 2010 FRN), at 8.
\247\ See Privo, Inc. (comment 50, 2010 FRN), at 5 (``the presentation of a verified email is much less reliable if there is virtually no proofing or analyzing that goes on to determine who the email belongs to''); RelyId (comment 53, 2010 FRN), at 3 (``The email plus mechanism does not obtain verifiable parental consent at all. It simply does not ensure that a parent `authorizes' anything required by the COPPA statute. The main problem with this approach is that the child can create an email address to act as the supposed parent's email address, send the email from that address, and receive the confirmatory email at that address.''); see also D. Tayloe and P. Spaeth, Remarks from Federal Trade Commission's Roundtable: Protecting Kids' Privacy Online, at 215-17 (email plus is very unreliable).
---------------------------------------------------------------------------
In the 2011 NPRM, the Commission proposed eliminating email plus as a means of obtaining parental consent. The Commission considered whether operators' continued reliance on email plus may have inhibited the development of more reliable methods of obtaining verifiable parental consent. The Commission also made clear that, although internal uses may pose a lower risk of misuse of children's personal information than the sharing or public disclosure of such information, all collections of children's information merit strong verifiable parental consent.
Several commenters supported the Commission's proposal to eliminate email plus. These commenters opined that children can easily circumvent email plus and thus, that it is not
Page 3991
sufficiently effective to meet the statutory requirement of being reasonably calculated to ensure that it is the parent providing consent.\248\ Some of these commenters also echoed the Commission's concern that operators' continued reliance on email plus is a disincentive to innovation.\249\
---------------------------------------------------------------------------
\248\ See K. Dennis, AssertID (comment 34, 2011 NPRM), at 2; AssertID (comment 6, 2012 SNPRM), at 1; TRUSTe (comment 164, 2011 NPRM), at 11; EPIC (comment 41, 2011 NPRM), at 9; Institute for Public Representation (comment 71, 2011 NPRM), at 41; S. Leff, WhooGoo (comment 60, 2012 SNPRM).
\249\ See AssertID, supra note 248; Institute for Public Representation, supra note 248.
---------------------------------------------------------------------------
A majority of the comments, however, strongly urged the Commission to retain email plus.\250\ Several commenters indicated that email plus remains a widely used and valuable tool for communicating with parents and obtaining consent. These commenters maintained that email plus is easy for companies and parents to use, easy to understand, effective, and affordable.\251\ In addition, several commenters expressed concern that other approved methods for obtaining consent would impose significant burdens on operators and parents.\252\ Commenters also questioned whether other methods for verifiable parental consent are any more reliable than email plus.\253\ Finally, several commenters challenged the FTC's assumption that eliminating email plus would spur further innovation in parental consent mechanisms.\254\
---------------------------------------------------------------------------
\250\ See, e.g., American Association of Advertising Agencies (comment 2, 2011 NPRM); Association of Educational Publishers (comment 7, 2011 NPRM); ATT (comment 8, 2011 NPRM); d. boyd (comment 13, 2011 NPRM); DMA (comment 37, 2011 NPRM); ESA (comment 47, 2011 NPRM); Internet Commerce Coalition (comment 74, 2011 NPRM); kidSAFE Seal Program (comment 81, 2011 NPRM); Magazine Publishers of America (comment 61, 2012 SNPRM); Marketing Research Association (comment 97, 2011 NPRM); R. Newton (comment 118, 2011 NPRM); N. Savitt (comment 142, 2011 NPRM); Scholastic (comment 144, 2011 NPRM).
\251\ See, e.g., Association of Educational Publishers (comment 7, 2011 NPRM), at 1 (email plus is effective way to balance parental involvement with children's freedom to pursue educational experiences online); Scholastic (comment 144, 2011 NPRM), at 3 (email plus strikes a balance between the ease of getting consent and low safety risk to children from internal use of their data); Toy Industry Association (comment 163, 2011 NPRM), at 4-5 (similar cost-effective and efficient technologies to replace this method have not yet been developed); NCTA (comment 113, 2011 NPRM), at 20 (termination of email plus will have negative consequences and leave operators with no viable alternative); Privo (comment 132, 2011 NPRM), at 2 (email plus is a reasonable approach that can be understood by all constituents); d. boyd (comment 13, 2011 NPRM), at 5-6 (email plus imposes fewer burdens on families, particular low-
income and immigrant families, than other available mechanisms); DMA (comment 37, 2011 NPRM), at 21 (elimination of email plus would create economic challenges in a difficult economic time).
\252\ See Association for Competitive Technology (comment 7, 2012 SNPRM), at 6 (FTC should not remove easy to understand email plus without finding ways to make parental consent simpler); Toy Industry Association (comment 89, 2012 SNPRM), at 15 (the alternatives to email plus are not likely to be useful, effective, or cost-effective); see also American Association of Advertising Agencies (comment 2, 2011 NPRM), at 2 (this could result in a major reduction in parental consents obtained, solely due to burdensomeness of process); Association of Educational Publishers (comment 7, 2011 NPRM), at 2 (methods such as print, fax, or scan impede timely access to online resources; requiring credit cards or identification imposes barriers that may alienate parents; and other mechanisms impose financial costs on operators that may result in less free content); ESA (comment 47, 2011 NPRM), at 17-18 (requiring other methods of consent will make it harder to offer children robust content; no public benefit in requiring operators to make the costly changeover to other mechanisms); Scholastic (comment 144, 2011 NPRM), at 5-6 (credit card use is not an option for Scholastic, which offers free services; existing options are cumbersome and slow for parents and operators, and newly proposed options are less privacy protective, affordable, or accessible than email plus); TechFreedom (comment 159, 2011 NPRM), at 7-8 (making parental consent more difficult to obtain would disproportionately burden smaller players in the market and retard new entry); Wired Trust (comment 177, 2011 NPRM), at 5 (eliminating email plus will likely result in reduction in innovative and valuable online features for children).
\253\ See d. boyd (comment 13, 2011 NPRM), at 6 (no data to suggest that children are evading email plus more than other consent mechanisms); Scholastic (comment 144, 2011 NPRM), at 8 (no evidence that proposed methods are significantly more reliable); see also kidSAFE Seal Program (comment 81, 2011 NPRM), at 13-14 (the Commission has not shown any harm to children due to use of email plus); SIIA (comment 150, 2011 NPRM), at 12-13 (proposing that only a small percentage of children are likely to falsify parental consent).
\254\ See, e.g., ACT (comment 7, 2012 SNPRM), at 6; Internet Commerce Coalition (comment 74, 2011 NPRM), at 5; Marketing Research Association (comment 97, 2011 NPRM), at 3; A. Thierer (comment 162, 2011 NPRM), at 7; WiredTrust (comment 177, 2011 NPRM), at 5.
---------------------------------------------------------------------------
The Commission is persuaded by the weight of the comments that email plus, although imperfect, remains a valued and cost-effective consent mechanism for certain operators. Accordingly, the final Rule retains email plus as an acceptable consent method for operators collecting personal information only for internal use. Nevertheless, the Commission continues to believe that email plus is less reliable than other methods of consent, and is concerned that, twelve years after COPPA became effective, so many operators rely upon what was supposed to be a temporary option. The Commission is also concerned about perpetuating for much longer a distinction between internal and external uses of personal information that the COPPA statute does not make. Thus, the Commission strongly encourages industry to innovate to create additional useful mechanisms as quickly as possible.
8. Voluntary Process for Commission Approval of Parental Consent Mechanisms
Under the Rule, methods to obtain verifiable parental consent ``must be reasonably calculated, in light of available technology, to ensure that the person providing consent is the child's parent.'' \255\ The Rule thus provides operators with the opportunity to craft consent mechanisms that meet this standard but otherwise are not enumerated in paragraph (b)(2) of Sec. 312.5. Nevertheless, the recent Rule review process revealed that, whether out of concern for potential liability, ease of implementation, or lack of technological developments, operators have been reluctant to utilize consent methods other than those specifically set forth in the Rule.\256\ As a result, little technical innovation in the area of parental consent has occurred.
---------------------------------------------------------------------------
\255\ See 16 CFR 312.5(b)(1).
\256\ The June 2, 2010 Roundtable and the public comments reflect a tension between operators' desire for new methods of parental verification and their hesitation to adopt consent mechanisms other than those specifically enumerated in the Rule. See Remarks from Federal Trade Commission's Roundtable: Protecting Kids' Privacy Online at 226-27 (June 2, 2010), available at http://www.ftc.gov/bcp/workshops/coppa/COPPARuleReview_Transcript.pdf; CDT (comment 8, 2010 FRN), at 3 (``innovation in developing procedures to obtain parental consent has been limited as Web sites choose to use the methods suggested by the FTC out of fear that a more innovative method could lead to liability'').
---------------------------------------------------------------------------
To encourage the development of new consent mechanisms, and to provide transparency regarding consent mechanisms that may be proposed, the Commission in the 2011 NPRM proposed establishing a process in the Rule through which parties may, on a voluntary basis, seek Commission approval of a particular consent mechanism. Applicants who seek such approval would be required to present a detailed description of the proposed parental consent mechanism, together with an analysis of how the mechanism meets the requirements of Sec. 312.5(b)(1) of the Rule. The Commission would publish the application in the Federal Register for public comment, and approve or deny the applicant's request in writing within 180 days of its filing.
The NPRM stated the Commission's belief that this new approval process, aided by public input, would allow the Commission to give careful consideration, on a case-by-case basis, to new forms of obtaining consent as they develop in the marketplace. The Commission also noted that the new process would increase transparency by publicizing approvals or rejections of particular consent mechanisms, and
Page 3992
should encourage operators who may previously have been tentative about exploring technological advancements to come forward and share them with the Commission and the public.
The Commission received several comments expressing support for the concept of a voluntary Commission approval process for new consent mechanisms.\257\ At the same time, several commenters that supported the concept also opined that the 180-day approval period was too lengthy and would likely to discourage use of the program.\258\ Commenters also expressed concerns that applications for approval would be subject to public comment.\259\ One commenter asked the Commission instead to consider publicly releasing a letter explaining the Commission's decision to approve or disapprove a mechanism and thereby signaling what is an acceptable consent mechanism, without causing undue delay or risking the disclosure of proprietary information.\260\
---------------------------------------------------------------------------
\257\ See CCIA (comment 27, 2011 NPRM), at 6 (voluntary approval mechanism is an ``excellent step'' to encourage innovation, provide assurance to potential operators, and ensure parents' participation); Yahoo! (comment 180, 2011 NPRM), at 4 (streamlined approval process for new mechanisms is critical to encouraging innovation); see also Consumers Union (comment 29, 2011 NPRM), at 5; FOSI (comment 51, 2011 NPRM), at 7; kidSAFE Seal Program (comment 81, 2011 NPRM), at 16.
\258\ See, e.g., CCIA (comment 27, 2011 NPRM), at 6 (process must be completed more quickly in order to be useful to industry); Facebook (comment 50, 2011 NPRM), at 14 (Commission's extensive experience with COPPA should enable its more expeditious approval or disapproval of new mechanisms).
\259\ See, e.g., CCIA (comment 27, 2011 NPRM), at 6 (while public comment is important, the Commission should consider ``an alternate private track'' for consent mechanisms involving proprietary technology or a competitive advantage); Facebook (comment 50, 2011 NPRM), at 15 (public comment requirement could negatively affect economic incentives for innovation where rival operators might be able to copy the mechanism).
\260\ Facebook (comment 50, 2011 NPRM), at 15.
---------------------------------------------------------------------------
One commenter opposed to the voluntary approval process asserted that it would be ultra vires to the COPPA statute and would create a de facto requirement for FTC approval of any new consent mechanisms, thereby discouraging operators from developing or using new means not formally approved by the Commission.\261\ The Commission does not believe that offering operators the opportunity to apply for a voluntary approval process will either de facto create an additional COPPA requirement or chill innovation. This is just one more option available to operators.
---------------------------------------------------------------------------
\261\ DMA (comment 37, 2011 NPRM), at 24.
---------------------------------------------------------------------------
The Commission also is persuaded by the comments requesting that it shorten the 180-day approval period. Accordingly, the final Rule's provision for Commission approval of parental consent mechanisms provides that the Commission shall issue a written determination within 120 days of the filing of the request. The Commission anticipates that some commenters will find that this time period also is longer than desired; however, it sets a reasonable time frame in which to solicit public comment and carefully determine whether a consent mechanism is sufficiently well-designed to fulfill the Rule's requirements.
The Commission has determined not to alter the requirement that the proposed mechanisms undergo public review and comment. This is an important component of the approval process. Moreover, just as the Commission has done for COPPA safe harbor applicants, it would permit those entities that voluntarily seek approval of consent mechanisms to seek confidential treatment for those portions of their applications that they believe warrant trade secret protection. In the event an applicant is not comfortable with the Commission's determination as to which materials will be placed on the public record, it will be free to withdraw the proposal from the approval process.
Accordingly, the Commission has amended the Rule to institute this voluntary approval process. For ease of organization, the Commission has created a new section--312.12 (``Voluntary Commission Approval Processes'')--to encompass both this approval process and the process for approval of additional activities under the support for internal operations definition.
9. Safe Harbor Approval of Parental Consent Mechanisms
Several commenters urged the Commission to permit Commission-
approved safe harbor programs to serve as laboratories for developing new consent mechanisms.\262\ The Commission stated its agreement in the 2011 NPRM that establishing such a system may aid the pace of development in this area. The Commission also stated that, given the measures proposed to strengthen Commission oversight of safe harbor programs, allowing safe harbors to approve new consent mechanisms would not result in the loosening of COPPA's standards for parental consent. Thus, the 2011 NPRM included a proposed Rule provision stating that operators participating in a Commission-approved safe harbor program may use any parental consent mechanism deemed by the safe harbor program to meet the general consent standard set forth in Sec. 312.5(b)(1). Although one commenter expressed concern that this would lead to a ``race to the bottom'' by safe harbor programs,\263\ most of the comments were favorable.\264\ Moreover, the Commission believes its added oversight will prevent any ``race to the bottom'' efforts. Accordingly, the Commission adopts this provision unchanged from its September 2011 proposal.
---------------------------------------------------------------------------
\262\ See MPAA (comment 42, 2010 FRN), at 12; Rebecca Newton (comment 46, 2010 FRN), at 2; Privo (comment 50, 2010 FRN), at 2; PMA (comment 51, 2010 FRN), at 5; B. Szoka (comment 59, 2010 FRN), Szoka Responses to Questions for the Record, at 56; TRUSTe (comment 64, 2010 FRN), at 3; see also generally WiredSafety.org (comment 68, 2010 FRN), at 31-32.
\263\ CommonSense Media (comment 26, 2011 NPRM), at 16 (raising concern that safe harbor providers may ``race to the bottom'' to offer operators low-cost consent programs with low standards of verifiable consent, unless the Commission requires safe harbors to publicly disclose their approvals and report them to the FTC).
\264\ See, e.g., eBay (comment 40, 2011 NPRM), at 4; kidSAFE Seal Program (comment 81, 2011 NPRM), at 16; TRUSTe (comment 164, 2011 NPRM), at 11 (noting cost benefit to operators to get early review of mechanism at design or wireframe stage).
---------------------------------------------------------------------------
10. Exceptions to Prior Parental Consent
The COPPA Act and the Rule address five fact patterns under which an operator may collect limited pieces of personal information from children prior to, or sometimes without, obtaining parental consent.\265\ These exceptions permit operators to communicate with the child to initiate the parental consent process, respond to the child once or multiple times, and protect the safety of the child or the integrity of the Web site.\266\ The 2011 NPRM proposed minor changes to the Rule to add one new exception.
---------------------------------------------------------------------------
\265\ See 15 U.S.C. 6502(b)(2); 16 CFR 312.5(c).
\266\ The Act and Rule currently permit the collection of limited personal information for the purposes of: (1) Obtaining verified parental consent; (2) providing parents with a right to opt-out of an operator's use of a child's email address for multiple contacts of the child; and (3) to protect a child's safety on a Web site or online service. See 15 U.S.C. 6502(b)(2); 16 CFR 312.5(c)(1)-(5).
---------------------------------------------------------------------------
-
Section 312.5(c)(1)
The Rule's first exception, Sec. 312.5(c)(1), permits an operator to collect ``the name or online contact information of a parent or child'' to be used for the sole purpose of obtaining parental consent. In view of the limited purpose of the exception--to reach the parent to initiate the consent process--the Commission proposed in the 2011 NPRM to limit the information
Page 3993
collection under this exception to the parent's online contact information only. However, as one commenter pointed out,\267\ the COPPA statute expressly provides that, under this exception, an operator can collect ``the name or online contact information of a parent or child.'' \268\
---------------------------------------------------------------------------
\267\ N. Savitt (comment 142, 2011 NPRM), at 2; see also kidSAFE Seal Program (comment 81, 2011 NPRM), at 17 (this exception should also allow the collection of a child's online contact information to enable the operator to notify the child that the parent has consented).
\268\ 15 U.S.C. 6502(b)(2)(B).
---------------------------------------------------------------------------
Accordingly, the Commission retains Sec. 312.5(c)(1) allowing for the collection of the name or online contact information of the parent or child in order to initiate the notice and consent process.\269\
---------------------------------------------------------------------------
\269\ See Part II.B.1., supra (discussing the parallel correction to Sec. 312.4(c)(1) (direct notice to a parent required under Sec. 312.5(c)(1)).
---------------------------------------------------------------------------
-
Section 312.5(c)(2)
The 2011 NPRM proposed adding one additional exception to parental consent in order to give operators the option to collect a parent's online contact information for the purpose of providing notice to, or updating, the parent about a child's participation in a Web site or online service that does not otherwise collect, use, or disclose children's personal information.\270\ The proposed exception, numbered 312.5(c)(2), provided that the parent's online contact information may not be used for any other purpose, disclosed, or combined with any other information collected from the child. The Commission indicated its belief that collecting a parent's online contact information for the limited purpose of notifying the parent of a child's online activities in a site or service that does not otherwise collect personal information is reasonable and should be encouraged.
---------------------------------------------------------------------------
\270\ At least a few online virtual worlds directed to very young children already follow this practice. Because the Rule did not include such an exception, these operators technically were in violation of COPPA.
---------------------------------------------------------------------------
The few comments addressing this proposed additional exception generally supported it.\271\ Certain commenters recommended minor clarifications, such as adding language to indicate that the notice is voluntary and that operators can link a parent's email address to the child's account.\272\ Upon consideration of the commenters' suggestions, the Commission has made minor changes to the language of this exception to clarify that its use is voluntary and that operators can use the exception to provide notice and subsequent updates to parents. The Commission did not find that clarification is needed to enable operators to link the parent's email to the child's account. Therefore, Sec. 312.5(c)(2) of the final Rule permits the collection of a parent's online contact information to provide voluntary notice to, and subsequently update the parent about, the child's participation in a Web site or online service that does not otherwise collect, use, or disclose children's personal information, where the parent's contact information is not used or disclosed for any other purpose.\273\
---------------------------------------------------------------------------
\271\ See, e.g., DMA (comment 37, 2011 NPRM), at 26; kidSAFE Seal Program (comment 81, 2011 NPRM), at 17-18; N. Savitt (comment 142, 2011 NPRM), at 2.
