Children's Online Privacy Protection Rule
Federal Register, Volume 77 Issue 151 (Monday, August 6, 2012)
Federal Register Volume 77, Number 151 (Monday, August 6, 2012)
Proposed Rules
Pages 46643-46653
From the Federal Register Online via the Government Printing Office www.gpo.gov
FR Doc No: 2012-19115
Page 46643
FEDERAL TRADE COMMISSION
RIN 3084-AB20
Children's Online Privacy Protection Rule
AGENCY: Federal Trade Commission (``FTC'' or ``Commission'').
ACTION: Supplemental notice of proposed rulemaking; request for comment.
-----------------------------------------------------------------------
SUMMARY: The Commission is proposing to further modify the proposed definitions of personal information, support for internal operations, and Web site or online service directed to children, that the FTC has proposed previously under its Rule implementing the Children's Online Privacy Protection Act (``COPPA Rule''), and further proposes to revise the Rule's definition of operator. These proposed revisions, which are based on the FTC's review of public comments and its enforcement experience, are intended to clarify the scope of the Rule and strengthen its protections for children's personal information. The Commission is not adopting any final amendments to the COPPA Rule at this time and continues to consider comments submitted in response to its Notice of Proposed Rulemaking issued in September 2011.
DATES: Written comments must be received on or before September 10, 2012.
ADDRESSES: Interested parties may file a comment online or on paper, by following the instructions in the Request for Comment part of the SUPPLEMENTARY INFORMATION section below. Write ``COPPA Rule Review, 16 CFR Part 312, Project No. P104503'' on your comment, and file your comment online at https://ftcpublic.commentworks.com/ftc/2012copparulereview, by following the instructions on the web-based form. If you prefer to file your comment on paper, mail or deliver your comment to the following address: Federal Trade Commission, Office of the Secretary, Room H-113 (Annex E), 600 Pennsylvania Avenue NW., Washington, DC 20580.
FOR FURTHER INFORMATION CONTACT: Phyllis H. Marcus or Mamie Kresses, Attorneys, Division of Advertising Practices, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW., Washington, DC 20580, (202) 326-2854 or (202) 326-2070.
SUPPLEMENTARY INFORMATION:
-
Background
In September 2011, the FTC issued a Notice of Proposed Rulemaking setting forth proposed changes to the Commission's COPPA Rule. Among other things, the Commission proposed modifying the Rule's definition of personal information to include persistent identifiers and screen or user names other than where they are used to support internal operations, and Web site or online service directed to children to include additional indicia that a site or service may be targeted to children.\1\ The Commission received over 350 comments, a number of which addressed the proposed changes to these two definitions.\2\ After reviewing these comments, and based upon its experience in enforcing and administering the Rule, the Commission now proposes to modify the definition of operator, and proposes additional modifications to the definitions of Web site or online service directed to children, personal information, and support for internal operations.
---------------------------------------------------------------------------
\1\ Id.
\2\ Public comments in response to the Commission's September 27, 2011, Federal Register document are located at http://www.ftc.gov/os/comments/copparulereview2011/. Comments have been numbered based upon alphabetical order. Comments are cited herein by commenter name, comment number, and, where applicable, page number.
---------------------------------------------------------------------------
The Commission proposes modifying the definition of both operator and Web site or online service directed to children to allocate and clarify the responsibilities under COPPA when independent entities or third parties, e.g., advertising networks or downloadable software kits (``plug-ins''), collect information from users through child-directed sites and services. As described below, previous Commission statements suggested that the responsibility for providing notice to parents and obtaining verifiable parental consent to the collection of personal information from children rested entirely with the information collection entity and not with the child-directed site operator. The Commission now believes that the most effective way to implement the intent of Congress is to hold both the child-directed site or service and the information-collecting site or service responsible as covered co-operators. Sites and services whose content is directed to children, and who permit others to collect personal information from their child visitors, benefit from that collection and thus should be responsible under COPPA for providing notice to and obtaining consent from parents. Conversely, online services whose business models entail the collection of personal information and that know or have reason to know that such information is collected through child-directed properties should provide COPPA's protections.