\272\ See N. Savitt (comment 142, 2011 NPRM), at 2 (proposing that the exception clearly indicate that providing such notice is optional); kidSAFE (comment 81, 2011 NPRM), at 18 (seeking clarification that parent's online contact information is linkable to child's account for updating purposes).
\273\ Section 312.4(c)(2) of the final Rule sets out the direct notice requirements under this exception. See Part II.B.1., supra.
---------------------------------------------------------------------------
-
Section 312.5(c)(3) (One-Time Use Exception)
Section 312.5(c)(2) of the Rule provides that an operator is not required to provide notice to a parent or obtain consent where the operator has collected online contact information from a child for the sole purpose of responding on a one-time basis to a child's request, and then deletes the information. The 2011 NPRM proposed a minor change to the language of the one-time use exception, stating that the exception would apply where the operator collected a child's online contact information for such purpose. One commenter pointed out that the Rule language, ``online contact information from a child,'' is taken directly from the COPPA statute. The commenter also expressed concern that the Commission's proposed change to the language may prevent operators from offering several popular one-time use activities under this exception.\274\ In proposing this minor change, the Commission did not intend to further constrict the permissible uses of online contact information under the one-time-use exception (such as notifications regarding a contest or sweepstakes, homework help, birthday messages, forward-to-a-friend emails, or other similar communications). The Commission is persuaded, therefore, to retain the existing language in Sec. 312.5(c)(3) permitting the collection of online contact information from a child.
---------------------------------------------------------------------------
\274\ See Promotion Marketing Association (comment 133, 2011 NPRM), at 5-6.
---------------------------------------------------------------------------
-
Section 312.5(c)(4) (Multiple Use Exception)
The Rule provides that an operator may notify a parent via email or postal address that it has collected a child's online contact information to contact a child multiple times (for instance, to provide the child with a newsletter or other periodic communication).\275\ The 2011 NPRM proposed revising the multiple contacts exception to allow for the collection of a child's and a parent's online contact information; and to strike the collection of postal address on the basis that it is now outmoded for this use. Although one commenter argued that postal address continues to provide a reasonable means of contacting the parent,\276\ the Commission believes that the revised provision provides operators with a sufficient and practical means of contacting a parent in connection with the multiple use exception. The Commission also notes that the collection of postal address for the purpose of providing notice to a parent is not specifically provided for in the COPPA statute \277\ or elsewhere in the Rule's notice requirements. Therefore, the language of Sec. 312.5(4), as proposed in the 2011 NPRM, is hereby adopted in the final Rule.
---------------------------------------------------------------------------
\275\ Under this exception, the Rule requires the operator only to provide the parent the opportunity to opt-out of granting consent, rather than requiring it to obtain opt-in consent.
\276\ See DMA (comment 37, 2011 NPRM), at 25-26.
\277\ See 15 U.S.C. 6502(b)(2)(C) (statute requires operator to ``use reasonable efforts to provide a parent notice'').
---------------------------------------------------------------------------
-
Section 312.5(c)(5) (Child Safety Exception)
The 2011 NPRM proposed minor changes to the language of the child safety exception to state the purpose of the exception up-front, and to make clear that the operator can collect both the child's and the parent's online contact information where it is necessary to protect the safety of the child and where the information is not used for any other purpose. The Commission received one comment recommending that the Rule also allow for the collection of the parent's name, which the commenter believes may aid in contacting the parent, if necessary.\278\ The Commission recognizes that the circumstances under which the child-
safety exception becomes important may vary significantly. As such, the Commission is persuaded to further modify this exception to allow for collection of the parent's name, given that the exception is available only
Page 3994
where necessary to protect the safety of a child and where such information is not used or disclosed for any purpose unrelated to the child's safety. Section 312.5(c)(5) of the final Rule therefore provides that an operator can collect a child's and a parent's name and online contact information, to protect the safety of a child, where such information is not used or disclosed for any purpose unrelated to the child's safety.
---------------------------------------------------------------------------
\278\ kidSAFE Seal Program (comment 81, 2011 NPRM), at 18.
---------------------------------------------------------------------------
-
Section 312.5(c)(6) (Security of the Site or Service Exception)
The final Rule incorporates the language of the Rule, with only minor, non-substantive changes to sentence structure.
-
Section 312.5(c)(7) (Persistent Identifier Used To Support Internal Operations Exception)
As described in Section II.C.5.b. above, the final Rule creates an exception for the collection of a persistent identifier, and no other personal information, where used solely to provide support for the internal operations of the Web site or online service. Where these criteria are met, the operator will have no notice or consent obligations under this exception.
-
Section 312.5(c)(8) (Operator Covered Under Paragraph (2) of Definition of Web Site or Online Service Directed to Children Collects a Persistent Identifier From a Previously Registered User)
Paragraph (2) of the definition of Web site or online service directed to children sets forth the actual knowledge standard for plug-
ins under the Rule. The Commission is providing for a new, narrow, exception to the Rule's notice and consent requirements for such an operator where it collects a persistent identifier, and no other personal information, from a user who affirmatively interacts with the operator and whose previous registration with that operator indicates that such user is not a child. The Commission has determined that, in this limited circumstance where an operator has already age-screened a user on its own Web site or online service, and such user has self-
identified as being over the age of 12, the burden of requiring that operator to assume that this same user is a child outweighs any benefit that might come from providing notice and obtaining consent before collecting the persistent identifier in this instance. This exception only applies if the user affirmatively interacts with the operator's online service (e.g., by clicking on a plug-in), and does not apply if the online service otherwise passively collects personal information from the user while he or she is on another site or service.
-
-
Section 312.8: Confidentiality, Security, and Integrity of Personal Information Collected From Children
In the 2011 NPRM, the Commission proposed amending Sec. 312.8 to strengthen the provision requiring operators to maintain the confidentiality, security, and integrity of personal information collected from children. Specifically, the Commission proposed adding a requirement that operators take reasonable measures to ensure that any service provider or third party to whom they release children's personal information has in place reasonable procedures to protect the confidentiality, security, and integrity of such personal information.\279\
---------------------------------------------------------------------------
\279\ See 2011 NPRM, 76 FR at 59821. The Rule was silent on the data security obligations of third parties. However, the online notice provision in the Rule required operators to state in their privacy policies whether they disclose personal information to third parties, and if so, whether those third parties have agreed to maintain the confidentiality, security, and integrity of the personal information they obtain from the operator. See Sec. 312.4(b)(2)(iv) of the Rule.
---------------------------------------------------------------------------
The Commission received a number of comments in support of its proposal. EPIC asserted, ``third-party data collectors are the ``least cost avoiders'' and can more efficiently protect the data in their possession than could the data subjects who have transferred control over their personal information.'' \280\ The CDT found the proposal to be a ``sensible requirement that third-party operators put in place reasonable security procedures.'' \281\ And the Privacy Rights Clearinghouse stated, ``the proposed revision * * * would enhance consumer trust and reduce the likelihood that data will be mishandled when disclosed to an outside party.'' \282\
---------------------------------------------------------------------------
\280\ EPIC (comment 41, 2011 NPRM), at 10-11; see also H. Valetk (comment 166, 2011 NPRM), at 2.
\281\ CDT (comment 17, 2011 NPRM), at 2.
\282\ Privacy Rights Clearinghouse (comment 131, 2011 NPRM), at 2.
---------------------------------------------------------------------------
Several commenters opposed the Commission's proposal outright, finding it to be unduly onerous on small businesses \283\ or ultra vires to the statute.\284\ The Commission finds this opposition unpersuasive. The requirement that operators take reasonable care to release children's personal information only to entities that will keep it secure flows directly from the statutory requirement that covered operators ``establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children.'' \285\
---------------------------------------------------------------------------
\283\ Marketing Research Association (comment 97, 2011 NPRM), at 4.
\284\ DMA (comment 37, 2011 NPRM), at 26.
\285\ 15 U.S.C. 6502(b)(1)(D).
---------------------------------------------------------------------------
Several commenters asked the Commission to consider narrowing the proposal so that it applies only to third parties with whom the operator has a contractual relationship, rather than to all third parties, given the breadth of the Rule's definition of third party.\286\ These concerns are obviated by the Commission's proposal in the 2011 NPRM to narrow the definition of release to include only business-to-business disclosures, and not the sort of open-to-the-
public disclosures that worry the commenters.\287\
---------------------------------------------------------------------------
\286\ See Facebook (comment 50, 2011 NPRM), at 15-16 (``The current definition of third party in Section 312.1 sweeps so broadly that it also encompasses other users who can view content or receive communications from the child--including, for example, the child's relatives or classmates. Under the proposed amendment, operators would be obligated to take reasonable measures to ensure that these relatives and classmates have `reasonable procedures' in place to protect the child's personal information''); CDT (comment 17, 2011 NPRM), at 2 (``consistent with the Commission's goal of addressing business-to-business data sharing, the Commission should make it clear that these additional data security requirements apply only to other FTC-regulated entities with which the operator has a contractual relationship'').
\287\ See 2011 NPRM, 76 FR at 59809.
---------------------------------------------------------------------------
Other commenters expressed concern with the Commission's use of the words ``reasonable measures'' and ``ensure'' in the proposed revised language, stating that such phrases are too subjective to be workable and set an impossible-to-reach standard.\288\ Requiring operators to use ``reasonable measures'' both to establish their own data protection programs and to evaluate the programs of others has long been the standard the Commission employs in the context of its data security actions, and provides companies with the flexibility necessary to effectuate strong data privacy programs.\289\ Importantly, the
Page 3995
reasonable measures standard is the one set by Congress for operators' confidentiality, security, and integrity measures in the COPPA statute.\290\
---------------------------------------------------------------------------
\288\ IAB (comment 73, 2011 NPRM), at 14 (``The IAB is concerned that these requirements, if finalized, would create a risk of liability to companies based on highly subjective standards and on third party activities ''); MPAA (comment 109, 2011 NPRM), at 16-17 (``the proposed requirement that operators take measures sufficient to ensure compliance by vendors and other third parties might be misapplied to make operators the effective guarantors of those measures. As a practical matter, no business is in a position to exercise the same degree of control over another, independent business as it can exercise over its own operations.'').
\289\ See, e.g., In the Matter of Compete, Inc., FTC File No. 102 3155 (proposed consent order) (Oct. 29, 2012), available at http://www.ftc.gov/os/caselist/1023155/121022competeincagreeorder.pdf; In the Matter of Franklin's Budget Car Sales, Inc., FTC Docket No. C-4371 (consent order) (Oct. 3, 2012), available at http://ftc.gov/os/caselist/1023094/121026franklinautomalldo.pdf; In the Matter of EPN, Inc., FTC Docket No. C-4370 (consent order) (Oct. 3, 2012), available at http://ftc.gov/os/caselist/1123143/121026epndo.pdf; In the Matter of Upromise, Inc., FTC Docket No. C-4351 (consent order) (Apr. 3, 2012), available at http://www.ftc.gov/os/caselist/1023116/120403upromisedo.pdf.
\290\ 15 U.S.C. 6502(b)(1)(D).
---------------------------------------------------------------------------
The Commission finds merit, however, in the concerns expressed about the difficulty operators may face in ``ensuring'' that any service provider or any third party to whom it releases children's personal information has in place reasonable procedures to protect the confidentiality, security, and integrity of children's personal information.\291\ The Motion Picture Association of America (``MPAA'') urged the Commission to take the approach adopted in the Safeguards Rule implemented under the Gramm-Leach-Bliley Act. Entities covered by the Safeguards Rule are required to take ``reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue'' and to ``require service providers by contract to implement and maintain such safeguards.'' \292\
---------------------------------------------------------------------------
\291\ Facebook (comment 50, 2011 NPRM), at 16; MPAA (comment 109, 2011 NPRM), at 16-17.
\292\ 16 CFR 314.4(d).
---------------------------------------------------------------------------
After reviewing these comments, the Commission has decided to modify the standard required when an operator releases children's personal information to service providers and third parties. Operators must inquire about entities' data security capabilities and, either by contract or otherwise, receive assurances from such entities about how they will treat the personal information they receive. They will not be required to ``ensure'' that those entities secure the information absolutely.
Accordingly, the revised confidentiality, security, and integrity provision (Sec. 312.8) states that the operator must establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children. The operator must also take reasonable steps to release children's personal information only to service providers and third parties who are capable of maintaining the confidentiality, security and integrity of such information, and who provide assurances that they will maintain the information in such a manner.
-
Section 312.10: Data Retention and Deletion Requirements
In the 2011 NPRM, the Commission proposed adding a data retention and deletion provision (new Section 312.10).\293\ The general tenet of data security, that deleting unneeded information is an integral part of any reasonable data security strategy (discussed in the Commission's 1999 COPPA Rulemaking), informed the Commission's rationale for this new provision.\294\ In addition, the new proposed provision flowed from the statutory authority granted in COPPA for regulations requiring operators to establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children.\295\
---------------------------------------------------------------------------
\293\ See 76 FR at 59822.
\294\ See 1999 Notice of Proposed Rulemaking, 64 FR at 22750, 22758-59 (``The Commission encourages operators to establish reasonable procedures for the destruction of personal information once it is no longer necessary for the fulfillment of the purpose for which it was collected. Timely elimination of data is the ultimate protection against misuse or unauthorized disclosure.'').
\295\ See 15 U.S.C. 6502(b)(1)(D).
---------------------------------------------------------------------------
The Commission received support for its data retention and deletion proposal from several consumer groups and an individual commenter.\296\ The Institute for Public Representation stated that, without such a provision, operators have no incentive to eliminate children's personal information and may retain it indefinitely.\297\ Other supporters mentioned that a requirement to retain and eliminate data works in tandem with the Rule's requirement that data be kept confidential and secure, and has the added benefit of reducing the risk and impact of data breaches.\298\
---------------------------------------------------------------------------
\296\ EPIC (comment 41, 2011 NPRM), at 4-5; Institute for Public Representation (comment 71, 2011 NPRM), at 42-43; Sarah Kirchner (comment 82, 2011 NPRM); Privacy Rights Clearinghouse (comment 131, 2011 NPRM), at 2-3.
\297\ Institute for Public Representation, supra note 296, at 42-43.
\298\ See EPIC (comment 41, 2011 NPRM), at 12; Privacy Rights Clearinghouse (comment 131, 2011 NPRM), at 2-3.
---------------------------------------------------------------------------
Other commenters, primarily industry members, opposed the addition of a data retention and deletion provision, stating that it was unnecessary, vague, and unduly prescriptive.\299\ These commenters especially objected to the combination of the data retention and deletion provision with the proposed expansion of the definition of personal information to include persistent identifiers. They asserted that the proposed deletion requirement would require companies to delete non-personally identifiable information, such as data used for Web site and marketing analytics.\300\
---------------------------------------------------------------------------
\299\ American Association of Advertising Agencies (comment 2, 2011 NPRM), at 3; DMA (comment 37, 2011 NPRM), at 27; NCTA (comment 113, 2011 NPRM), at 21; National Retail Federation (comment 114, 2011 NPRM), at 4; TRUSTe (comment 164, 2011 NPRM), at 11-12; Yahoo! (comment 180, 2011 NPRM), at 15-16.
\300\ See DMA (comment 37, 2011 NPRM), at 26; Yahoo! (comment 180, 2011 NPRM), at 15.
---------------------------------------------------------------------------
The Commission chose the phrases ``for only as long as is reasonably necessary'' and ``reasonable measures'' to avoid the very rigidity about which commenters opposing this provision complain.\301\ Such terms permit operators to determine their own data retention needs and data deletion capabilities, without the Commission dictating specific time-frames or data destruction practices.\302\
---------------------------------------------------------------------------
\301\ See National Retail Federation (comment 114, 2011 NPRM), at 4; TRUSTe (comment 164, 2011 NPRM), at 12.
\302\ For this reason, the Commission declines to adopt the Institute for Public Representation's request that it require companies to delete children's personal information within three months. See Institute for Public Representation (comment 71, 2011 NPRM), at 43.
---------------------------------------------------------------------------
While this new provision may require operators to give additional thought to notions of data retention and deletion, it should not add significantly to operators' burden. The existing Rule already prohibits operators from conditioning a child's participation in an activity on the child disclosing more personal information than is reasonably necessary to participate.\303\ Operators also must establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children.\304\ This new data retention and deletion provision, Section 312.10, requires operators to anticipate the reasonable lifetime of the personal information they collect from children, and apply the same concepts of data security to its disposal as they are required to do with regard to its collection and maintenance.
---------------------------------------------------------------------------
\303\ 16 CFR 312.7.
\304\ 16 CFR 312.8.
---------------------------------------------------------------------------
Therefore, the Commission modifies Section 312.10 as originally proposed, without change from its 2011 proposal.
-
Section 312.11: Safe Harbors
The COPPA statute established a ``safe harbor'' for participants in Commission-approved COPPA self-regulatory programs.\305\ As noted in the 2011 NPRM, with the safe harbor provision, Congress intended to encourage industry members and other groups to develop their own COPPA oversight programs, thereby promoting efficiency and flexibility in complying with
Page 3996
COPPA's substantive provisions.\306\ COPPA's safe harbor provision also was intended to reward operators' good faith efforts to comply with COPPA. The Rule therefore provides that operators fully complying with an approved safe harbor program will be ``deemed to be in compliance'' with the Rule for purposes of enforcement. In lieu of formal enforcement actions, such operators instead are subject first to the safe harbor program's own review and disciplinary procedures.\307\
---------------------------------------------------------------------------
\305\ See 15 U.S.C. 6503.
\306\ See 2011 NPRM, 76 FR at 59822 (citing the 1999 Statement of Basis and Purpose, 64 FR at 59906).
\307\ See 16 CFR 312.10(a) and (b)(4).
---------------------------------------------------------------------------
In the 2011 NPRM, the Commission proposed several significant substantive changes to the Rule's safe harbor provision to strengthen the Commission's oversight of participating safe harbor programs. The proposed changes include a requirement that applicants seeking Commission approval of self-regulatory guidelines submit comprehensive information about their capability to run an effective safe harbor program. The changes also establish more rigorous baseline oversight by Commission-approved safe harbor programs of their members. In addition, the changes require Commission-approved safe harbor programs to submit periodic reports to the Commission. The Commission also proposed certain structural and linguistic changes to increase the clarity of the Rule's safe harbor provision.\308\
---------------------------------------------------------------------------
\308\ See 2011 NPRM, 76 FR at 59822-24.
---------------------------------------------------------------------------
The Commission received several comments regarding the proposed changes, including comments from all four of the COPPA safe harbor programs the Commission had approved by 2011,\309\ as well as from several other industry associations.\310\ With the exception of a few areas discussed below, commenters favorably viewed the Commission's proposed revisions.\311\ First, among commenters who mentioned them, there was uniform support for the proposed revised criteria for approval of self-regulatory guidelines, which would mandate that (at a minimum) safe harbor programs conduct annual, comprehensive reviews of each of their members' information practices.\312\ Accordingly, the Commission retains paragraph (b)(2) (``Criteria for approval of self-
regulatory guidelines'') without change from its 2011 proposal.
---------------------------------------------------------------------------
\309\ CARU (comment 20, 2011 NPRM); Entertainment Software Rating Board (``ESRB'') (comment 48, 2011 NPRM); Privo (comment 132, 2011 NPRM); TRUSTe (comment 164, 2011 NPRM).
\310\ DMA (comment 37, 2011 NPRM); IAB (comment 73, 2011 NPRM); kidSAFE Seal Program (comment 81, 2011 NPRM).
\311\ See, e.g., CARU (comment 20, 2011 NPRM), at 2 (``In general, CARU believes that most of the proposed modifications will not only strengthen the safe harbor program, but will facilitate and enhance the Commission's named goals of reliability, accountability, transparency and sustainability.'').
\312\ CARU (comment 20, 2011 NPRM), at 3; ESRB (comment 48, 2011 NPRM), at 2; kidSAFE Seal Program (comment 81, 2011 NPRM), at 20; TRUSTe (comment 164, 2011 NPRM), at 12.
---------------------------------------------------------------------------
In paragraph (c) (``Request for Commission approval of self-
regulatory program guidelines''), the Commission proposed requiring applicants to explain in detail their business model and their technological capabilities and mechanisms for initial and continuing assessment of subject operators' fitness for membership in the safe harbor program. Again, commenters who mentioned it uniformly supported this change.\313\ Accordingly, the Commission revises paragraph (c) (``Request for Commission approval of self-regulatory program guidelines'') without change from its 2011 proposal.
---------------------------------------------------------------------------
\313\ See, e.g., kidSAFE Seal Program (comment 81, 2011 NPRM), at 20 (``KSP supports this change and believes more detailed information during the application process will give the FTC greater comfort regarding the operations of safe harbor programs''); see also CARU (comment 20, 2011 NPRM), at 3; ESRB (comment 48, 2011 NPRM), at 3; TRUSTe (comment 164, 2011 NPRM), at 13. One commenter sought assurance that such materials will be treated confidentially. kidSAFE Seal Program (comment 81, 2011 NPRM), at 20. Safe harbor applicants may designate materials as ``confidential,'' and the Commission will apply the same standards of confidentiality to such materials as it does to other voluntary submissions. See 15 U.S.C. 46(f) and 57b-2, and the Commission's Rules of Practice 4.10-4.11, 16 CFR 4.10-4.11.
---------------------------------------------------------------------------
The response to the 2011 proposal for periodic reporting by safe harbors to the Commission (paragraph (d)) was more ambivalent.\314\ While commenters generally supported stronger Commission oversight of safe harbor activities post-approval, they were concerned that a requirement forcing safe harbors to ``name names'' of violative member operators would chill the programs' abilities to recruit and retain members, and generally would be counter to notions of self-
regulation.\315\
---------------------------------------------------------------------------
\314\ The proposed change would have required safe harbor programs to submit periodic reports--within one year after the revised Rule goes into effect and every eighteen months thereafter--
of the results of the independent audits under revised paragraph (b)(2) and of any disciplinary actions taken against member operators. See 2011 NPRM, 76 FR at 59823.
\315\ See CARU (comment 20, 2011 NPRM), at 3 (``Much of the value of self-regulation is that issues can be handled quickly and effectively. The reporting of `any' action taken against a Web site operator may have a chilling effect on Web site operators' willingness to raise compliance issues themselves''); DMA (comment 37, 2011 NPRM), at 26 (``Based on feedback from our members, the DMA has reason to believe that this revision would decrease interest and participation in the safe harbor programs in contravention of the Commission's goal of increasing safe harbor participation''); see also ESRB (comment 48, 2011 NPRM), at 4; IAB (comment 73, 2011 NPRM), at 14; kidSAFE Seal Program (comment 81, 2011 NPRM), at 20; Privo (comment 132, 2011 NPRM), at 8; TRUSTe (comment 164, 2011 NPRM), at 13.
---------------------------------------------------------------------------
The Commission continues to believe that there is great value in receiving regular reports from its approved safe harbor programs. It is persuaded, however, that these reports need not name the member operators who were subject to a safe harbor's annual comprehensive review. Rather, the Commission has revised paragraph (d) to permit safe harbors to submit a report to the Commission containing an aggregated summary of the results of the independent assessments conducted under paragraph (b)(2). In addition, to simplify matters, the Commission has changed the required reporting period to an annual requirement rather than one occurring every eighteen months after the first annual report.\316\ Therefore, the Commission amends paragraph (d) of the safe harbor provision so that it reads as set forth at Sec. 312.11(d) in the regulatory amendments of this rule.
---------------------------------------------------------------------------
\316\ The kidSAFE Seal Program also sought to limit the Rule's reporting requirements to ``material'' descriptions of disciplinary action taken against member operators (paragraph (d)(1)), ``reasonable'' Commission requests for additional information (paragraph (d)(2)), and ``material'' consumer complaints (paragraph (d)(3)). See kidSAFE Seal Program (comment 81, 2011 NPRM), at 21. The Commission believes that such limitations are unnecessary and that the wording of the requirements in revised paragraph (d) will not be overly burdensome for compliance by safe harbor programs.
---------------------------------------------------------------------------
-
-
Final Regulatory Flexibility Act Analysis
The Regulatory Flexibility Act of 1980 (``RFA'')\317\ requires a description and analysis of proposed and final Rules that will have significant economic impact on a substantial number of small entities. The RFA requires an agency to provide an Initial Regulatory Flexibility Analysis (``IRFA'') with the proposed Rule, and a Final Regulatory Flexibility Analysis (``FRFA''), if any, with the final Rule.\318\ The Commission is not required to make such analyses if a Rule would not have such an economic effect.\319\ As described below, the Commission anticipates the final Rule amendments will result in more Web sites and online services being subject to the Rule and to the Rule's disclosure and other compliance requirements. As discussed in Part IV.C, below, the Commission believes that a high proportion of operators of Web sites and online services potentially affected by
Page 3997
these revisions are small entities as defined by the RFA.
---------------------------------------------------------------------------
\317\ 5 U.S.C. 601-612.
\318\ See 5 U.S.C. 603-04.
\319\ See 5 U.S.C. 605.
---------------------------------------------------------------------------
As described in Part I.B above, in September 2011, the Commission issued a Notice of Proposed Rulemaking setting forth proposed changes to the Commission's COPPA Rule. The Commission issued a Supplemental Notice of Proposed Rulemaking in August 2012 in which the Commission proposed additional and alternative changes to the Rule. In both the 2011 NPRM and 2012 SNPRM, the Commission published IRFAs and requested public comment on the impact on small businesses of its proposed Rule amendments. The Commission received approximately 450 comments, combined, on the changes proposed in the 2011 NPRM and the 2012 SNPRM. Numerous comments expressed general concern that the proposed revisions would impose costs on businesses, including small businesses;\320\ few comments discussed the specific types of costs that the proposed revisions might impose, or attempted to quantify the costs or support their comments with empirical data.
---------------------------------------------------------------------------
\320\ See, e.g., D. Russell-Pinson (comment 81, 2012 SNPRM), at 1; Ahmed Siddiqui (comment 83, 2012 SNPRM), at 1; Mindy Douglas (comment 29, 2012 SNPRM), at 1; Karen Robertson (comment 80, 2012 SNPRM), at 1; R. Newton (comment 118, 2011 NPRM), at 1.
---------------------------------------------------------------------------
In the 2011 NPRM and 2012 SNPRM, the Commission proposed modifications to the Rule in the following five areas: Definitions, Notice, Parental Consent, Confidentiality and Security of Children's Personal Information, and Safe Harbor Programs. The Commission proposed modifications to the definitions of operator, personal information, support for internal operations, and Web site or online service directed to children. Among other things, the proposed definition of personal information was revised to include persistent identifiers where they are used for purposes other than support for internal operations, and to include screen and user names where they function as online contact information. In addition, the Commission proposed adding a new Section to the Rule regarding data retention and deletion.
The Commission shares the concern many commenters expressed that operators be afforded enough time to implement changes necessary for them to comply with the final Rule amendments.\321\ Accordingly, the final Rule will go into effect on July 1, 2013.
---------------------------------------------------------------------------
\321\ See DMA (comment 37, 2011 NPRM), at 17; National Cable & Telecommunications Association (comment 113, 2011 NPRM), at 15-16.
---------------------------------------------------------------------------
-
Need for and Objectives of the Final Rule Amendments
The objectives of the final Rule amendments are to update the Rule to ensure that children's online privacy continues to be protected, as directed by Congress, even as new online technologies evolve, and to clarify existing obligations for operators under the Rule. The legal basis for the final Rule amendments is the Children's Online Privacy Protection Act, 15 U.S.C. 6501 et seq.
-
Significant Issues Raised by Public Comments, Summary of the Agency's Assessment of These Issues, and Changes, if Any, Made in Response to Such Comments
In the IRFAs, the Commission sought comment regarding the impact of the proposed COPPA Rule amendments and any alternatives the Commission should consider, with a specific focus on the effect of the Rule on small entities. As discussed above, the Commission received hundreds of comments in response to the rule amendments proposed in the NPRM and SNPRM. The most significant issues raised by the public comments, including comments addressing the impacts on small businesses, are set forth below. While the Commission received numerous comments about the compliance burdens and costs of the rules, the Commission did not receive much quantifiable information about the nature of the compliance burdens. The Commission has taken the costs and burdens of compliance into consideration in adopting these amendments.
(1) Definitions
Definition of Collects or Collection
As described above in Part II.A.1.b., the Commission proposed amendments to the Rule provision that allows sites and services to make interactive content available to children, without providing parental notice and obtaining consent, if all personal information is deleted prior to posting. The Commission proposed replacing this 100% deletion standard with a ``reasonable measures'' standard to further enable sites and services to make interactive content available to children, without providing parental notice and obtaining consent, thereby reducing burdens on operators. Most comments favored the ``reasonable measures'' standard, and the Commission has adopted it.
Definitions of Operator and Web Site or Online Service Directed to Children
As discussed above in Part II.A.4., the Commission's proposed rule changes clarify the responsibilities under COPPA when independent entities or third parties, e.g., advertising networks or downloadable plug-ins, collect information from users through child-directed sites and services. Under the proposed revisions, the child-directed content provider would be strictly liable for personal information collected from its users by third parties. The Commission also proposed imputing the child-directed nature of the content site to the entity collecting the personal information if that entity knew or had reason to know that it was collecting personal information through a child-directed site. Most of the comments opposed the Commission's proposed modifications. Some of these commenters asserted that the proposed revisions would impracticably subject new entities to the Rule and its compliance costs.\322\
---------------------------------------------------------------------------
\322\ See, e.g., Application Developers Alliance (comment 5, 2012 SNPRM), at 3-5; Association for Competitive Technology (comment 7, 2012 SNPRM), at 3-5; Center for Democracy & Technology (``CDT'') (comment 15, 2012 SNPRM), at 4-5; DMA (comment 28, 2012 SNPRM), at 5, 17; J. Garrett (comment 38, 2012 SNPRM), at 1; L. Mattke (comment 63, 2012 SNPRM); S. Weiner (comment 97, 2012 SNPRM), at 1-2.
---------------------------------------------------------------------------
With some modifications to the proposed Rule language, the Commission has retained the proposed strict liability standard for child-directed content providers that allow third parties to collect personal information from users of the child-directed sites, as discussed in Part II.A.5.b. The Commission recognizes the potential burden that strict liability places on child-directed content providers, particularly small app developers, but believes that the potential burden will be eased by the changes to the definitions of persistent identifier and support for internal operations adopted in the Final Rule, as well as the exception to notice and parental consent--Sec. 312.5(c)(7)--where an operator collects only a persistent identifier only to support its internal operations. Further, in light of the comments received, the Commission revised the language proposed in the 2012 SNPRM to clarify that the language describing ``on whose behalf'' does not encompass platforms, such as Google Play or the App Store, that offer access to someone else's child-directed content. Also in light of the comments received, the Commission deemed third-
party plug-ins to be co-operators only where they have actual knowledge that
Page 3998
they are collecting personal information from users of a child-directed site. This change will likely substantially reduce the number of operators of third-party plug-ins, many of whom are small businesses, who must comply with the Rule in comparison to the proposal in the 2012 SNPRM. In response to comments requesting it, the Commission is also providing guidance in Part II.A.4.b. above as to when it believes this ``actual knowledge'' standard will likely be met.
Definition of Online Contact Information
The Commission proposed clarifications to the definition of online contact information to flag that the term broadly covers all identifiers that permit direct contact with a person online and to ensure consistency between the definition of online contact information and the use of that term within the definition of personal information. The proposed revised definition identified commonly used online identifiers, including email addresses, instant messaging (``IM'') user identifiers, voice over Internet protocol (``VOIP'') identifiers, and video chat user identifiers, while also clarifying that the list of identifiers was non-exhaustive. This amendment, which serves to clarify the definition, should not increase operators' burden.
Definition of Personal Information
-
Screen or User Names
As described above, the Commission in the 2011 NPRM proposed modifications to the inclusion of screen names in the definition of personal information. Numerous commenters expressed concern that the Commission's screen-name proposal would unnecessarily inhibit functions that are important to the operation of child-directed Web sites and online services. In response to this concern, the 2012 SNPRM proposed covering screen names as personal information only in those instances in which a screen or user name rises to the level of online contact information. As discussed in Part II.A.5.a., the Commission has adopted the proposal in the SNPRM. The revision permits operators to use anonymous screen and user names in place of individually identifiable information, including use for content personalization, filtered chat, for public display on a Web site or online service, or for operator-to-
user communication via the screen or user name. Moreover, the definition does not reach single log-in identifiers that permit children to transition between devices or access related properties across multiple platforms. Thus, the provision for screen or usernames does not create any additional compliance burden for operators.
-
Persistent Identifiers and Support for Internal Operations
In the 2011 NPRM, and again in the 2012 SNPRM, the Commission proposed broadening the definition of personal information to include persistent identifiers, except where used to support the internal operations of the site or service. Numerous commenters opposed the inclusion of persistent identifiers, while others sought to broaden the definition of support for internal operations to allow for more covered uses of persistent identifiers. Some commenters maintained that, to comply with COPPA's notice and consent requirements in the context of persistent identifiers, sites would be burdened to collect more personal information on their users, which is also contrary to COPPA's goals of data minimization.\323\ As set forth in Part II.A.5.b, the Commission believes that persistent identifiers permit the online contacting of a specific individual and thus are personal information. However, the Commission recognizes that including persistent identifiers within the definition of personal information may impose a burden on some operators to provide notice to parents and obtain consent under circumstances where they previously had no COPPA obligation. The Commission also recognizes that persistent identifiers are used for a host of functions that are unrelated to contacting a specific individual and fundamental to the smooth functioning of the Internet, the quality of the site or service, and the individual user's experience. Thus, the final Rule further restricts the proposed definition of persistent identifiers to ``a persistent identifier that can be used to recognize a user over time and across different Web sites or online services, where such persistent identifier is used for functions other than or in addition to support for the internal operations of the Web site or online service.'' (Emphasis added.) The Final Rule also modifies the definition of support for internal operations to broaden the list of activities covered within this category. As a result of these modifications, fewer uses of persistent identifiers will be covered in the Final Rule than in the proposals, thereby resulting in fewer operators being subject to the final Rule amendments.
---------------------------------------------------------------------------
\323\ Facebook (comment 33, 2012 SNPRM), at 9-10; Google (comment 41, 2012 SNPRM), at 5; J. Holmes (comment 47, 2012 SNPRM).
---------------------------------------------------------------------------
-
Photographs, Videos, and Audio Files
In the 2011 NPRM, the Commission proposed creating a new category within the definition of personal information covering a photograph, video, or audio file where such file contains a child's image or voice. Some commenters supported this proposal; others were critical. The latter claimed that the proposal's effect would limit children's participation in online activities involving ``user-generated content,'' that photos, videos, and/or audio files, in and of themselves, do not permit operators to locate or contact a child, or that the Commission's proposal is premature.\324\ The Commission determined, as discussed in Part II.A.5.c, that such files meet the standard for ``personal information'' set forth in the COPPA statute. While recognizing that defining personal information to include photos, videos, and/or audio files may affect a limited number of operators, this is warranted given the inherently personal nature of this content.
---------------------------------------------------------------------------
\324\ See National Cable & Telecommunications Association (comment 113, 2011 NPRM), at 16; Wired Trust (comment 177, 2011 NPRM), at 10; Toy Industry Association (comment 163, 2011 NPRM), at 14; Privo (comment 132, 2011 NPRM), at 7; see also Center for Democracy and Technology (comment 17, 2011 NPRM), at 7-8.
---------------------------------------------------------------------------
-
Geolocation Information
In the 2011 NPRM, the Commission stated that, in its view, existing paragraph (b) of the definition of personal information already covered any geolocation information that provides precise enough information to identify the name of a street and city or town. To make this clear, the Commission has made geolocation information a stand-alone category within the definition of personal information. Thus, this amendment should impose little or no additional burden on operators.
Definition of Web Site or Online Service Directed to Children
In the 2012 SNPRM, the Commission proposed revising the definition of Web site or online service directed to children to allow a subset of sites falling within that category an option not to treat all users as children. However, several commenters expressed concern and confusion that the proposed amendment would expand COPPA's reach to sites or services not previously covered under the definition of Web site directed to children, and thus would be likely to impose COPPA's burdens on
Page 3999
operators not previously covered by the Rule. The Commission has clarified in Part II.A.7 that it did not intend to expand the reach of the Rule to additional sites and services through the proposed revision, but rather to create a new compliance option for a subset of Web sites and online services already considered directed to children under the Rule's totality of the circumstances standard. The Commission also clarified when a child-directed site would be permitted to age-
screen to differentiate among users, thereby providing further guidance to businesses. This amendment will ease compliance burdens on operators of sites or services that qualify to age-screen their visitors. In addition, the Commission has made further clarifying edits to the definition of Web site or online service directed to children to incorporate the ``actual knowledge'' standard for plug-ins or ad networks, as discussed above.
(2) Section 312.4: Notice
Direct Notice to a Parent
The Commission proposed refining the Rule requirements for the direct notice to ensure a more effective ``just-in-time'' message to parents about an operator's information practices. Commenters generally supported the Commission's proposed changes as providing greater clarity and simplicity to otherwise difficult-to-understand statements. The Commission adopted the proposed modification but, in light of suggestions in the comments, reorganized the paragraphs to provide a better flow and guidance for operators.