In addition, the Commission proposes to modify the previously proposed revised definition of Web site or online service directed to children to permit Web sites or online services that are designed for both children and a broader audience to comply with COPPA without treating all users as children. The Commission also proposes modifying the definition of screen or user name to cover only those situations where a screen or user name functions in the same manner as online contact information. Finally, the Commission proposes to modify the revised definition of support for internal operations and to modify the Rule's coverage of persistent identifiers as personal information.
-
Proposed Modifications to the Rule's Definitions (16 CFR 312.2)
-
Definition of Operator
Public comments \3\ and the Commission's own enforcement experience \4\ highlight the need for the
Page 46644
Commission to clarify the responsibilities of child-directed properties that integrate independent social networking or other types of ``plug-
ins'' into their sites or services. These plug-ins often collect personal information directly from users of child-directed sites and services. Although the child-directed site or service benefits by incorporating the social networking or other information collection features of the plug-in, it generally has no ownership, control, or access to the personal information collected by the plug-in. In many ways, the plug-in scenario mirrors the current situation with child-
directed Web sites and advertising networks: the site determines the child-directed nature of the content, but the third-party advertising network collects persistent identifiers for tracking purposes, which could be considered personal information under the proposed revised Rule.
---------------------------------------------------------------------------
\3\ See, e.g., AT&T (comment 8), at 3-4; CDT (comment 17), at 3-
6; CTIA (comment 32), at 16; Direct Marketing Association (comment 37), at 7; Future of Privacy Forum (comment 55), at 3; Information Technology Industry Council (comment 70), at 3-4; Interactive Advertising Bureau (comment 73), at 7; and, Tech Freedom (comment 159), at 12.
\4\ See FTC staff closing letter to OpenFeint (``OpenFeint Letter''), available at http://www.ftc.gov/os/closings/120831openfeintclosingletter.pdf.
---------------------------------------------------------------------------
COPPA defines operator in pertinent part, as
(A) Any person who operates a Web site located on the Internet or an online service and who collects or maintains personal information from or about the users of or visitors to such Web site or online service, or on whose behalf such information is collected or maintained, where such Web site or online service is operated for commercial purposes, including any person offering products or services for sale through that Web site or online service, involving commerce * * *.\5\
---------------------------------------------------------------------------
\5\ 15 U.S.C. 6501(2). The Rule's definition of operator reflects the statutory language. See 16 CFR 312.2.
In both the 1999 Notice of Proposed Rulemaking and the 1999 Statement of Basis and Purpose, the Commission suggested that some retention of ownership, control, or access to the personal information collected was required to make a party an operator. The Commission stated that it would look to a variety of factors--ownership, control, financial and contractual arrangements, and the role of the site or service in data collection or maintenance--to establish whether an entity was covered by or subject to COPPA's regulatory obligations.\6\ The Commission also asserted that ``where the Web site or online service merely acts as the conduit through which the personal information collected flows to another person or to another's Web site or online service, and the Web site or online service does not have access to the information, then it is not an operator under the proposed Rule.'' \7\
---------------------------------------------------------------------------
\6\ 1999 Notice of Proposed Rulemaking and Request for Public Comment, 64 FR 22750, 22752 (Apr. 27, 1999), available at http://www.ftc.gov/os/fedreg/1999/april/990427childrensonlineprivacy.pdf (``In determining who is the operator for purposes of the proposed Rule, the Commission will consider such factors as who owns the information, who controls the information, who pays for the collection or maintenance of the information, the pre-existing contractual relationships surrounding the collection or maintenance of the information, and the role of the Web site or online service in collecting and/or maintaining the information'').
\7\ Id. The Commission reiterated this view in the 1999 Statement of Basis and Purpose to the COPPA Rule (``1999 Statement of Basis and Purpose''), 64 FR 59888, 59891 (Nov. 3, 1999), available at http://www.ftc.gov/os/1999/10/64Fr59888.pdf.
---------------------------------------------------------------------------
At that time, the Commission did not foresee how easy and commonplace it would become for child-directed sites and services to integrate social networking and other personal information collection features into the content offered to their users, without maintaining ownership, control, or access to the personal data. Given these changes in technology, the Commission now believes that an operator of a child-
directed site or service that chooses to integrate into its site or service other services that collect personal information from its visitors should be considered a covered operator under the Rule. Although the child-directed site or service does not own, control, or have access to the information collected, the personal information is collected on its behalf. The child-directed site or service benefits from its use of integrated services that collect personal information because the services provide the site with content, functionality, and/
or advertising revenue.