Notice on the Web Site or Online Service
The Commission proposed to change the Rule's online notice provision to require all operators collecting, using, or disclosing information on a Web site or online service to provide contact information, including, at a minimum, the operator's name, physical address, telephone number, and email address. This proposal marked a change from the existing Rule's ``single operator designee'' proviso that such operators could designate one operator to serve as the point of contact. Almost all commenters who spoke to the issue opposed mandating that the online notice list all operators. Among the varied reasons cited in opposition to this change was the potential burden on operators. After considering the comments, the Commission has determined to retain the Rule's ``single operator designee'' proviso.
(3) Section 312.5: Parental Consent
Based on input the Commission received at its June 2, 2010 COPPA roundtable and comments to the 2010 FRN, in the 2011 NPRM the Commission proposed several significant changes to the mechanisms of verifiable parental consent set forth in paragraph (b) of Sec. 312.5. These included recognizing electronic scans of signed consent forms, video conferencing, government-issued ID, and a credit card in connection with a monetary transaction as additional mechanisms for operators to obtain parental consent. In response to comments, the Commission also adopted amendments to allow the use of other payment systems, in addition to credit cards, in connection with a monetary transaction as verifiable parental consent, provided that any such payment system notifies the primary account holder of each discrete transaction. These changes provide operators with further flexibility in complying with the Rule.
The Commission also proposed eliminating the sliding scale (``email plus'') approach to parental consent for operators collecting personal information only for internal use. As discussed in Part II.C.7, most commenters urged the Commission to retain email plus, in part because they asserted it is more affordable and less burdensome for operators to use than other approved methods for obtaining consent. Persuaded by the weight of the comments, the Commission retained email plus as an acceptable consent method for internal use of personal information, thereby providing operators with the choice of a mechanism many deem useful and affordable.
Finally, the Commission also added two new voluntary processes for evaluation and pre-clearance of parental consent mechanisms: use of an FTC preapproval process and use of a safe harbor program for such purpose. The availability of these voluntary pre-clearance mechanisms may provide benefits to participating operators in reducing the burden associated with the start-up of a new COPPA compliance mechanism.
(4) Section 312.8: Confidentiality, Security, and Integrity of Personal Information Collected From Children
In 2011, the Commission proposed amending Sec. 312.8 of the Rule to require that operators take reasonable measures to ensure that any service provider or third party to whom they release children's personal information has in place reasonable procedures to protect the confidentiality, security, and integrity of such personal information. Although many commenters supported this proposal, some raised concerns about the language ``reasonable measures'' and ``ensure.'' Other commenters opposed the requirement as unduly onerous on small businesses. The Commission found merit in the concerns expressed about the difficulty operators may face in ``ensuring'' that any service provider or third party has in place reasonable confidentiality and security procedures. Thus, the Commission has lessened the burden on operators that would have been imposed by the earlier proposal by requiring operators to take reasonable steps to release personal information only to service providers and third parties capable of maintaining it securely.
(5) Section 312.10: Data Retention and Deletion Requirements
The Commission also has added a data retention and deletion provision (new Section 312.10) to the Rule to require operators to anticipate the reasonable lifetime of the personal information they collect from children, and apply the same concepts of data security to its disposal as they are required to do with regard to its collection and maintenance. While several commenters supported this provision, several others objected to it as unnecessary, vague, or unduly prescriptive.\325\ These commenters especially objected to the burden imposed by the combination of the data retention and deletion provision with the proposed expansion of the definition of personal information to include persistent identifiers. The Commission believes these concerns are not warranted in light of the language of the final Rule amendments, and that this requirement should not add significantly to operators' burdens.
---------------------------------------------------------------------------
\325\ See, e.g., DMA (comment 37, 2011 NPRM), at 27; Toy Industry Association (comment 163, 2011 NPRM), at 16-17.
---------------------------------------------------------------------------
(6) Section 312.11: Safe Harbors
The Commission proposed changing the Rule's safe harbor provision to strengthen the Commission's oversight of participating safe harbor programs. Among other things, the Commission proposed requiring those programs to submit periodic reports to the Commission. Commenters generally viewed the proposed revisions favorably, but expressed concern that the proposed language requiring safe harbors to name violative member operators, would chill participation in the programs. Heeding these concerns,
Page 4000
the Commission will not require regular reports from approved safe harbor programs to name the member operators who were subject to a safe harbor's annual comprehensive review. The final Rule amendments instead will require safe harbor programs to submit an aggregated summary of the results of the annual, comprehensive reviews of each of their members' information practices. These amendments ensure the effectiveness of the safe harbor programs upon which numerous operators rely for assistance in their compliance with COPPA.
-
-
Description and Estimate of the Number of Small Entities Subject to the Final Rule or Explanation Why No Estimate Is Available
The revised definitions in the Final Rule will affect operators of Web sites and online services directed to children, as well as those operators that have actual knowledge that they are collecting personal information from children. The Final Rule amendments will impose costs on entities that are ``operators'' under the Rule. The Commission staff is unaware of any comprehensive empirical evidence concerning the number of operators subject to the Rule. However, based on the public comments received and the modifications adopted here, the Commission staff estimates that approximately 2,910 existing operators may be subject to the Rule's requirements and that there will be approximately 280 new operators per year for a prospective three-year period.
Under the Small Business Size Standards issued by the Small Business Administration, ``Internet publishing and broadcasting and web search portals'' qualify as small businesses if they have fewer than 500 employees.\326\ Consistent with the estimate set forth in the 2012 SNPRM, Commission staff estimates that approximately 85-90% of operators potentially subject to the Rule qualify as small entities. The Commission staff bases this estimate on its experience in this area, which includes its law enforcement activities, discussions with industry members, privacy professionals, and advocates, and oversight of COPPA safe harbor programs. This estimate is also consistent with the sole comment that attempted to quantify how many operators are small entities.\327\
---------------------------------------------------------------------------
\326\ See U.S. Small Business Administration Table of Small Business Size Standards Matched to North American Industry Classification System Codes, available at http://www.sba.gov/sites/default/files/files/Size_Standards_Table.pdf.
\327\ Association for Competitive Technology (comment 7, 2012 SNPRM), at 2 (ACT's research ``found that 87% of educational apps are created by companies qualifying as `small' by SBA guidelines''). ACT gave only limited information about how it calculated this figure.
---------------------------------------------------------------------------
-
Description of the Projected Reporting, Recordkeeping, and Other Compliance Requirements of the Final Rule Amendments, Including an Estimate of the Classes of Small Entities Which Will Be Subject to the Rule and the Type of Professional Skills That Will Be Necessary To Comply
The final Rule amendments will likely increase certain disclosure and other compliance requirements for covered operators. In particular, the requirement that the direct notice to parents include more specific details about an operator's information collection practices, pursuant to a revised Sec. 312.4 (Notice), would impose a one-time cost on operators. The addition of language in Sec. 312.8 (confidentiality, security, and integrity of personal information collected from children) will require operators to ``take reasonable steps'' to release children's personal information only to third parties capable of maintaining its confidentiality, security, and integrity, and who provide assurances that they will do so. The final Rule amendments contain additional reporting requirements for entities voluntarily seeking approval to be a COPPA safe harbor self-regulatory program, and additional compliance requirements for all Commission-approved safe harbor programs. Each of these improvements to the Rule may entail some added cost burden to operators, including those that qualify as small entities, but the Commission has considered these burdens and responded to commenters as described in Part III.C., above.
The revisions to the Rule's definitions will also likely increase the number of operators subject to the final Rule amendments' disclosure and other compliance requirements. In particular, the revised definition of operator will cover additional child-directed Web sites and online services that choose to integrate plug-ins or advertising networks that collect personal information from visitors. Similarly, the addition of paragraph (2) to the definition of Web site or online service directed to children, which clarifies that the Rule covers a Web site or online service that has actual knowledge that it is collecting personal information directly from users of a Web site or online service directed to children, will potentially cover additional Web sites and online services. These amendments may entail some added cost burden to operators, including those that qualify as small entities; however, as described above, other final Rule amendments will ease the burdens on operators and facilitate compliance.
The estimated burden imposed by these modifications to the Rule's definitions is discussed in the Paperwork Reduction Act section of this document, and there should be no difference in that burden as applied to small businesses. While the Rule's compliance obligations apply equally to all entities subject to the Rule, it is unclear whether the economic burden on small entities will be the same as or greater than the burden on other entities. That determination would depend upon a particular entity's compliance costs, some of which may be largely fixed for all entities (e.g., Web site programming) and others that may be variable (e.g., choosing to operate a family friendly Web site or online service), and the entity's income or profit from operation of the Web site or online service (e.g., membership fees) or from related sources (e.g., revenue from marketing to children through the site or service). As explained in the Paperwork Reduction Act section, in order to comply with the Rule's requirements, operators will require the professional skills of legal (lawyers or similar professionals) and technical (e.g., computer programmers) personnel. As explained earlier, the Commission staff estimates that there are approximately 2,910 Web site or online services that would qualify as operators under the final Rule amendments, that there will be approximately 280 new operators per year for a three-year period, and that approximately 85-90% of all such operators would qualify as small entities under the SBA's Small Business Size standards.
-
Steps the Agency Has Taken To Minimize Any Significant Economic Impact on Small Entities, Consistent With the Stated Objectives of the Applicable Statute
In drafting the amendments to the Rule's definitions, the Commission has attempted to avoid unduly burdensome requirements for all entities, including small businesses. The Commission believes that the final Rule amendments will advance the goal of children's online privacy in accordance with COPPA. For each of the modifications, the Commission has taken into account the concerns evidenced by the record. On balance, the Commission believes that the benefits to children and their parents outweigh the costs of implementation to industry.
The Commission has considered, but has decided not to propose, an
Page 4001
exemption for small businesses. The primary purpose of COPPA is to protect children's online privacy by requiring verifiable parental consent before an operator collects personal information. The record and the Commission's enforcement experience have shown that the threats to children's privacy are just as great, if not greater, from small businesses or even individuals than from large businesses.\328\ Accordingly, an exemption for small businesses would undermine the very purpose of the statute and Rule.
---------------------------------------------------------------------------
\328\ See, e.g.,United States v. RockYou, Inc., No. 3:12-cv-
01487-SI (N.D. Cal., entered Mar. 27, 2012); United States v. Godwin, No. 1:11-cv-03846-JOF (N.D. Ga., entered Feb. 1, 2012); United States v. W3 Innovations, LLC, No. CV-11-03958 (N.D. Cal., filed Aug. 12, 2011); United States v. Industrious Kid, Inc., No. CV-08-0639 (N.D. Cal., filed Jan. 28, 2008); United States v. Xanga.com, Inc., No. 06-CIV-6853 (S.D.N.Y., entered Sept. 11, 2006); United States v. Bonzi Software, Inc., No. CV-04-1048 (C.D. Cal., filed Feb. 17, 2004); United States v. Looksmart, Ltd., No. 01-605-A (E.D. Va., filed Apr. 18, 2001); United States v. Bigmailbox.Com, Inc., No. 01-606-B (E.D. Va., filed Apr. 18, 2001).
---------------------------------------------------------------------------
Nonetheless, the Commission has taken care in developing the final Rule amendments to set performance standards that regulated entities must achieve, but provide them with the flexibility to select the most appropriate, cost-effective, technologies to achieve COPPA's objective results. For example, the Commission has retained the standard that verifiable parental consent may be obtained via any means reasonably calculated, in light of available technology, to ensure that the person providing consent is the child's parent. The new requirements for maintaining the security of children's personal information and deleting such information when no longer needed do not mandate any specific means to accomplish those objectives. The Commission has adopted the ``reasonable measures'' standard enabling operators to use competent filtering technologies to prevent children from publicly disclosing personal information, which the Commission believes will make it easier for operators to avoid the collection of children's personal information. The new definition of support for internal operations is intended to provide operators with the flexibility to collect and use personal information for purposes consistent with ordinary operation, enhancement, or security measures. Moreover, the changes to Web site or online service directed to children should provide greater flexibility to ``family friendly'' sites and services in developing mechanisms to provide the COPPA protections to child visitors.
-
-
Paperwork Reduction Act
The existing Rule contains recordkeeping, disclosure, and reporting requirements that constitute``information collection requirements'' as defined by 5 CFR 1320.3(c) under the OMB regulations that implement the Paperwork Reduction Act (APRA''), as amended, 44 U.S.C. 3501 et seq. OMB has approved the Rule's existing information collection requirements through July 31, 2014. In accordance with the PRA, the Commission is seeking OMB approval of the final Rule amendments under OMB Control No. 3084-0117. The disclosure, recordkeeping, and reporting requirements under the final Rule amendments discussed above constitute``collections of information'' for purposes of the PRA.
Upon publication of the 2011 NPRM and the 2012 SNPRM, the FTC submitted the proposed Rule amendments and a Supporting Statement to OMB. In response, OMB filed comments (dated October 27, 2011 and August 10, 2012) indicating that it was withholding approval pending the Commission's examination of the public comments in response to the 2011 NPRM and 2012 SNPRM. The remainder of this section sets forth a revised PRA analysis, factoring in relevant public comments and the Commission's resulting or self-initiated changes to the proposed Rule.
-
Practical Utility
According to the PRA,``practical utility'' is`` the ability of an agency to use information, particularly the capability to process such information in a timely and useful fashion.'' \329\ The Commission has maximized the practical utility of the new disclosure (notice) and reporting requirements contained in the final Rule amendments, consistent with the requirements of COPPA.
---------------------------------------------------------------------------
\329\ 44 U.S.C. 3502(11). In determining whether information will have ``practical utility,'' OMB will consider ``whether the agency demonstrates actual timely use for the information either to carry out its functions or make it available to third-parties or the public, either directly or by means of a third-party or public posting, notification, labeling, or similar disclosure requirement, for the use of persons who have an interest in entities or transactions over which the agency has jurisdiction.'' 5 CFR 1320.3(l).
---------------------------------------------------------------------------
(1) Disclosure Requirements
The final Rule amendments to Section 312.4(c) more clearly articulate the specific information that operators' direct notices to parents must include about their information collection and use practices. The succinct, ``just-in-time'' notices will present key information to parents to better enable them to determine whether to permit their children to provide personal information online, seek access from a Web site or online service operator to review their children's personal information, and object to any further collection, maintenance, or use of such information. The final Rule amendments to the definitions of operator and Web site or online service directed to children in Section 312.2 will better ensure that parents are provided notice when a child-directed site or service chooses to integrate into its property other services that collect visitors' personal information. For example, the final Rule amendment to the definition of operator clarifies that child-directed Web sites that do not collect personal information from users, but that employ downloadable software plug-ins or permit other entities, such as advertising networks, to collect personal information directly from their users, are covered operators with responsibility for providing parental notice and obtaining consent. Additionally, the changes to the definition of Web site or online service directed to children, among other things, will clarify that the Rule covers a plug-in or ad network where it has actual knowledge that it is collecting personal information directly from users of a child-directed Web site or online service.
To avoid obscuring the most meaningful, material information for consumers, however, the Commission removed a previously proposed requirement, set forth in the 2011 NPRM, that all operators collecting, using, or disclosing information on a Web site or online service must provide contact information.\330\ The Commission retained the existing Rule's proviso that such operators could designate one operator to serve as the point of contact. For the same reason, the Commission has streamlined the Rule's online notice requirement to require a simple statement of: (1) What information the operator collects from children, including whether the Web site or online service enables a child to make personal information publicly available; (2) how the operator uses such information; and (3) the operator's disclosure practices for such information.\331\ As a part of this revision, the Commission also removed the required statement that the operator may not condition a child's participation in an activity on the child's disclosure of more personal
Page 4002
information than is reasonably necessary to participate in such activity.\332\
---------------------------------------------------------------------------
\330\ 2011 NPRM, 76 FR at 59815.
\331\ See id.
\332\ See id.
---------------------------------------------------------------------------
(2) Reporting Requirements
As stated above, the Commission believes that there is great value in receiving annual reports from its approved safe harbor programs. Obtaining this information (in addition to the Commission's right to access program records) will better ensure that all safe harbor programs keep sufficient records and that the Commission is routinely apprised of key information about the safe harbors' programs and membership oversight. Further, requiring annual reports to include a description of any safe harbor approvals of new parental consent mechanisms will inform the Commission of the emergence of new feasible parental consent mechanisms for operators. Additionally, the final Rule amendments impose more stringent requirements for safe harbor applicants' submissions to the Commission to better ensure that applicants are capable of administering effective safe harbor programs.
Thus, given the justifications stated above for the amended disclosure and reporting requirements, the final Rule amendments will have significant practical utility.
-
Explanation of Estimated Incremental Burden Under the Final Rule Amendments
1. Disclosure: 69,000 hours (for new and existing operators, combined).
2. Reporting: 720 hours (one-time burden, annualized, and recurring).
3. Labor Costs: $21,508,900.
4. Non-Labor/Capital Costs: $0.
Estimating PRA burden of the final Rule amendments' requirements depends on various factors, including the number of firms operating Web sites or online services directed to children or having actual knowledge that they are collecting or maintaining personal information from children, and the number of such firms that collect persistent identifiers for something other than support for the internal operations of their Web sites or online services.
In its 2011 NPRM PRA analysis, FTC staff estimated that there were then approximately 2,000 operators subject to the Rule. Staff additionally stated its belief that the number of operators subject to the Rule would not change significantly as a result of the proposed revision to the definition of personal information proposed in the 2011 NPRM.\333\ Staff believed that altering that definition would potentially increase the number of operators, but that the increase would be offset by other proposed modifications. These offsets included provisions allowing the use of persistent identifiers to support the internal operations of a Web site or online service, and permitting the use of ``reasonable measures,'' such as automated filtering, to strip out personal information before posting children's content in interactive venues. The 2011 NPRM PRA analysis also assumed that some operators of Web sites or online services will adjust their information collection practices so that they will not be collecting personal information from children.\334\ In the 2011 NPRM PRA analysis, staff estimated that approximately 100 new operators per year \335\ (over a prospective three-year OMB clearance \336\) of Web sites or online services would likely be covered by the Rule through the proposed modifications. No comments filed in response to the 2011 NPRM took direct issue with these estimates.\337\ Commission staff also estimated that no more than one safe harbor applicant will submit a request within the next three years,\338\ and this estimate has not been contested.
---------------------------------------------------------------------------
\333\ Id. at 59826.
\334\ Id.
\335\ Id.
\336\ Under the PRA, agencies may seek from OMB a maximum three year clearance for a collection of information. 44 U.S.C. 3507(g).
\337\ Likewise, no comments were received in response to the February 9, 2011 and May 31, 2011 Federal Register notices (76 FR 7211 and 76 FR 31334, respectively, available at http://www.gpo.gov/fdsys/pkg/FR-2011-02-09/pdf/2011-2904.pdf and http://www.gpo.gov/fdsys/pkg/FR-2011-05-31/pdf/2011-13357.pdf) seeking comment on the information requirements associated with the existing COPPA Rule and the FTC burden estimates for them. These notices included the Commission staff estimate that roughly 100 new web entrants each year will fall within the Rule's coverage.
\338\ 2011 NPRM, 76 FR at 59826; accord 76 FR 7211 at 7213 and 76 FR at 31335.
---------------------------------------------------------------------------
In its 2012 SNPRM PRA analysis, staff stated that the proposed modifications to the Rule would change the definitions of operator and Web site or online service directed to children, potentially increasing the number of operators subject to the Rule. Staff added, however, that the proposed amendments to the definitions of support for internal operations and Web site or online service direct to children should offset some of the effects of these other definitional expansions.\339\ The 2012 SNPRM PRA analysis also assumed that some operators of Web sites or online services would adjust their information collection practices so that they would not be collecting personal information from children.\340\ Based on those assumptions, FTC staff estimated that, in addition to the 2,000 existing operators already covered by the Rule (per the 2011 NPRM PRA analysis), there would be approximately 500 existing operators of Web sites or online services likely to be newly covered due to the proposed modifications.\341\ Staff also estimated that 125 additional new operators per year (over a prospective three-year clearance) would be covered by the Rule through the proposed modifications. That was incremental to the previously cleared FTC estimate of 100 new operators per year for the then existing Rule.\342\ The FTC's 2011 NPRM and 2012 SNPRM analyses thus cumulatively accounted for an estimated 2,500 existing operators and 225 new operators each year that would be subject to the proposed Rule amendments.\343\
---------------------------------------------------------------------------
\339\ 2012 SNPRM, 77 FR at 46650.
\340\ Id.
\341\ Id.
\342\ Id.
\343\ Commenter Association for Competitive Technology therefore is mistaken in asserting that the ``FTC has estimated 500 existing education app makers will be affected by the proposed rule, and an additional 125 newly affected entities each successive year.'' Association for Competitive Technology (comment 7, 2012 SNPRM), at 2. The Commission's previous PRA analyses did not specifically estimate numbers of ``education app makers,'' and the commenter did not account for the Commission's 2011 NPRM estimate of 2,000 existing entities.
---------------------------------------------------------------------------
Given the public comments received, the Commission now estimates, as detailed further below, that the final Rule amendments will cover 2,910 existing operators of Web sites or online services and 280 new operators per year.\344\ These groups of covered operators would generally consist of certain traditional Web site operators, mobile app developers, plug-in developers, and advertising networks.
---------------------------------------------------------------------------
\344\ Under the existing OMB clearance for the pre-amended Rule, however, the FTC had already accounted for an estimated 100 new operators each requiring approximately 60 hours to comply with the Rule. See 76 FR at 7211, 7212 (Feb. 9, 2011); 76 FR at 31334, 31335 (May 31, 2011). Thus, to avoid double-counting what has already been submitted to OMB and cleared, the ensuing calculations for new operators' disclosure burden account strictly for the difference between the revised population estimate (280) and the currently cleared estimate (100), i.e., 180 additional new operators.
---------------------------------------------------------------------------
Existing Operators
The Commission received several comments directed to its estimates of the number of existing operators, all of which assert that the Commission significantly underestimated these
Page 4003
numbers.\345\ The Association for Competitive Technology (``ACT'') cited data showing that as of September 2012, there were approximately 74,000 ``education'' apps in the iTunes App Store, and 30,000 in the Android market.\346\ Based on its review of ``top'' apps, ACT calculated a ratio of 1.54 apps per developer of ``education'' apps in the iTunes App Store,\347\ and that approximately 60% of apps in this category were directed to children under 13.\348\ Based on this information, ACT calculated that approximately 28,800 app developers would be ``potentially affected'' by the proposed modifications to the Rule set forth in the 2011 NPRM and 2012 SNPRM.\349\ One commenter, the moderator of an online group called ``Parents With Apps,'' stated that the group has more than 1,400 small developers of family-friendly apps as members.\350\ Another commenter stated that the Silicon Valley Apps for Kids Meetup group had ``well over 500 members'' as of September 2012, and that ``the kids app market is incredibly vibrant with thousands of developers, over 500 of which'' are group members.\351\
---------------------------------------------------------------------------
\345\ Association for Competitive Technology (comment 7, 2012 SNPRM), at 2-3; S. Weiner (comment 97, 2012 SNPRM), at 1-2; J. Garrett (comment 38, 2012 SNPRM), at 1; see also DMA (comment 28, 2012 SNPRM), at 17.
\346\ Association for Competitive Technology (comment 7, 2012 SNPRM), at 2.
\347\ Id. (``Unlike the game sector, where one developer may have several applications in the top 100, Educational Apps tended to be much closer to a one-to-one ratio between app and creator at 1.54 apps per developer.'').
\348\ Id. ACT's comment does not describe the methodology it used to categorize apps as being directed to children under 13.
\349\ Id. at 2-3.
\350\ S. Weiner (comment 97, 2012 SNPRM), at 1-2.
\351\ J. Garrett (comment 38, 2012 SNPRM), at 1.
---------------------------------------------------------------------------
Per the industry information source cited by ACT, the Commission believes that as of November 2012, there were approximately 75,000 education apps in the iTunes App Store and approximately 33,000 education apps in the Android market.\352\ ACT's comment appears to suggest that it would be reasonable for the Commission to base its PRA estimate of the number of existing operators subject to the final Rule amendments on the number of ``Education'' app developers. The Commission agrees that developer activity in the ``Education'' category, to the extent it can be discerned through publicly available information, is a useful starting point for estimating the number of mobile app developers whose activities may bring them within coverage of the final Rule amendments. As discussed below, the Commission also looks to information about ``Education'' apps in the Google Play store, and apps in the game and entertainment categories in both the iTunes App Store and Google Play, as a basis for its estimates for this PRA analysis.\353\
---------------------------------------------------------------------------
\352\ ``App Store Metrics,'' 148Apps.biz (accessed Nov. 14, 2012), available at http://148apps.biz/app-store-metrics; ``Android Statistic Top Categories,'' AppBrain (accessed Nov. 15, 2012), available at http://www.appbrain.com/stats/android-market-app-categories.
\353\ Although there are other mobile app platforms and distribution channels, the Commission believes that the education, games, and entertainment categories in the iTunes App Store and the Google Play store adequately approximate the relevant universe of unique mobile app developers whose apps may be directed to children under 13.
---------------------------------------------------------------------------
Similar to what appears to have been ACT's methodology, Commission staff reviewed a list, generated using the desktop version of iTunes, of the Top 200 Paid and Top 200 Free ``Education'' apps in the iTunes App Store as of early November 2012. Based on the titles and a prima facie review of the apps' descriptions, staff believes that approximately 56% of them may be directed to children under 13.\354\ Averaging this figure and ACT's 60% calculation, FTC staff estimates that 58% of ``Education'' Apps in the iTunes App Store may be directed to children under 13, meaning that 43,500 of those 75,000 ``Education'' apps may be directed to children under 13. To determine a ratio for the Education apps for the Android platform, Commission staff reviewed listings of the Top 216 Paid and Top 216 Free ``Education'' apps in the Google Play store as of mid-November 2012. Staff believes that approximately 42% of them may be directed to children under 13; 42% of 33,000 apps yields 13,860 apps that may be directed to children under 13. Adding these projected totals together yields 57,360 such apps for both platforms, combined.
---------------------------------------------------------------------------
\354\ In estimating this percentage (and similar percentages throughout this section) for purposes of the PRA analysis, the Commission's staff attempted to err on the side of inclusion to count any apps that were likely to be used by children, whether independently or with parents' assistance. To ensure a generous accounting of operators potentially subject to the Rule, this estimate included, for example, even toddler apps unlikely to be used by children themselves without direct parental assistance.
---------------------------------------------------------------------------
It is unreasonable to assume, however, that all apps directed to children under 13 collect personal information from children, and that no developers only collect persistent identifiers in support for their internal operations. Data from the Mobile Apps for Kids II Report indicate that about 59% of the apps surveyed transmit device identification or other persistent identifiers, to their developers.\355\ However, it is not clear how many of those app developers would be using those persistent identifiers in a way that would fall within the final Rule's amended definition of personal information. Indeed, the Commission believes, based on the comments received, that many developers would use such persistent identifiers to support internal operations as defined in the final Rule amendments and not for other purposes, such as behavioral advertising directed to children.\356\ Furthermore, the Commission believes that some mobile app developers, like some other operators of Web sites or online services, will adjust their information collection practices so that they will not be collecting personal information from children. The data in the staff report do suggest, however, that approximately 3.5% of apps directed to children under 13 could be collecting location information or a device's phone number, thus making their developers more likely to be covered by the final Rule amendments.\357\ The Commission believes it is reasonable to assume that an additional 1.5% of those apps could be collecting other personal information, including transmitting persistent identifiers to developers (or their partners) to use in ways that implicate COPPA. This results in an estimate of 5% of apps that may be directed to children under 13, i.e., approximately 2,870 apps, that operate in ways that implicate the final Rule amendments.
---------------------------------------------------------------------------
\355\ See Mobile Apps for Kids II Report, at 9-10, supra note 189.
\356\ See L. Akemann (comment 2, 2012 SNPRM), at 1; DMA (comment 37, 2011 NPRM), at 7, 14; Scholastic (comment 144, 2011 NPRM), at 13-14; TRUSTe (comment 164, 2011 NPRM), at 5.
\357\ See Mobile Apps for Kids II Report, at 5-6, 10, supra note 189 (14 of 400 apps tested transmitted the mobile device's geolocation or phone number). These apps also transmitted device identification.
---------------------------------------------------------------------------
To estimate the number of developers responsible for these apps,\358\ Commission staff used the ``Browse'' function in iTunes, to generate a list of 6,000 apps in the ``Education'' category. Sorting that list by ``Genre'' generates a list of approximately 3,300 apps for which ``Education'' was listed as the ``Genre.'' Approximately 1,800 developers were listed in connection
Page 4004
with these apps. Dividing 3,300 apps by 1,800 developers yields an iTunes education-apps-per-developer ratio of approximately 1.83,\359\ and the Commission assumes this ratio would apply for Android apps, as well. Assuming a 1.83 education-apps-to-developer ratio, it appears that approximately 1,570 developers (2,870) 1.83) are responsible for apps directed to children under 13 that operate in ways likely to implicate the final Rule amendments.
---------------------------------------------------------------------------
\358\ The Commission believes it is reasonable to assume, as ACT appears to, that developers responsible for multiple apps directed to children under 13 will typically have a single set of privacy practices, a single privacy policy to describe them, and will develop a single method of disclosing the information required by the final Rule amendments. Any marginal increase in developer burdens addressed in this PRA analysis arising from developers publishing additional apps is therefore not likely to be significant.
\359\ This appears to be a larger universe of data than ACT consulted in generating its education-apps-to-developer ratio of 1.54. See Association for Competitive Technology (comment 7, 2012 SNPRM), at 2. Data from the industry source ACT cites indicate a more general apps-to-developer ratio of approximately 3.8 apps per developer of iTunes App Store apps. See ``App Store Metrics,'' 148Apps.biz (accessed Nov. 14, 2012), available at http://148apps.bix/app-store-metrics (727,938 Total Active Apps; 191,366 Active Publishers in the U.S. App Store).
---------------------------------------------------------------------------
At least one more adjustment to this total of approximately 1,570 potentially affected developers is warranted, however. Commission staff's research for its two Mobile Apps for Kids reports indicate that approximately 2.2% of developers of apps that may be directed to children under 13 develop apps for both iOS and Android.\360\ To avoid double-counting developers that develop for both platforms, the Commission subtracts 18 developers from the total (i.e., 1,570 x 2.2% = 34.54; 35) 2 = 17.5), leaving approximately 1,552 potentially affected developers of iOS and Android education apps that may be directed to children under 13.
---------------------------------------------------------------------------
\360\ See Mobile Apps for Kids II Report, at 26, supra note 189 (approximately 1.6% of developers of apps studied developed apps for both Android and iOS); FTC Staff, Mobile Apps for Kids: Current Privacy Disclosures are Disappointing, at 8-9 (Feb. 2012), available at http://www.ftc.gov/os/2012/02/120216mobile_apps_kids.pdf (approximately 2.7% of developers of apps studied developed apps for both Android and iOS). Averaging these two percentages indicates developer overlap of approximately 2.2%.
---------------------------------------------------------------------------
The Commission believes it is also reasonable to add to this total existing developers of game and entertainment apps directed to children under 13. Commission staff reviewed a list, generated using the desktop version of iTunes, of the Top 200 Paid and Top 200 Free ``Game'' apps in the iTunes App Store as of mid November 2012. Staff believes that approximately 7% of them may be directed to children under 13. Publicly available industry data show that approximately 131,000 game apps were available in the iTunes App Store as of mid-November 2012;\361\ thus, approximately 9,170 of those apps may be directed to children under 13. Assuming 5% of those apps operate in ways that bring their developers within the ambit of the final Rule amendments, at a general app-to-
developer ratio of 3.8 apps per developer,\362\ this yields approximately 120 developers (9,170 x .05 = 458.5; 458.5) 3.8 = 120.66). Commission staff observed that approximately 35% of developers of games that may be directed to children under the age of 13 also develop similar education apps. Thus, of the aforementioned 120 developers, 65% would not already have been counted in the previous tally of educational app developers. This calculation yields an estimate of approximately 78 additional developers of iTunes games apps primarily directed to children under 13 that likely are covered by the final Rule amendments.
---------------------------------------------------------------------------
\361\ ``App Store Metrics,'' 148Apps.biz (accessed Nov. 14, 2012), available at http://148apps.bix/app-store-metrics.
\362\ See note 357, supra.
---------------------------------------------------------------------------
Performing a similar calculation for iTunes ``Entertainment'' app developers yields few additional existing developers that are likely to be covered. Commission staff reviewed a list, generated using the desktop version of iTunes, of the Top 200 Paid and Top 200 Free ``Entertainment'' apps in the iTunes App Store as of mid-November 2012. Staff believes that approximately 2.5% of them may be directed to children under 13. Publicly available industry data show that approximately 67,600 ``Entertainment'' apps were available in the iTunes App Store as of mid-November 2012; \363\ thus, approximately 1,690 of those apps may be directed to children under 13. Assuming 5% of those apps operate in ways that bring their developers within the ambit of the final Rule amendments, at a general app-to-developer ratio of 3.8 apps per developer, this yields approximately 22 developers (1,690 x .05 = 84.5; 84.5) 3.8 = 22.24). Commission staff observed that approximately 84% of developers of ``Entertainment'' apps that may be directed to children under the age of 13 also develop similar education and game apps. Thus, of the aforementioned 22 developers, 16% would not already have been counted in the previous tally of educational and games app developers. This calculation yields an estimate of approximately 4 additional developers of iTunes entertainment apps primarily directed to children under 13 that likely are covered by the final Rule amendments.
---------------------------------------------------------------------------
\363\ ``App Store Metrics,'' 148Apps.biz (accessed Nov. 14, 2012), available at http://148apps.bix/app-store-metrics.
---------------------------------------------------------------------------
To account for Android ``Games'' apps, Commission staff reviewed listings of the Top 216 Paid and Top 216 Free ``Games'' apps in the Google Play store as of mid-November 2012. Staff believes that approximately 3% of them may be directed to children under 13. Three percent of 75,000 apps \364\ yields about 2,250 Android ``Games'' apps that may be directed to children under 13. Assuming 5% of those apps operate in ways that bring their developers within the ambit of the final Rule amendments, at a general app-to-developer ratio of 3.8 apps per developer, this yields approximately 30 developers (2,250 x .05 = 112.5; 112.5) 3.8 = 29.6). Assuming that, as Commission staff observed in the iTunes App Store, approximately 35% of developers of games that may be directed to children under the age of 13 also develop similar education apps, 65% of the aforementioned 30 developers would not already have been counted in the previous tally of educational app developers. This calculation yields an estimate of approximately 19 additional developers of Android games apps primarily directed to children under 13 that likely are covered by the final Rule amendments.
---------------------------------------------------------------------------
\364\ ``Android Statistic Top Categories,'' AppBrain (accessed Nov. 15, 2012), available at http://www.appbrain.com/stats/android-market-app-categories (total calculated by adding the number of apps in each ``Games'' subcategory).
---------------------------------------------------------------------------
Similarly, for Android ``Entertainment'' apps, Commission staff reviewed listings of the Top 216 Paid and Top 216 Free ``Entertainment'' apps in the Google Play store as of mid-November 2012. Staff believes that approximately 2% of them may be directed to children under 13. Two percent of 67,000 apps \365\ yields about 1,340 Android ``Entertainment'' apps that may be directed to children under 13. Assuming 5% of those apps operate in ways that bring their developers within the ambit of the final Rule amendments, at a general app-to-developer ratio of 3.8 apps per developer, this yields approximately 18 developers (1,340 x .05 = 67; 67) 3.8 = 17.63). Assuming that, as Commission staff observed with regard to the iTunes App Store, approximately 84% of developers of entertainment apps that may be directed to children under the age of 13 also develop similar education and game apps, 16% of the aforementioned 18 developers would not already have been counted in the prior tally of educational and game app developers. This calculation yields an estimate of approximately 3 additional developers of Android entertainment apps primarily directed to children
Page 4005
under 13 that likely are covered by the final Rule amendments.
---------------------------------------------------------------------------
\365\ Id.
---------------------------------------------------------------------------
Thus, the FTC estimates that approximately 1,660 mobile app developers (1,552 for iTunes and Android education apps + 78 for iTunes games apps + 4 for iTunes entertainment apps + 19 for Android games apps + 3 for Android entertainment apps = 1,656) are existing operators of Web sites or online services that will be covered by the final Rule amendments. The FTC's 2011 NPRM PRA estimate of 2,000 existing operators already covered by the Rule and its 2012 SNPRM PRA estimate of 500 newly covered existing operators,\366\ however, already partially accounted for these mobile app developers because these estimates covered all types of operators subject to COPPA, including mobile app developers. As discussed above, comments on the FTC staff's estimate of the number of existing operators focused almost entirely on an asserted understatement of the number of mobile app developers that would be covered by the final Rule amendments. The estimate otherwise was not contested. Thus, the total numbers of mobile app developers set forth herein must be substituted for the total (unspecified) number of mobile app developers subsumed within the 2011 NPRM and 2012 SNPRM PRA estimates.
---------------------------------------------------------------------------
\366\ See 2011 NPRM, 76 FR at 59812, 59813; 2012 SNPRM, 77 FR at 46649.