Therefore, the Commission proposes to revise the definition of operator to add a proviso stating:
Personal information is collected or maintained on behalf of an operator where it is collected in the interest of, as a representative of, or for the benefit of, the operator.
Neither the COPPA statute nor its legislative history make clear under what circumstances third-party data collection activities would be deemed to be conducted ``on an operator's behalf.'' Nor did the Commission previously define the phrase on whose behalf such information is collected or maintained in the COPPA Rule.
Congress granted the FTC broad rulemaking authority under COPPA.\8\ The Commission's interpretation of the phrase on whose behalf is consistent both with its plain and common meaning \9\ and with the Commission's advocated position on the meaning of that phrase within the Telephone Consumer Protection Act, 47 U.S.C. 227, and the position it has urged the Federal Communications Commission to adopt in the implementing regulations, 47 CFR 64.1200.\10\
---------------------------------------------------------------------------
\8\ Congress delegated to the FTC the authority to promulgate regulations that require operators covered by COPPA to: Provide online notice of their information practices; obtain verifiable parental consent for the collection, use, or disclosure of personal information from children; provide parents with a means to obtain such personal information and to refuse further collection; establish and maintain adequate confidentiality and security for children's personal information; and that prohibit conditioning a child's participation online on disclosing more personal information than is necessary. See 15 U.S.C. 6502(b).
\9\ See Madden v. Cowen & Co., 576 F.3d 957, 974 (9th Cir. 2009).
\10\ See Comment of the Federal Trade Commission before the Federal Communications Commission, CG Docket No. 11-50 (2011), at 7, available at http://www.ftc.gov/os/2011/05/110516dishechostar.pdf (stating that the common dictionary definition of ``on behalf of'' means in an entity's ``interest,'' in its ``aid,'' or for its ``benefit'').
---------------------------------------------------------------------------
In the context of COPPA's requirements, an operator of a child-
directed site or service is in an appropriate position to give notice and obtain consent from parents where any personal information is being collected from its visitors on or through its site or service. The operator is in the best position to know that its site or service is directed to children and can control which plug-ins, software downloads, or advertising networks it integrates into its site. To interpret the COPPA statute's on whose behalf language more narrowly does not fully effectuate Congress's intent to insure that parents are consistently given notice and the opportunity to consent prior to the collection of children's personal information.
-
Definition of Web Site or Online Service Directed to Children
In the September 2011 COPPA NPRM, the Commission proposed minor changes to the definition of Web site or online service directed to children to include additional indicia of child-directed Web sites and online services.\11\ The Commission now proposes additional modifications to this definition in order to: (1) Make clear that a Web site or online service that knows or has reason to know that it collects personal information from children through a child-directed Web site or online service is itself A``directed to children''; and (2) permit a Web site or online service that is designed for both children and a broader audience to comply with COPPA without having to treat all its users as children.
---------------------------------------------------------------------------
\11\ See 2011 COPPA NPRM, 76 FR at 59814.
---------------------------------------------------------------------------
Page 46645
-
Operators Who Collect Personal Information Through Child-Directed Web Sites or Online Services
As noted above, online services such as advertising networks or downloadable plug-ins often collect personal information from users through another's site or service, including properties directed to children.\12\ When operating on child-directed properties, that portion of these services could be deemed directed to children and the operator held strictly liable under COPPA. This position would be consistent with previous Commission statements that the Rule covers entities collecting information through child-directed sites. In its original April 1999 Notice of Proposed Rulemaking, the Commission stated that the definition of operator includes ``a person who collects or maintains personal information through another's Web site or online service.'' \13\ In the 1999 Statement of Basis and Purpose, in discussing the potential liability of network advertising companies, the Commission noted that ``if such companies collect personal information directly from children who click on ads placed on Web sites or online services directed to children, then they will be considered operators who must comply with the Act, unless one of the exceptions applies.'' \14\
---------------------------------------------------------------------------
\12\ This fact was highlighted in a recent Commission law enforcement investigation of OpenFeint, Inc., an online social gaming network available as a plug-in to mobile applications. See OpenFeint Letter, supra note 4.