---------------------------------------------------------------------------
The Commission believes it is reasonable to substitute the above-
noted estimate of 1,660 mobile app developers for half, i.e., 1,250, of the 2,500 existing operators previously estimated to be ``covered'' and ``newly covered'' by the 2011 NPRM and 2012 SNPRM PRA estimates. Based on its experience, the Commission believes that half--if not more--of the existing operators currently covered by the Rule already develop or publish mobile apps. The remaining 1,250 operators would account for traditional Web site and other online service providers that are not mobile app developers, as well as plug-in developers and advertising networks that could be covered by the ``actual knowledge'' standard.\367\ Thus, combining these totals (1,660 + 1,250) yields a total of 2,910 operators of existing Web sites or online services that would likely be covered by the final Rule amendments.
---------------------------------------------------------------------------
\367\ Disclosure burdens do not increase when taking into account plug-in developers and advertising networks with actual knowledge because the burden will fall on either the primary-content site or the plug-in, but need not fall on both. They can choose to allocate the burden between them. The Commission has chosen to account for the burden via the primary-content site or service because it would generally be the party in the best position to give notice and obtain consent from parents.
---------------------------------------------------------------------------
New Operators
The Commission received one comment asserting that the Commission significantly underestimated the number of new operators per year that will be covered by the proposed Rule amendments. One commenter, the moderator of an online group called ``Parents With Apps,'' stated that this group of more than 1,400 small developers of family-friendly apps grows by at least 100 new developers every six months.\368\ This would constitute an annual growth rate of nearly 15% (200 new developers per year divided by 1,400 developers in the group = 0.1429). Although the Commission believes this rate of increase is due, at least in part, to increased awareness among developers of the group's existence rather than growth in the number of new developers, the Commission concludes it is reasonable to incorporate this information into its revised estimate. Assuming a base number of 1,660 existing mobile app developers estimated to be covered by the final Rule amendments, a 15% growth rate would yield, year-over-year after three years, an additional 864 new developers, or approximately 290 per year averaged over a prospective three-year clearance (1,660 x 1.15 = 1,909; 1,909 x 1.15 = 2,195; 2,195 x 1.15 = 2,524; 2,524 - 1,660 = 864; 864 / 3 = 288).\369\
---------------------------------------------------------------------------
\368\ S. Weiner (comment 97, 2012 SNPRM), at 1-2.
\369\ See also Association for Competitive Technology (comment 5, 2011 SNPRM), at 2 (``total unique apps across all platforms continue to grow beyond the one million mark'' since Apple's 2008 launch of its App Store; ``the mobile app marketplace has grown to a five billion dollar industry from scratch in less than four years.'').
---------------------------------------------------------------------------
Bureau of Labor Statistics (``BLS'') projections suggest a much more modest rate of growth. BLS has projected that employment of software application developers will increase 28% between 2010 and 2020.\370\ Assuming 10% of that total 28% growth would occur each year of the ten-year period, and a base number of 1,660 existing mobile app developers, one can derive an increase of approximately 46 (1,645 x 0.028 = 46.48) new mobile app developers per year on average that will be covered by the final Rule amendments. Combining the average based on the annual growth rate of Parents With Apps and that based on the BLS software application developer growth projection yields an increase of approximately 168 (290 + 46 = 336; 336 / 2 = 168) new mobile app developers per year on average that will be covered by the proposed Rule amendments.
---------------------------------------------------------------------------
\370\ Bureau of Labor Statistics, U.S. Department of Labor, Occupational Outlook Handbook, 2012-13 Edition, Software Developers, http://www.bls.gov/ooh/computer-and-information-technology/software-developers.htm (visited November 16, 2012).
---------------------------------------------------------------------------
As with its previous estimates of existing developers, mobile app developers were already included in the Commission's 2011 NPRM PRA estimate of 100 new operators and the Commission's 2012 SNPRM PRA estimate of 125 additional new operators per year. As noted above, the Commission's 2011 NPRM and 2012 SNPRM PRA estimates of new operators were contested only as they relate to their estimation of new mobile app developers. Thus, the total number of new mobile app developers set forth herein should replace the total (unspecified) number of new mobile app developers subsumed within the 2011 NPRM and 2012 SNPRM PRA estimates.
The Commission believes it is reasonable to substitute the above-
noted estimate of 168 mobile app developers for half, i.e., 113, of the 225 new operators previously estimated to be covered by the 2011 NPRM and 2012 SNPRM PRA estimates. The remainder of the prior estimates would account for new Web site and other online service providers other than new mobile app developers, as well as new plug-in developers and advertising networks that could be covered by the ``actual knowledge'' standard. Thus, combining these totals (168 + 113 = 281) yields a total of approximately 280 new operators per year (over a prospective three-
year clearance) of Web sites or online services that would likely be covered by the final Rule amendments. Given that the FTC's existing clearance already accounts for an estimate of 100 new operators,\371\ the incremental calculation for additional OMB clearance is 180 new operators x 60 hours each = 10,800 hours.
---------------------------------------------------------------------------
\371\ See note 342, supra.
---------------------------------------------------------------------------
-
Recordkeeping
Under the PRA, the term ``recordkeeping requirement'' means a requirement imposed by or for an agency on persons to maintain specified records, including a requirement to (A) Retain such records; (B) notify third parties, the Federal Government, or the public of the existence of such records; (C) disclose such records to third parties, the Federal Government, or the public; or (D) report to third parties, the Federal Government, or the public
Page 4006
regarding such records.'' The final amendments do not affect the Rule's existing recordkeeping requirements. Moreover, FTC staff believes that most of the records listed in the Rule's pre-existing safe harbor recordkeeping provisions consist of documentation that such parties have kept in the ordinary course of business irrespective of the Rule.\372\ Any incremental burden, such as that for maintaining the results of independent assessments under section 312.11(d), would be, in staff's view, marginal.
---------------------------------------------------------------------------
\372\ Under 5 CFR 1320.3(b)(2), OMB excludes from the definition of PRA ``burden'' the time and financial resources needed to comply with agency-imposed recordkeeping, disclosure, or reporting requirements that customarily would be undertaken independently in the normal course of business. Thus, on further reflection, the FTC has determined not to include recordkeeping costs for safe harbors as it did in the 2011 NPRM PRA analysis.
---------------------------------------------------------------------------
-
Disclosure Hours
(1) New Operators' Disclosure Burden
Under the existing OMB clearance for the Rule, the FTC has estimated that new operators will each spend approximately 60 hours to craft a privacy policy, design mechanisms to provide the required online privacy notice and, where applicable, direct notice to parents in order to obtain verifiable consent. Several commenters noted that this 60-hour estimate failed to take into account accurate costs of compliance with the Rule, but they did not provide the Commission with empirical data or specific evidence on the number of hours such activities require.\373\ The Toy Industry Association (``TIA'') \374\ asserts that the Commission underestimated the number of hours shown in the 2011 NPRM and 2012 SNPRM PRA calculations,\375\ and that ``depending on the FTC's final revisions to the COPPA Rule, the time it takes to implement technological changes could more than triple the Commission's 60-hour estimate.'' \376\ These assertions appear to be based primarily on TIA's concern that the FTC's estimate did not include costs ``of `ensuring' security procedures of third parties, securing deletion, managing parental consents, or updating policies to disclose changes in `operators.' In addition, the FTC seems to reference only top level domains and, as such, its estimates for implementation of new verifiable parental consent requirements are very low.'' \377\ TIA states that ``the additional processes and procedures mandated under the revised proposed Rule will potentially include privacy policy and operational changes, with related resource-intensive measures, such as organizational management and employee training.'' \378\ Moreover, TIA suggests that changes proposed in the 2011 NPRM to the treatment of screen or user names would entail ``enormous'' costs that the FTC did not quantify.\379\
---------------------------------------------------------------------------
\373\ See N. Savitt (comment 142, 2011 NPRM), at 1; NCTA (comment 113, 2011 NPRM), at 23-24.
\374\ TIA contends that in the 2012 SNPRM, the Commission ``disregarded the empirical economic input'' regarding compliance costs that TIA had submitted in response to the 2011 NPRM, including hour and labor cost estimates. Toy Industry Association (comment 89, 2012 SNPRM), at 16. Although the Commission did not discuss TIA's 2011 comments in the SNPRM--which focused on the potential incremental compliance cost changes that the Commission anticipated would flow from certain newly proposed Rule amendments--it has considered TIA's 2011 and 2012 comments on compliance costs as discussed herein.
\375\ Toy Industry Association (comment 89, 2012 SNPRM), at 16-
17; Toy Industry Association (comment 163, 2011 NPRM), at 17-18; see also DMA (comment 28, 2012 SNPRM), at 17.
\376\ Toy Industry Association (comment 163, 2011 NPRM), at 18.
\377\ Id. at 17. Also with specific regard to potential costs associated with obtaining and verifying parental consent, TIA estimates that dedicating employees specifically to this task would, if the FTC were to require a ``scanned form type of control regime,'' require additional salary and benefit costs. Id. at 18.
\378\ Id. at 17.
\379\ Id. at 18.
---------------------------------------------------------------------------
Substantially all of TIA's concerns about understated burden estimates relate to proposed requirements that the Commission has ultimately determined not to adopt. For example, the final Rule amendments do not require operators to ``ensure'' that third-parties secure information, but that they ``take reasonable steps'' to release children's information only to third parties capable of maintaining it securely and provide assurances that they will do so.\380\ The Commission is not eliminating the ``single operator designee'' proviso of the Rule's online notice requirement.\381\ It is not eliminating email plus as an acceptable consent method for operators collecting personal information only for internal use.\382\ The Commission determined to treat screen names as personal information only in those instances in which a screen or user name rises to the level of online contact information.\383\ Thus, in the Commission's view, TIA's proposed increase to the above-noted estimate of 60 hours for compliance is not warranted.\384\
---------------------------------------------------------------------------
\380\ See Part II.D., supra. As for the ``reasonable steps'' requirement, the time and financial resources operators devote to this task would likely be incurred, anyway, in the normal course of their seeking to preserve the security of children's data conveyed to those third parties. To reiterate, PRA ``burden'' does not include effort expended in the ordinary course of business independent of a regulatory requirement. 5 CFR 1320.3(b)(2). See also Toy Industry Association (comment 163, 2011 NPRM), at 16 (``Operators regularly investigate agents, service providers, and business partners to assure that they will responsibly maintain the security and confidentiality of children's data . * * *'').
\381\ See Part II.B.2, supra.
\382\ See Part II.C.7, supra. Furthermore, the requirement to obtain parental consent is not a collection of information under the PRA.
\383\ See Part II.A.5.a, supra. This change also appears to moot NCTA's concern that operators would be faced with substantial costs if ``forced to redesign'' Web sites to eliminate the use of unique screen or user names. NCTA (comment 113, 2011 NPRM), at 23 n.69.
\384\ TIA also cites the potential cost of needing to ``develop communication tools and respond to complaints from parents who may mistakenly believe that companies are altering data collection practices. * * *'' Toy Industry Association (comment 163, 2011 NPRM), at 18. This speculative cost does not relate to any ``information collection requirement'' in the final Rule amendments.
---------------------------------------------------------------------------
Applying, then, the 60 hours estimate to the portion of new operators not accounted for in the FTC's previously cleared burden totals yields a cumulative total of 10,800 hours (180 new operators x 60 hours each).
(2) Existing Operators' Disclosure Burden
The final Rule amendments will not impose ongoing incremental disclosure time per entity, but, as noted above, would result in an estimated 2,910 existing operators covered by the Rule. These entities will have a one-time burden to re-design their existing privacy policies and direct notice procedures that would not carry over to the second and third years of a prospective three-year OMB clearance under the PRA. Commission staff believes that an existing operator's time to make these changes would be no more than that for a new entrant crafting its online and direct notices for the first time, i.e., 60 hours. Annualized over three years of a prospective clearance,\385\ this amounts to 20 hours ((60 hours + 0 + 0) / 3) per year. Aggregated for the estimated 2,910 existing operators that would be subject to the Rule, annualized disclosure burden would be 58,200 hours per year.
---------------------------------------------------------------------------
\385\ TIA states that this first-year cost associated with compliance should not be ``amortized'' over three years. Toy Industry Association (comment 89, 2012 SNPRM), at 17. As stated supra note 336, however, agencies may seek up to three years of clearance from OMB, and this is what the FTC routinely does for rulemakings. Moreover, OMB seeks estimates of annual burden (reflective of the clearance period sought). See 5 CFR 1320.5(a)(1)(iv)(B).
---------------------------------------------------------------------------
-
Reporting Hours
The final Rule amendments do not impose reporting requirements on operators; they do, however, for safe harbor programs. Under the FTC's already cleared estimates, pre-amendments, staff projected that each new safe harbor program applicant
Page 4007
would require 265 hours to prepare and submit its safe harbor proposal.\386\ The final Rule amendments, however, require a safe harbor applicant to submit a more detailed proposal than what the Rule, prior to such amendments, mandated. Existing safe harbor programs will thus need to submit a revised application and new safe harbor applicants will have to provide greater detail than they would have under the original Rule. The FTC estimates this added information will entail approximately 60 additional hours for each new, and each existing, safe harbor to prepare. Accordingly, for this added one-time preparation, the aggregate incremental burden is 60 hours for the projected one new safe harbor program per three-year clearance cycle and 300 hours, cumulatively, for the five existing safe harbor programs. Annualized for an average single year per three-year clearance, this amounts to 20 hours for one new safe harbor program, and 100 hours for the existing five safe harbor programs; thus, cumulatively, the burden is 120 hours.
---------------------------------------------------------------------------
\386\ 76 FR at 7211, 7212 (Feb. 9, 2011); 76 FR at 31334, 31335 (May 31, 2011). These safe harbor reporting hour estimates have not been contested. For PRA purposes, annualized over the course of three years of clearance, this averages roughly 100 hours per year, given that the 265 hours is a one-time, not recurring, expenditure of time for an applicant.
---------------------------------------------------------------------------
The final Rule amendments require safe harbor programs to audit their members at least annually and to submit periodic reports to the Commission on the aggregate results of these member audits. As such, this will increase currently cleared burden estimates pertaining to safe harbor applicants. The burden for conducting member audits and preparing these reports likely will vary for each safe harbor program depending on the number of members. Commission staff estimates that conducting audits and preparing reports will require approximately 100 hours per program per year. Aggregated for one new (100 hours) and five existing (500 hours) safe harbor programs, this amounts to an increased disclosure burden of 600 hours per year. Accordingly, the annualized reporting burden for one new and five existing safe harbor applicants to provide the added information required (120 hours) and to conduct audits and prepare reports (600 hours) is 720 hours, cumulatively.
-
Labor Costs
(1) Disclosure
The Commission assumes that the time spent on compliance for new operators and existing operators covered by the final Rule amendments would be apportioned five to one between legal (lawyers or similar professionals) and technical (e.g., computer programmers, software developers, and information security analysts) personnel.\387\ In the 2012 SNPRM, based on BLS compiled data, FTC staff assumed for compliance cost estimates a mean hourly rate of $180 for legal assistance and $42 for technical labor support.\388\ These estimates were challenged in the comments.
---------------------------------------------------------------------------
\387\ See 76 FR at 7211, 7212-7213 (Feb. 9, 2011); 76 FR at 31334, 31335 n.1 (May 31, 2011) (FTC notices for renewing OMB clearance for the COPPA Rule).
\388\ As explained in the 2012 SNPRM, ``the estimated rate of $180 is roughly midway between BLS mean hourly wages for lawyers ($62.74) in the most recent annual compilation available online as of August 2012 and what Commission staff believes more generally reflects hourly attorney costs ($300) associated with Commission information collection activities.'' 77 FR at 46651, n.54. This estimated rate was an upward revision of the Commission's estimate of $150 per hour used in the 2011 NPRM. See 76 FR at 59827 n.204 and accompanying text. The estimated mean hourly wages for technical labor support ($42) is based on an average of the salaries for computer programmers, software developers, information security analysts, and web developers as reported by the BLS. See National Occupational and Wages--May 2011, available at http://www.bls.gov/news.release/archives/ocwage_03272012.pdf.
---------------------------------------------------------------------------
TIA asserts that the Commission underestimates the labor rate for lawyers used in the Commission's 2011 NPRM and 2012 SNPRM compliance cost calculations.\389\ Given the comments received, the Commission believes it appropriate to increase the estimated mean hourly rate of $180 for legal assistance used in certain of the Commission's 2011 NPRM and 2012 SNPRM compliance cost calculations. TIA stated in its 2011 comment that the ``average rates'' of ``specialized attorneys who understand children's privacy and data security laws'' with whom its members typically consult are ``2-3 times the Commission's estimates'' of $150 per hour set forth in the 2011 NPRM.\390\ TIA reiterated this information in its 2012 comment\391\ and added: ``According to The National Law Journal's 2011 annual billing survey, the average hourly firm-wide billing rate (which combines partner and associate rates) ranges from $236 to $633, not taking into account any area of specialization.'' \392\ While the Commission believes TIA's information provides useful reference points, it does not provide an adequate basis for estimating an hourly rate for lawyers for compliance cost calculation purposes.
---------------------------------------------------------------------------
\389\ Toy Industry Association (comment 89, 2012 SNPRM), at 16; Toy Industry Association (comment 163, 2011 NPRM), at 17.
\390\ Toy Industry Association (comment 163, 2011 NPRM), at 17. See also NCTA (comment 113, 2011 NPRM), at 23 n.70 (``NCTA members typically consult with attorneys who specialize in data privacy and security laws and whose average rates are 2-3 times the Commission's 2011 NPRM estimates of $150 per hour.'').
\391\ Toy Industry Association (comment 89, 2012 SNPRM), at 18.
\392\ Id., at 10 (citation omitted).
---------------------------------------------------------------------------
As an initial matter, the Commission notes that TIA has cited a range of average hourly rates that its members pay for counsel, not a single average hourly rate, and it did not submit the underlying data upon which those average rate calculations were based. The range of average hourly rates TIA stated that its members typically pay (i.e., $300-$450 per hour) may include some unusually high or low billing rates that have too much influence on the arithmetic means for those averages to be representative of the rates operators are likely to have to pay.\393\ Without more information about the distribution of the underlying rates factored into each average, or the distribution of the averages within the cited range, TIA's information is of limited value. Likewise, as TIA's comments appear to implicitly recognize, routine COPPA compliance counseling would likely be performed by a mix of attorneys billed at a range of hourly rates. Unfortunately, the information submitted in TIA's comments does not indicate how that workload is typically apportioned as between ``high-level partners'' whose ``support'' is required for ``complex'' COPPA compliance matters and other, less senior, attorneys at a law firm. The National Law Journal survey the TIA cites is also a useful reference point, but it is a non-scientific survey of the nation's 250 largest law firms \394\ that are located predominantly in major metropolitan areas.\395\ Beyond the range of average hourly firm-wide billing rates that TIA cites, the survey states that the
Page 4008
average firm-wide billing rate (partners and associates) in 2011 was $403, the average partner rate was $482, and the average associate rate was $303.
---------------------------------------------------------------------------
\393\ See Federal Judicial Center, Reference Manual on Scientific Evidence (3rd Ed.), David H. Kay and David A. Freedman, Reference Guide on Statistics at 238 (``the mean takes account of all the data B it involves the total of all the numbers; however, particularly with small datasets, a few unusually large or small observations may have too much influence on the mean.'').
\394\ Toy Industry Association (comment 89, 2012 SNPRM), at 19. Fifty-one law firms supplied the average rate information used in the survey's tabulation, ``A nationwide sampling of law firm billing rates,'' to which the TIA appears to refer.
\395\ The Commission recognizes that many attorneys who specialize in COPPA compliance and data security law often work at large law firms located in major metropolitan areas. However, just as the nature of online technology and the mobile marketplace allow operators to live almost anywhere, see Association for Competitive Technology (comment 5, 2011 NPRM), at 2 (the ``nature of this industry allows developers to live almost anywhere''), it also allows them to seek the counsel of competent lawyers practicing anywhere in the United States.
---------------------------------------------------------------------------
The Commission believes it reasonable to assume that the workload among law firm partners and associates for COPPA compliance questions could be competently addressed and efficiently distributed among attorneys at varying levels of seniority, but would be weighted most heavily to more junior attorneys. Thus, assuming an apportionment of two-thirds of such work is done by associates, and one-third by partners, a weighted average tied to the average firm-wide associate and average firm-wide partner rates, respectively, in the National Law Journal 2011 survey would be about $365 per hour. The Commission believes that this rate B which is very near the mean of TIA's stated range of purported hourly rates that its members typically pay to engage counsel for COPPA compliance questions B is an appropriate measure to calculate the cost of legal assistance for operators to comply with the final Rule amendments.\396\
---------------------------------------------------------------------------
\396\ Cf. Civil Division of the United States Attorney's Office for the District of Columbia, United States Attorney's Office, District of Columbia, Laffey Matrix B 2003-2013, available at http://www.justice.gov/usao/dc/divisions/Laffey_Matrix_2003-2013.pdf (updated ``Laffey Matrix'' for calculating ``reasonable'' attorneys fees in suits in which fee shifting is authorized can be evidence of prevailing market rates for litigation counsel in the Washington, DC area; rates in table range from $245 per hour for most junior associates to $505 per hour for most senior partners).
---------------------------------------------------------------------------
TIA also states that the 2012 SNPRM estimate of $42 per hour for technical support is too low, and that engaging expert technical personnel can, on average, involve hourly costs that range from $72 to $108.\397\ Similar to TIA's hours estimate, discussed above, the Commission believes that TIA's estimate may have been based on implementing requirements that, ultimately, the Commission has determined not to adopt. For example, technical personnel will not need to ``ensure'' the security procedures of third parties; operators that have been eligible to use email plus for parental consents will not be required to implement new systems to replace it. It is unclear whether TIA's estimate for technical support is based on the types of disclosure-related tasks that the final Rule amendments would actually require, other tasks that the final Rule amendments would not require, or non-disclosure tasks not covered by the PRA. Moreover, unlike its estimate for lawyer assistance, TIA's estimates for technical labor are not accompanied by an adequate explanation of why estimates for technical support drawn from BLS statistics are not an appropriate basis for the FTC's PRA analysis. Accordingly, the Commission believes it is reasonable to retain the 2012 SNPRM estimate of $42 per hour for technical assistance based on BLS data.
---------------------------------------------------------------------------
\397\ Toy Industry Association (comment 89, 2012 SNPRM), at 18.
---------------------------------------------------------------------------
Thus, for the 180 new operators per year not previously accounted for under the FTC's currently cleared estimates, 10,800 cumulative disclosure hours would be composed of 9,000 hours of legal assistance and 1,800 hours of technical support. Applied to hourly rates of $365 and $42, respectively, associated labor costs for the 180 new operators potentially subject to the proposed amendments would be $3,360,600 (i.e., $3,285,000 for legal support plus $75,600 for technical support).
Similarly, for the estimated 2,910 existing operators covered by the final Rule amendments, 58,200 cumulative disclosure hours would consist of 48,500 hours of legal assistance and 9,700 hours for technical support. Applied at hourly rates of $365 and $42, respectively, associated labor costs would total $18,109,900 (i.e., $17,702,500 for legal support plus $407,400 for technical support). Cumulatively, estimated labor costs for new and existing operators subject to the final Rule amendments is $21,470,500.
(2) Reporting
The Commission staff assumes that the tasks to prepare augmented safe harbor program applications occasioned by the final Rule amendments will be performed primarily by lawyers, at a mean labor rate of $180 an hour.\398\ Thus, applied to an assumed industry total of 120 hours per year for this task, incremental associated yearly labor costs would total $21,600.
---------------------------------------------------------------------------
\398\ Based on Commission staff's experience with previously approved safe harbor programs, staff anticipates that most of the legal tasks associated with safe harbor programs will be performed by in-house counsel. Cf. Toy Industry Association (comment 89, 2012 SNPRM), at 19 (regional BLS statistics for lawyer wages can support estimates of the level of in-house legal support likely to be required on an ongoing basis). Moreover, no comments were received in response to the February 9, 2011 and May 31, 2011 Federal Register notices (76 FR at 7211 and 76 FR at 31334, respectively, available at http://www.gpo.gov/fdsys/pkg/FR-2011-02-09/pdf/2011-2904.pdf and http://www.gpo.gov/fdsys/pkg/FR-2011-05-31/pdf/2011-13357.pdf), which assumed a labor rate of $150 per hour for lawyers or similar professionals to prepare and submit a new safe harbor application. Nor was that challenged in the comments responding to the 2011 NPRM.
---------------------------------------------------------------------------
The Commission staff assumes periodic reports will be prepared by compliance officers, at a labor rate of $28 per hour.\399\ Applied to an assumed industry total of 600 hours per year for this task, associated yearly labor costs would be $16,800.
---------------------------------------------------------------------------
\399\ See Bureau of Labor Statistics National Compensation Survey: Occupational Earnings in the United States, 2010, at Table 3, available at http://www.bls.gov/ncs/ocs/sp/nctb1477.pdf. This rate has not been contested.
---------------------------------------------------------------------------
Cumulatively, labor costs for the above-noted reporting requirements total approximately $38,400 per year.
-
Non-Labor/Capital Costs
Because both operators and safe harbor programs will already be equipped with the computer equipment and software necessary to comply with the Rule's new notice requirements, the final Rule amendments should not impose any additional capital or other non-labor costs.\400\
---------------------------------------------------------------------------
\400\ NCTA commented that the Commission failed to consider costs ``related to redeveloping child-directed Web sites'' that operators would be ``forced'' to incur as a result of the proposed Rule amendments, including for ``new equipment and software required by the expanded regulatory regime.'' NCTA (comment 113, 2011 NPRM), at 23. Similarly, TIA commented that the proposed Rule amendments would entail ``increased monetary costs with respect to technology acquisition and implementation * * *.'' Toy Industry Association (comment 163, 2011 NPRM), at 17. These comments, however, do not specify projected costs or which Rule amendments would entail the asserted costs.
---------------------------------------------------------------------------
List of Subjects in 16 CFR Part 312
Children, Communications, Consumer protection, Electronic mail, Email, Internet, Online service, Privacy, Record retention, Safety, science and technology, Trade practices, Web site, Youth.
0
Accordingly, for the reasons stated above, the Federal Trade Commission revises part 312 of Title 16 of the Code of Federal Regulations to read as follows:
PART 312--CHILDREN'S ONLINE PRIVACY PROTECTION RULE
Sec.
312.1 Scope of regulations in this part.
312.2 Definitions.
312.3 Regulation of unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children on the Internet.
312.4 Notice.
312.5 Parental consent.
312.6 Right of parent to review personal information provided by a child.
312.7 Prohibition against conditioning a child's participation on collection of personal information.
Page 4009
312.8 Confidentiality, security, and integrity of personal information collected from children.
312.9 Enforcement.
312.10 Data retention and deletion requirements.
312.11 Safe harbor programs.
312.12 Voluntary Commission Approval Processes.
312.13 Severability.
Authority: 15 U.S.C. 6501-6508.
Sec. 312.1 Scope of regulations in this part.
This part implements the Children's Online Privacy Protection Act of 1998, (15 U.S.C. 6501, et seq.,) which prohibits unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children on the Internet.
Sec. 312.2 Definitions.
Child means an individual under the age of 13.
Collects or collection means the gathering of any personal information from a child by any means, including but not limited to:
(1) Requesting, prompting, or encouraging a child to submit personal information online;
(2) Enabling a child to make personal information publicly available in identifiable form. An operator shall not be considered to have collected personal information under this paragraph if it takes reasonable measures to delete all or virtually all personal information from a child's postings before they are made public and also to delete such information from its records; or
(3) Passive tracking of a child online.
Commission means the Federal Trade Commission.
Delete means to remove personal information such that it is not maintained in retrievable form and cannot be retrieved in the normal course of business.
Disclose or disclosure means, with respect to personal information:
(1) The release of personal information collected by an operator from a child in identifiable form for any purpose, except where an operator provides such information to a person who provides support for the internal operations of the Web site or online service; and
(2) Making personal information collected by an operator from a child publicly available in identifiable form by any means, including but not limited to a public posting through the Internet, or through a personal home page or screen posted on a Web site or online service; a pen pal service; an electronic mail service; a message board; or a chat room.
Federal agency means an agency, as that term is defined in Section 551(1) of title 5, United States Code.
Internet means collectively the myriad of computer and telecommunications facilities, including equipment and operating software, which comprise the interconnected world-wide network of networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol, to communicate information of all kinds by wire, radio, or other methods of transmission.
Obtaining verifiable consent means making any reasonable effort (taking into consideration available technology) to ensure that before personal information is collected from a child, a parent of the child:
(1) Receives notice of the operator's personal information collection, use, and disclosure practices; and
(2) Authorizes any collection, use, and/or disclosure of the personal information.
Online contact information means an email address or any other substantially similar identifier that permits direct contact with a person online, including but not limited to, an instant messaging user identifier, a voice over internet protocol (VOIP) identifier, or a video chat user identifier.
Operator means any person who operates a Web site located on the Internet or an online service and who collects or maintains personal information from or about the users of or visitors to such Web site or online service, or on whose behalf such information is collected or maintained, or offers products or services for sale through that Web site or online service, where such Web site or online service is operated for commercial purposes involving commerce among the several States or with 1 or more foreign nations; in any territory of the United States or in the District of Columbia, or between any such territory and another such territory or any State or foreign nation; or between the District of Columbia and any State, territory, or foreign nation. This definition does not include any nonprofit entity that would otherwise be exempt from coverage under Section 5 of the Federal Trade Commission Act (15 U.S.C. 45). Personal information is collected or maintained on behalf of an operator when:
(1) It is collected or maintained by an agent or service provider of the operator; or
(2) The operator benefits by allowing another person to collect personal information directly from users of such Web site or online service.
Parent includes a legal guardian.
Person means any individual, partnership, corporation, trust, estate, cooperative, association, or other entity.
Personal information means individually identifiable information about an individual collected online, including:
(1) A first and last name;
(2) A home or other physical address including street name and name of a city or town;
(3) Online contact information as defined in this section;
(4) A screen or user name where it functions in the same manner as online contact information, as defined in this section;
(5) A telephone number;
(6) A Social Security number;
(7) A persistent identifier that can be used to recognize a user over time and across different Web sites or online services. Such persistent identifier includes, but is not limited to, a customer number held in a cookie, an Internet Protocol (IP) address, a processor or device serial number, or unique device identifier;
(8) A photograph, video, or audio file where such file contains a child's image or voice;
(9) Geolocation information sufficient to identify street name and name of a city or town; or
(10) Information concerning the child or the parents of that child that the operator collects online from the child and combines with an identifier described in this definition.
Release of personal information means the sharing, selling, renting, or transfer of personal information to any third party.
Support for the internal operations of the Web site or online service means:
(1) Those activities necessary to:
(i) Maintain or analyze the functioning of the Web site or online service;
(ii) Perform network communications;
(iii) Authenticate users of, or personalize the content on, the Web site or online service;
(iv) Serve contextual advertising on the Web site or online service or cap the frequency of advertising;
(v) Protect the security or integrity of the user, Web site, or online service;
(vi) Ensure legal or regulatory compliance; or
(vii) Fulfill a request of a child as permitted by Sec. 312.5(c)(3) and (4);
(2) So long as The information collected for the activities listed in paragraphs (1)(i)-(vii) of this definition is not used or disclosed to contact a specific individual, including through behavioral advertising, to amass a
Page 4010
profile on a specific individual, or for any other purpose.
Third party means any person who is not:
(1) An operator with respect to the collection or maintenance of personal information on the Web site or online service; or
(2) A person who provides support for the internal operations of the Web site or online service and who does not use or disclose information protected under this part for any other purpose.
Web site or online service directed to children means a commercial Web site or online service, or portion thereof, that is targeted to children.
(1) In determining whether a Web site or online service, or a portion thereof, is directed to children, the Commission will consider its subject matter, visual content, use of animated characters or child-oriented activities and incentives, music or other audio content, age of models, presence of child celebrities or celebrities who appeal to children, language or other characteristics of the Web site or online service, as well as whether advertising promoting or appearing on the Web site or online service is directed to children. The Commission will also consider competent and reliable empirical evidence regarding audience composition, and evidence regarding the intended audience.
(2) A Web site or online service shall be deemed directed to children when it has actual knowledge that it is collecting personal information directly from users of another Web site or online service directed to children.
(3) A Web site or online service that is directed to children under the criteria set forth in paragraph (1) of this definition, but that does not target children as its primary audience, shall not be deemed directed to children if it:
(i) Does not collect personal information from any visitor prior to collecting age information; and
(ii) Prevents the collection, use, or disclosure of personal information from visitors who identify themselves as under age 13 without first complying with the notice and parental consent provisions of this part.
(4) A Web site or online service shall not be deemed directed to children solely because it refers or links to a commercial Web site or online service directed to children by using information location tools, including a directory, index, reference, pointer, or hypertext link.
Sec. 312.3 Regulation of unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children on the Internet.
General requirements. It shall be unlawful for any operator of a Web site or online service directed to children, or any operator that has actual knowledge that it is collecting or maintaining personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under this part. Generally, under this part, an operator must:
(a) Provide notice on the Web site or online service of what information it collects from children, how it uses such information, and its disclosure practices for such information (Sec. 312.4(b));
(b) Obtain verifiable parental consent prior to any collection, use, and/or disclosure of personal information from children (Sec. 312.5);
(c) Provide a reasonable means for a parent to review the personal information collected from a child and to refuse to permit its further use or maintenance (Sec. 312.6);
(d) Not condition a child's participation in a game, the offering of a prize, or another activity on the child disclosing more personal information than is reasonably necessary to participate in such activity (Sec. 312.7); and
(e) Establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children (Sec. 312.8).
Sec. 312.4 Notice.
(a) General principles of notice. It shall be the obligation of the operator to provide notice and obtain verifiable parental consent prior to collecting, using, or disclosing personal information from children. Such notice must be clearly and understandably written, complete, and must contain no unrelated, confusing, or contradictory materials.
(b) Direct notice to the parent. An operator must make reasonable efforts, taking into account available technology, to ensure that a parent of a child receives direct notice of the operator's practices with regard to the collection, use, or disclosure of personal information from children, including notice of any material change in the collection, use, or disclosure practices to which the parent has previously consented.
(c) Content of the direct notice to the parent--(1) Content of the direct notice to the parent under Sec. 312.5(c)(1) (Notice to Obtain Parent's Affirmative Consent to the Collection, Use, or Disclosure of a Child's Personal Information). This direct notice shall set forth:
(i) That the operator has collected the parent's online contact information from the child, and, if such is the case, the name of the child or the parent, in order to obtain the parent's consent;
(ii) That the parent's consent is required for the collection, use, or disclosure of such information, and that the operator will not collect, use, or disclose any personal information from the child if the parent does not provide such consent;
(iii) The additional items of personal information the operator intends to collect from the child, or the potential opportunities for the disclosure of personal information, should the parent provide consent;
(iv) A hyperlink to the operator's online notice of its information practices required under paragraph (d) of this section;
(v) The means by which the parent can provide verifiable consent to the collection, use, and disclosure of the information; and
(vi) That if the parent does not provide consent within a reasonable time from the date the direct notice was sent, the operator will delete the parent's online contact information from its records.
(2) Content of the direct notice to the parent under Sec. 312.5(c)(2) (Voluntary Notice to Parent of a Child's Online Activities Not Involving the Collection, Use or Disclosure of Personal Information). Where an operator chooses to notify a parent of a child's participation in a Web site or online service, and where such site or service does not collect any personal information other than the parent's online contact information, the direct notice shall set forth:
(i) That the operator has collected the parent's online contact information from the child in order to provide notice to, and subsequently update the parent about, a child's participation in a Web site or online service that does not otherwise collect, use, or disclose children's personal information;
(ii) That the parent's online contact information will not be used or disclosed for any other purpose;
(iii) That the parent may refuse to permit the child's participation in the Web site or online service and may require the deletion of the parent's online contact information, and how the parent can do so; and
(iv) A hyperlink to the operator's online notice of its information
Page 4011
practices required under paragraph (d) of this section.
(3) Content of the direct notice to the parent under Sec. 312.5(c)(4) (Notice to a Parent of Operator's Intent to Communicate with the Child Multiple Times). This direct notice shall set forth:
(i) That the operator has collected the child's online contact information from the child in order to provide multiple online communications to the child;
(ii) That the operator has collected the parent's online contact information from the child in order to notify the parent that the child has registered to receive multiple online communications from the operator;
(iii) That the online contact information collected from the child will not be used for any other purpose, disclosed, or combined with any other information collected from the child;
(iv) That the parent may refuse to permit further contact with the child and require the deletion of the parent's and child's online contact information, and how the parent can do so;
(v) That if the parent fails to respond to this direct notice, the operator may use the online contact information collected from the child for the purpose stated in the direct notice; and
(vi) A hyperlink to the operator's online notice of its information practices required under paragraph (d) of this section.
(4) Content of the direct notice to the parent required under Sec. 312.5(c)(5) (Notice to a Parent In Order to Protect a Child's Safety). This direct notice shall set forth:
(i) That the operator has collected the name and the online contact information of the child and the parent in order to protect the safety of a child;
(ii) That the information will not be used or disclosed for any purpose unrelated to the child's safety;
(iii) That the parent may refuse to permit the use, and require the deletion, of the information collected, and how the parent can do so;
(iv) That if the parent fails to respond to this direct notice, the operator may use the information for the purpose stated in the direct notice; and
(v) A hyperlink to the operator's online notice of its information practices required under paragraph (d) of this section.