\13\ 1999 Notice of Proposed Rulemaking and Request for Public Comment, 64 FR 22750, 22752 (Apr. 27, 1999), available at http://www.ftc.gov/os/fedreg/1999/april/990427childrensonlineprivacy.pdf.
\14\ Statement of Basis and Purpose to the COPPA Rule, 64 FR 59888, 59892 (Nov. 3, 1999), available at http://www.ftc.gov/os/1999/10/64Fr59888.pdf.
---------------------------------------------------------------------------
Several commenters in response to the 2011 COPPA NPRM, however, state that operators of online services that are designed to be incorporated into another site or service should not be covered under COPPA's requirements when they appear on child-directed sites or services.\15\ For example, the Center for Democracy and Technology (``CDT'') states, ``operators of analytics services, advertising networks, and social plug-ins that do not intentionally target their services to children should not have independent COPPA notice and consent obligations simply because a site directed to children has chosen to use their service.'' \16\
---------------------------------------------------------------------------
\15\ See, e.g., CDT (comment 17), at 5; Facebook (comment 50), at 11; Future of Privacy Forum (comment 55), at 3; TechFreedom (comment 159), at 10-11.
\16\ CDT (comment 17), at 5.
---------------------------------------------------------------------------
The COPPA statute gives the Commission broad discretion to define Web site or online service directed to children. Congress provided only one limitation to that discretion:
A commercial Web site or online service, or a portion of a commercial Web site or online service, shall not be deemed directed to children solely for referring or linking to a commercial Web site or online service directed to children by using information location tools, including a directory, index, reference, pointer, or hypertext link.\17\
---------------------------------------------------------------------------
\17\ 15 U.S.C. 6501(10).
The Commission continues to believe that when an online service collects personal information through child-directed properties, that portion of the online service can and should be deemed directed to children, but only under certain circumstances. The Commission believes that the strict liability standard applicable to conventional child-
directed sites and services is unworkable for advertising networks or plug-ins because of the logistical difficulties such services face in controlling or monitoring which sites incorporate their online services. Accordingly, the Commission proposes to modify the definition of Web site or online service directed to children to include any operator who ``knows or has reason to know'' it is collecting personal information through a host Web site or online service directed to ---------------------------------------------------------------------------
children. The proposed new paragraph is:
Web site or online service directed to children means a commercial Web site or online service, or portion thereof, that:
* * * * *
(d) knows or has reason to know that it is collecting personal information through any Web site or online service covered under paragraphs (a)-(c).
In choosing to use the phrase ``reason to know'' as part of the definition, the Commission is not imposing a duty on entities such as ad-networks or plug-ins to monitor or investigate whether their services are incorporated into child-directed properties; \18\ however, such sites and services will not be free to ignore credible information brought to their attention indicating that such is the case.
---------------------------------------------------------------------------
\18\ The phrase ``reason to know'' does not impose a duty to ascertain unknown facts, but does require a person to draw a reasonable inference from information he does have. See Restatement (Second) of Agency Sec. 9 cmt. d (1958); Restatement (Second) of Torts Sec. Sec. 12(1), 401 (1965). See also Novicki v. Cook, 946 F.2d 938, 941 (D.C. Cir. 1991) (citing the Restatement (Second) of Agency); Alf v. Donley, 666 F. Supp. 2d 60, 67 (D.D.C. 2009) (following Novicki v. Cook); Feinerman v. Bernardi, 558 F. Supp. 2d 36, 49 (D.D.C. 2008) (following Novicki v. Cook); Topliff v. Wal-
Mart Stores E. LP, 2007 U.S. Dist. LEXIS 20533, 200, CCH Prod. Liab. Rep. P17,728 (N.D.N.Y Mar. 22, 2007) (``the term `had reason to know' does not impose any duty to ascertain unknown facts, while the term `should have known' does impose such a duty).
---------------------------------------------------------------------------
The Commission believes that this proposed modification to the definition of Web site or online service directed to children, along with the proposed revisions to the definition of operator that would hold the child-directed property to be a co-operator equally responsible under the Rule for the personal information collected by the plug-in or advertising network, will help ensure that operators in each position cooperate to meet their statutory duty to notify parents and obtain parental consent.
-
Web Sites and Online Services Directed to Children and Families
As noted in its September 2011 NPRM, the current definition of Web site or online service directed to children is, at bottom, a totality of the circumstances test. In its comment, The Walt Disney Company argues that this definition does not adequately address the reality that Web sites or online services directed to children fall along a continuum, targeting or appealing to children in varying degrees. Under the Rule's current structure, regardless of where a site or service falls on this continuum, it must still treat all visitors as children. Disney argues that only sites falling at the extreme end of the ``child-directed'' continuum should have to treat all of their users as children. It urges the Commission to adopt a system that would permit Web sites or online services directed to larger audiences, specifically those directed to children and families, to differentiate among users, requiring such sites and services to provide notice and obtain consent only for users who self-identify as under age 13.\19\
---------------------------------------------------------------------------
\19\ The Walt Disney Co. (comment 170), at 5-6.
---------------------------------------------------------------------------
The Commission finds merit in Disney's suggestion. In large measure, it reflects the prosecutorial discretion the Commission has applied in enforcing the Rule. The Commission has charged sites or services with being directed to children only where the Commission believed that children under age 13 were the primary audience.\20\ If the Commission believed the site merely was likely to attract significant numbers
Page 46646
of under 13 users, or had popular appeal with children (among others), the Commission has instead alleged that the operator had ``actual knowledge'' of collecting personal information from users who identified themselves as under 13.\21\ This enforcement approach recognizes the burden imposed on operators in having to obtain notice and consent for every user when most users may be over 13, as well as the burden and restrictions imposed on users over age 13 in being treated as young children.
---------------------------------------------------------------------------
\20\ See United States v. Godwin, d/b/a skid-e-kids.com, No. 1:11-cv-03846-JOF (N.D. Ga. Feb. 1, 2012) (alleging that defendant's skid-e-kids social networking Web site was directed to children); United States v. W3 Innovations, LLC, No. CV-11-03958 (N.D. Cal., filed Aug. 12, 2011) (alleging that defendants' ``Emily's'' apps were directed to children); United States v. Playdom, Inc., No. SA CV11-00724 (C.D. Cal., May 24, 2011) (alleging that Playdom's Pony Stars online virtual world was directed to children).
\21\ See United States v. Iconix Brand Group, Inc., No. 09 Civ. 8864 (S.D.N.Y, Nov. 5, 2009); United States v. Sony BMG Music Entertainment, No. 08 Civ. 10730 (S.D.N.Y., Dec. 15, 2008).
---------------------------------------------------------------------------
As noted above, Congress gave the Commission broad discretion to define Web site or online service directed to children. The Commission now proposes to modify that definition to implement much of what Disney has proposed and to better reflect the prosecutorial discretion it has applied. The proposed revised definition is:
Web site or online service directed to children means a commercial Web site or online service, or portion thereof, that:
(a) Knowingly targets children under age 13 as its primary audience; or,
(b) Based on the overall content of the Web site or online service, is likely to attract children under age 13 as its primary audience; or,
(c) Based on the overall content of the Web site or online service, is likely to attract an audience that includes a disproportionately large percentage of children under age 13 as compared to the percentage of such children in the general population; provided however that such Web site or online service shall not be deemed to be directed to children if it: (i) Does not collect personal information from any visitor prior to collecting age information; and (ii) prevents the collection, use, or disclosure of personal information from visitors who identify themselves as under age 13 without first obtaining verifiable parental consent;
* * * * *
The effect of the proposed changes would be that those sites and services at the far end of the ``child-directed'' continuum, i.e., those that knowingly target, or have content likely to draw, children under 13 as their primary audience, must still treat all users as children, and provide notice and obtain consent before collecting any personal information from any user. Those sites and services with child-oriented content appealing to a mixed audience, where children under 13 are likely to be an over-represented group, will not be deemed directed to children if, prior to collecting any personal information, they age-screen all users. At that point, for users who identify themselves as under 13, the site or service will be deemed to have actual knowledge that such users are under 13 and must obtain appropriate parental consent before collecting any personal information from them and must also comply with all other aspects of the Rule.