(d) Notice on the Web site or online service. In addition to the direct notice to the parent, an operator must post a prominent and clearly labeled link to an online notice of its information practices with regard to children on the home or landing page or screen of its Web site or online service, and, at each area of the Web site or online service where personal information is collected from children. The link must be in close proximity to the requests for information in each such area. An operator of a general audience Web site or online service that has a separate children's area must post a link to a notice of its information practices with regard to children on the home or landing page or screen of the children's area. To be complete, the online notice of the Web site or online service's information practices must state the following:
(1) The name, address, telephone number, and email address of all operators collecting or maintaining personal information from children through the Web site or online service. Provided that: The operators of a Web site or online service may list the name, address, phone number, and email address of one operator who will respond to all inquiries from parents concerning the operators' privacy policies and use of children's information, as long as the names of all the operators collecting or maintaining personal information from children through the Web site or online service are also listed in the notice;
(2) A description of what information the operator collects from children, including whether the Web site or online service enables a child to make personal information publicly available; how the operator uses such information; and, the operator's disclosure practices for such information; and
(3) That the parent can review or have deleted the child's personal information, and refuse to permit further collection or use of the child's information, and state the procedures for doing so.
Sec. 312.5 Parental consent.
(a) General requirements. (1) An operator is required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented.
(2) An operator must give the parent the option to consent to the collection and use of the child's personal information without consenting to disclosure of his or her personal information to third parties.
(b) Methods for verifiable parental consent. (1) An operator must make reasonable efforts to obtain verifiable parental consent, taking into consideration available technology. Any method to obtain verifiable parental consent must be reasonably calculated, in light of available technology, to ensure that the person providing consent is the child's parent. (2) Existing methods to obtain verifiable parental consent that satisfy the requirements of this paragraph include:
(i) Providing a consent form to be signed by the parent and returned to the operator by postal mail, facsimile, or electronic scan;
(ii) Requiring a parent, in connection with a monetary transaction, to use a credit card, debit card, or other online payment system that provides notification of each discrete transaction to the primary account holder;
(iii) Having a parent call a toll-free telephone number staffed by trained personnel;
(iv) Having a parent connect to trained personnel via video-
conference;
(v) Verifying a parent's identity by checking a form of government-
issued identification against databases of such information, where the parent's identification is deleted by the operator from its records promptly after such verification is complete; or
(vi) Provided that, an operator that does not ``disclose'' (as defined by Sec. 312.2) children's personal information, may use an email coupled with additional steps to provide assurances that the person providing the consent is the parent. Such additional steps include: Sending a confirmatory email to the parent following receipt of consent, or obtaining a postal address or telephone number from the parent and confirming the parent's consent by letter or telephone call. An operator that uses this method must provide notice that the parent can revoke any consent given in response to the earlier email.
(3) Safe harbor approval of parental consent methods. A safe harbor program approved by the Commission under Sec. 312.11 may approve its member operators' use of a parental consent method not currently enumerated in paragraph (b)(2) of this section where the safe harbor program determines that such parental consent method meets the requirements of paragraph (b)(1) of this section.
(c) Exceptions to prior parental consent. Verifiable parental consent is required prior to any collection, use, or disclosure of personal information from a child except as set forth in this paragraph:
(1) Where the sole purpose of collecting the name or online contact information of the parent or child is to provide notice and obtain parental consent under Sec. 312.4(c)(1). If the operator has not obtained parental consent after a reasonable time from the date of the information collection, the
Page 4012
operator must delete such information from its records;
(2) Where the purpose of collecting a parent's online contact information is to provide voluntary notice to, and subsequently update the parent about, the child's participation in a Web site or online service that does not otherwise collect, use, or disclose children's personal information. In such cases, the parent's online contact information may not be used or disclosed for any other purpose. In such cases, the operator must make reasonable efforts, taking into consideration available technology, to ensure that the parent receives notice as described in Sec. 312.4(c)(2);
(3) Where the sole purpose of collecting online contact information from a child is to respond directly on a one-time basis to a specific request from the child, and where such information is not used to re-
contact the child or for any other purpose, is not disclosed, and is deleted by the operator from its records promptly after responding to the child's request;
(4) Where the purpose of collecting a child's and a parent's online contact information is to respond directly more than once to the child's specific request, and where such information is not used for any other purpose, disclosed, or combined with any other information collected from the child. In such cases, the operator must make reasonable efforts, taking into consideration available technology, to ensure that the parent receives notice as described in Sec. 312.4(c)(3). An operator will not be deemed to have made reasonable efforts to ensure that a parent receives notice where the notice to the parent was unable to be delivered;
(5) Where the purpose of collecting a child's and a parent's name and online contact information, is to protect the safety of a child, and where such information is not used or disclosed for any purpose unrelated to the child's safety. In such cases, the operator must make reasonable efforts, taking into consideration available technology, to provide a parent with notice as described in Sec. 312.4(c)(4);
(6) Where the purpose of collecting a child's name and online contact information is to:
(i) Protect the security or integrity of its Web site or online service;
(ii) Take precautions against liability;
(iii) Respond to judicial process; or
(iv) To the extent permitted under other provisions of law, to provide information to law enforcement agencies or for an investigation on a matter related to public safety; and where such information is not be used for any other purpose;
(7) Where an operator collects a persistent identifier and no other personal information and such identifier is used for the sole purpose of providing support for the internal operations of the Web site or online service. In such case, there also shall be no obligation to provide notice under Sec. 312.4; or
(8) Where an operator covered under paragraph (2) of the definition of Web site or online service directed to children in Sec. 312.2 collects a persistent identifier and no other personal information from a user who affirmatively interacts with the operator and whose previous registration with that operator indicates that such user is not a child. In such case, there also shall be no obligation to provide notice under Sec. 312.4.
Sec. 312.6 Right of parent to review personal information provided by a child.
(a) Upon request of a parent whose child has provided personal information to a Web site or online service, the operator of that Web site or online service is required to provide to that parent the following:
(1) A description of the specific types or categories of personal information collected from children by the operator, such as name, address, telephone number, email address, hobbies, and extracurricular activities;
(2) The opportunity at any time to refuse to permit the operator's further use or future online collection of personal information from that child, and to direct the operator to delete the child's personal information; and
(3) Notwithstanding any other provision of law, a means of reviewing any personal information collected from the child. The means employed by the operator to carry out this provision must:
(i) Ensure that the requestor is a parent of that child, taking into account available technology; and
(ii) Not be unduly burdensome to the parent.
(b) Neither an operator nor the operator's agent shall be held liable under any Federal or State law for any disclosure made in good faith and following reasonable procedures in responding to a request for disclosure of personal information under this section.
(c) Subject to the limitations set forth in Sec. 312.7, an operator may terminate any service provided to a child whose parent has refused, under paragraph (a)(2) of this section, to permit the operator's further use or collection of personal information from his or her child or has directed the operator to delete the child's personal information.
Sec. 312.7 Prohibition against conditioning a child's participation on collection of personal information.
An operator is prohibited from conditioning a child's participation in a game, the offering of a prize, or another activity on the child's disclosing more personal information than is reasonably necessary to participate in such activity.
Sec. 312.8 Confidentiality, security, and integrity of personal information collected from children.
The operator must establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children. The operator must also take reasonable steps to release children's personal information only to service providers and third parties who are capable of maintaining the confidentiality, security and integrity of such information, and who provide assurances that they will maintain the information in such a manner.
Sec. 312.9 Enforcement.
Subject to sections 6503 and 6505 of the Children's Online Privacy Protection Act of 1998, a violation of a regulation prescribed under section 6502 (a) of this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
Sec. 312.10 Data retention and deletion requirements.
An operator of a Web site or online service shall retain personal information collected online from a child for only as long as is reasonably necessary to fulfill the purpose for which the information was collected. The operator must delete such information using reasonable measures to protect against unauthorized access to, or use of, the information in connection with its deletion.
Sec. 312.11 Safe harbor programs.
(a) In general. Industry groups or other persons may apply to the Commission for approval of self-regulatory program guidelines (``safe harbor programs''). The application shall be filed with the Commission's Office of the Secretary. The Commission will publish in the Federal Register a document seeking public comment on the application. The Commission shall issue a written determination within 180 days of the filing of the application.
(b) Criteria for approval of self-regulatory program guidelines. Proposed safe harbor programs must demonstrate
Page 4013
that they meet the following performance standards:
(1) Program requirements that ensure operators subject to the self-
regulatory program guidelines (``subject operators'') provide substantially the same or greater protections for children as those contained in Sec. Sec. 312.2 through 312.8, and 312.10.
(2) An effective, mandatory mechanism for the independent assessment of subject operators' compliance with the self-regulatory program guidelines. At a minimum, this mechanism must include a comprehensive review by the safe harbor program, to be conducted not less than annually, of each subject operator's information policies, practices, and representations. The assessment mechanism required under this paragraph can be provided by an independent enforcement program, such as a seal program.
(3) Disciplinary actions for subject operators' non-compliance with self-regulatory program guidelines. This performance standard may be satisfied by:
(i) Mandatory, public reporting of any action taken against subject operators by the industry group issuing the self-regulatory guidelines;
(ii) Consumer redress;
(iii) Voluntary payments to the United States Treasury in connection with an industry-directed program for violators of the self-
regulatory guidelines;
(iv) Referral to the Commission of operators who engage in a pattern or practice of violating the self-regulatory guidelines; or
(v) Any other equally effective action.
(c) Request for Commission approval of self-regulatory program guidelines. A proposed safe harbor program's request for approval shall be accompanied by the following:
(1) A detailed explanation of the applicant's business model, and the technological capabilities and mechanisms that will be used for initial and continuing assessment of subject operators' fitness for membership in the safe harbor program;
(2) A copy of the full text of the guidelines for which approval is sought and any accompanying commentary;
(3) A comparison of each provision of Sec. Sec. 312.2 through 312.8, and 312.10 with the corresponding provisions of the guidelines; and
(4) A statement explaining:
(i) How the self-regulatory program guidelines, including the applicable assessment mechanisms, meet the requirements of this part; and
(ii) How the assessment mechanisms and compliance consequences required under paragraphs (b)(2) and (b)(3) provide effective enforcement of the requirements of this part.
(d) Reporting and recordkeeping requirements. Approved safe harbor programs shall:
(1) By July 1, 2014, and annually thereafter, submit a report to the Commission containing, at a minimum, an aggregated summary of the results of the independent assessments conducted under paragraph (b)(2) of this section, a description of any disciplinary action taken against any subject operator under paragraph (b)(3) of this section, and a description of any approvals of member operators' use of a parental consent mechanism, pursuant to Sec. 312.5(b)(4);
(2) Promptly respond to Commission requests for additional information; and
(3) Maintain for a period not less than three years, and upon request make available to the Commission for inspection and copying:
(i) Consumer complaints alleging violations of the guidelines by subject operators;
(ii) Records of disciplinary actions taken against subject operators; and
(iii) Results of the independent assessments of subject operators' compliance required under paragraph (b)(2) of this section.
(e) Post-approval modifications to self-regulatory program guidelines. Approved safe harbor programs must submit proposed changes to their guidelines for review and approval by the Commission in the manner required for initial approval of guidelines under paragraph (c)(2) of this section. The statement required under paragraph (c)(4) of this section must describe how the proposed changes affect existing provisions of the guidelines.
(f) Revocation of approval of self-regulatory program guidelines. The Commission reserves the right to revoke any approval granted under this section if at any time it determines that the approved self-
regulatory program guidelines or their implementation do not meet the requirements of this part. Safe harbor programs that were approved prior to the publication of the Final Rule amendments must, by March 1, 2013, submit proposed modifications to their guidelines that would bring them into compliance with such amendments, or their approval shall be revoked.
(g) Operators' participation in a safe harbor program. An operator will be deemed to be in compliance with the requirements of Sec. Sec. 312.2 through 312.8, and 312.10 if that operator complies with Commission-approved safe harbor program guidelines. In considering whether to initiate an investigation or bring an enforcement action against a subject operator for violations of this part, the Commission will take into account the history of the subject operator's participation in the safe harbor program, whether the subject operator has taken action to remedy such non-compliance, and whether the operator's non-compliance resulted in any one of the disciplinary actions set forth in paragraph (b)(3).
Sec. 312.12 Voluntary Commission Approval Processes.
(a) Parental consent methods. An interested party may file a written request for Commission approval of parental consent methods not currently enumerated in Sec. 312.5(b). To be considered for approval, a party must provide a detailed description of the proposed parental consent methods, together with an analysis of how the methods meet Sec. 312.5(b)(1). The request shall be filed with the Commission's Office of the Secretary. The Commission will publish in the Federal Register a document seeking public comment on the request. The Commission shall issue a written determination within 120 days of the filing of the request; and
(b) Support for internal operations of the Web site or online service. An interested party may file a written request for Commission approval of additional activities to be included within the definition of support for internal operations. To be considered for approval, a party must provide a detailed justification why such activities should be deemed support for internal operations, and an analysis of their potential effects on children's online privacy. The request shall be filed with the Commission's Office of the Secretary. The Commission will publish in the Federal Register a document seeking public comment on the request. The Commission shall issue a written determination within 120 days of the filing of the request.
Sec. 312.13 Severability.
The provisions of this part are separate and severable from one another. If any provision is stayed or determined to be invalid, it is the Commission's intention that the remaining provisions shall continue in effect.
Page 4014
By direction of the Commission, Commissioner Rosch abstaining, and Commissioner Ohlhausen dissenting.
Donald S. Clark,
Secretary.
Dissenting Statement of Commissioner Maureen K. Ohlhausen
I voted against adopting the amendments to the Children's Online Privacy Protection Act (COPPA) Rule because I believe a core provision of the amendments exceeds the scope of the authority granted us by Congress in COPPA, the statute that underlies and authorizes the Rule.\401\ Before I explain my concerns, I wish to commend the Commission staff for their careful consideration of the multitude of issues raised by the numerous comments in this proceeding. Much of the language of the amendments is designed to preserve flexibility for the industry while striving to protect children's privacy, a goal I support strongly. The final proposed amendments largely strike the right balance between protecting children's privacy online and avoiding undue burdens on providers of children's online content and services. The staff's great expertise in the area of children's privacy and deep understanding of the values at stake in this matter have been invaluable in my consideration of these important issues.
---------------------------------------------------------------------------
\401\ 15 U.S.C. 6501-6506.
---------------------------------------------------------------------------
In COPPA Congress defined who is an operator and thereby set the outer boundary for the statute's and the COPPA Rule's reach.\402\ It is undisputed that COPPA places obligations on operators of Web sites or online services directed to children or operators with actual knowledge that they are collecting personal information from children. The statute provides, ``It is unlawful for an operator of a Web site or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed by the FTC.'' \403\
---------------------------------------------------------------------------
\402\ COPPA, 15 U.S.C. 6501(2), defines the term ``operator'' as ``any person who operates a Web site located on the Internet or an online service and who collects or maintains personal information from or about users of or visitors to such Web site or online service, or on whose behalf such information is collected and maintained * * *'' As stated in the Statement of Basis and Purpose for the original COPPA Rule, ``The definition of `operator' is of central importance because it determines who is covered by the Act and the Rule.'' Children's Online Privacy Protection Rule 64 FR 59888, 59891 (Nov. 3, 1999) (final rule).
\403\ 15 U.S.C. 6502(a)(1).
---------------------------------------------------------------------------
The Statement of Basis and Purpose for the amendments (SBP) discusses concerns that the current COPPA Rule may not cover child-
directed Web sites or services that do not themselves collect children's personal information but may incorporate third-party plug-ins that collect such information \404\ for the plug-ins' use but do not collect or maintain the information for, or share it with, the child-directed site or service. To address these concerns, the amendments add a new proviso to the definition of operator in the COPPA Rule: ``Personal information is collected or maintained on behalf of an operator when: (a) it is collected or maintained by an agent or service provider of the operator; or (b) the operator benefits by allowing another person to collect personal information directly from users of such Web site or online service.'' \405\
---------------------------------------------------------------------------
\404\ If the third-party plugs-ins are child-directed or have actual knowledge that they are collecting children's personal information they are already expressly covered by the COPPA statute. Thus, as the SBP notes, a behavioral advertising network that targets children under the age of 13 is already deemed an operator. The amendment must therefore be aimed at reaching third-party plug-
ins that are either not child-directed or do not have actual knowledge that they are collecting children's personal information, which raises a question about what harm this amendment will address. For example, it appears that this same type of harm could occur through general audience Web sites and online services collecting and using visitors' personal information without knowing whether some of the data is children's personal information, which is a practice that COPPA and the amendments do not prohibit.
\405\ 16 CFR 312.2 (Definitions).
---------------------------------------------------------------------------
The proposed amendments construe the term ``on whose behalf such information is collected and maintained'' to reach child-directed Web sites or services that merely derive from a third-party plug-in some kind of benefit, which may well be unrelated to the collection and use of children's information (e.g., content, functionality, or advertising revenue). I find that this proviso--which would extend COPPA obligations to entities that do not collect personal information from children or have access to or control of such information collected by a third-party does not comport with the plain meaning of the statutory definition of an operator in COPPA, which covers only entities ``on whose behalf such information is collected and maintained.'' \406\ In other words, I do not believe that the fact that a child-directed site or online service receives any kind of benefit from using a plug-in is equivalent to the collection of personal information by the third-party plug-in on behalf of the child-directed site or online service.
---------------------------------------------------------------------------
\406\ This expanded definition of operator reverses the Commission's previous conclusion that the appropriate test for determining an entity's status as an operator is to ``look at the entity's relationship to the data collected,'' using factors such as ``who owns and/or controls the information, who pays for its collection and maintenance, the pre-existing contractual relationships regarding collection and maintenance of the information, and the role of the Web site or online service in collecting and/or maintaining the information (i.e., whether the site participates in collection or is merely a conduit through which the information flows to another entity.)'' Children's Online Privacy Protection Rule 64 FR 59888, 59893, 59891 (Nov. 3, 1999) (final rule).
---------------------------------------------------------------------------
As the Supreme Court has directed, an agency ``must give effect to the unambiguously expressed intent of Congress.'' \407\ Thus, regardless of the policy justifications offered, I cannot support expanding the definition of the term ``operator'' beyond the statutory parameters set by Congress in COPPA.
---------------------------------------------------------------------------
\407\ Chevron v. Natural Resources Defense Council, Inc., 467 U.S. 837, 842-43 (1984) (``When a court reviews an agency's construction of the statute which it administers, it is confronted with two questions. First, always, is the question whether Congress has directly spoken to the precise question at issue. If the intent of Congress is clear, that is the end of the matter; for the court, as well as the agency, must give effect to the unambiguously expressed intent of Congress.'').
---------------------------------------------------------------------------
I therefore respectfully dissent.
FR Doc. 2012-31341 Filed 1-16-13; 8:45 am
BILLING CODE 6750-01-P
-