The Commission recognizes that many children may choose to lie about their age. Nevertheless, the Commission believes the proposed revisions strike the correct balance. First, it has been the Commission's law enforcement experience, as demonstrated by its ``actual knowledge'' cases, that many children do truthfully provide their age in response to an age screening question on mixed audience sites.\22\ Second, as noted above, as a matter of prosecutorial discretion, the Commission has not charged child-friendly mixed audience sites as being directed to children because of the burdens it imposes. Consequently, if those sites collected personal information without asking age, the Commission had little basis to allege that the operator had actual knowledge of any visitor's age. The proposed revisions will require operators of these child-friendly mixed audience sites to take an affirmative step to attain actual knowledge if they do not wish to treat all visitors as being under 13.
---------------------------------------------------------------------------
\22\ See United States v. Iconix Brand Group, Inc.; and United States v. Sony BMG Music Entertainment, supra note 23.
---------------------------------------------------------------------------
-
-
Definition of Personal Information
-
Screen or User Names
In the 2011 COPPA NPRM, the Commission proposed to define as personal information ``a screen or user name where such screen or user name is used for functions other than or in addition to support for the internal operations of the Web site or online service.'' \23\ This change was intended to address scenarios in which a screen or user name could be used by a child as a single credential to access multiple online properties, thereby permitting him or her to be directly contacted online, regardless of whether the screen or user name contained an email address.\24\
---------------------------------------------------------------------------
\23\ 2011 COPPA NPRM, 76 FR at 59810.
\24\ Id.
---------------------------------------------------------------------------
Several commenters expressed concern that the Commission's screen-
name proposal would unnecessarily inhibit functions that are important to the operation of child-directed Web sites and online services. For example, commenters stated that many child-directed properties use a screen or user name in place of a child's real name in an effort to minimize data collection.\25\ Operators also use single screen names to allow children to sign on to a single online service that runs on multiple platforms, as well as to access related properties across multiple platforms.\26\ These commenters raised concerns that, with the limited carve-out for functions to support internal operations, operators might be precluded from using screen or user names within a Web site or online service, and would certainly be precluded from doing so across multiple platforms.
---------------------------------------------------------------------------
\25\ See National Cable & Telecommunications Association (comment 113), at 12 (``Allowing children to create a unique screen name and password at a Web site through a registration process without collecting any personally identifying information has allowed several leading children's Web sites to offer: personalized content (e.g., horoscopes, weather forecasts, customized avatars for game play), attribution (e.g., acknowledge for a high score or other achievement), as well as a way to express opinions and participate in online activities in an interactive fashion (e.g., jokes, stories, letters to the editor, polls, challenging others to gameplay, swapping digital collectibles, participating in monitored `chat' with celebrities''); The Walt Disney Co. (comment 170), at 21.
\26\ See Direct Marketing Association (comment 37), at 17; Entertainment Software Association (comment 47), at 9; Scholastic (comment 144), at 12; Adam Thierer (comment 162), at 6; TRUSTe (comment 164), at 3; The Walt Disney Co. (comment 170), at 21-22.
---------------------------------------------------------------------------
The Commission has long supported the data minimization purposes behind operators' use of screen and user names in place of individually identifiable information.\27\ Indeed, the proposed changes in paragraph (d) were not intended to preclude such uses. Moreover, after reading the comments, the Commission is persuaded of the benefits of utilizing single sign-in identifiers across sites and services, for example, to permit children seamlessly to transition between devices or platforms via a single screen or user name.\28\ The Commission therefore proposes that a screen or user name should be included within the definition of personal information only in those instances in which a screen or user name rises to the level of online contact information.\29\ In such cases, a screen or user name functions much like an email address, an instant messaging identifier, or ``or any other substantially similar identifier that permits direct contact with a person online.'' \30\
Page 46647
Therefore, the Commission proposes to modify paragraph (d) of the ---------------------------------------------------------------------------
definition of personal information as follows:
\27\ See 1999 Statement of Basis and Purpose, 64 FR at 59892.
\28\ See Direct Marketing Association (comment 37), at 16-17; Entertainment Software Association (comment 47), at 9-10; Adam Thierer (comment 162), at 6; TRUSTe (comment 164), at 3-4; The Walt Disney Co. (comment 170), at 21-22.
\29\ Id. at 59891, n.49 (``Another example of `online contact information' could be a screen name that also serves as an email address'').
\30\ See 2011 COPPA NPRM, 76 FR at 59810 (proposed definition of online contact information).
---------------------------------------------------------------------------
Personal information means individually identifiable information about an individual collected online, including:
* * * * *
(d) A screen or user name where it functions in the same manner as online contact information, as defined in this Section;
* * * * *
-
Persistent Identifiers and Support for Internal Operations
In the September 2011 COPPA NPRM, the Commission proposed changes to the definition of personal information that, among other things, would have included ``a persistent identifier, including but not limited to, a customer number held in a cookie, an Internet Protocol (IP) address, a processor or device serial number, or unique device identifier, where such persistent identifier is used for functions other than or in addition to support for the internal operations of the Web site or online service.'' \31\ The Commission also proposed to include in the definition of personal information ``identifiers that link the activities of a child across different Web sites or online services.'' \32\ As stated in the 2011 COPPA NPRM, these changes were intended to ``require parental notification and consent prior to the collection of persistent identifiers where they are used for purposes such as amassing data on a child's online activities or behaviorally targeting advertising to the child.'' \33\ By carving out exceptions for support for internal operations, the Commission stated it intended to exempt from COPPA's coverage the collection and use of identifiers for authenticating users, improving site navigation, maintaining user preferences, serving contextual advertisements, protecting against fraud or theft, or otherwise personalizing, improving upon, or securing a Web site or online service.\34\
---------------------------------------------------------------------------
\31\ See 2011 COPPA NPRM, 76 FR at 59812 (proposed definition of personal information, paragraph (g)).
\32\ Id. (proposed definition of paragraph (h)).
\33\ Id.
\34\ Id.
---------------------------------------------------------------------------
The Commission received numerous comments on the proposed inclusion of persistent identifiers within the definition of personal information. Consumer advocacy organizations, including the Center for Digital Democracy (``CDD''), Consumers Union (``CU''), and the Electronic Privacy Information Center (``EPIC''), fully supported the proposal, finding that, increasingly, particular devices are associated with particular individuals, and the collection of identifiers permits direct contact with individuals online.\35\ In addition to these advocacy groups, nearly 200 individual consumers filed comments supporting the inclusion of IP address within the Rule's definition of personal information.
---------------------------------------------------------------------------
\35\ See CU (comment 29), at 3; EPIC (comment 41), at 8; CDD (comment 71), at 29.
---------------------------------------------------------------------------
By contrast, the overwhelming majority of the comments filed by Web site operators, industry associations, privacy experts, and telecommunications companies opposed the Commission's expansion of the definition of personal information to reach persistent identifiers, even with the limitation to activities other than or in addition to support for internal operations. Most of these commenters claimed that the collection of one or more persistent identifiers only permits online contact with a device and not with a specific individual.\36\ These commenters also expressed concern about the breadth and potential vagueness of the proposed paragraph (h) defining as personal information ``an identifier that links the activities of a child across different Web sites or online services.'' Among the concerns raised about (h) were the lack of clarity about the term ``different Web sites or online services,'' \37\ including whether this term is intended to cover identifiers collected by a single operator across multiple platforms \38\ or a child's activities within or between affiliated Web sites or online services.\39\
---------------------------------------------------------------------------
\36\ See Computer and Communications Industry Association (comment 27), at 3-5; CTIA (comment 32), at 7-8; eBay (comment 40), at 5; Future of Privacy Forum (comment 55), at 2-3; Information Technology Industry Council (comment 70), at 3-4; Intel (comment 72), at 4-6; IAB (comment 73), at 4-6; KidSafe Seal Program (comment 81), at 6-7; TechAmerica (comment 159), at 3-5; Promotion Marketing Association (comment 133), at 10-12; TRUSTe (comment 164), at 4-6; Yahoo! (comment 180), at 7-8; Toy Industry Association (comment 163), at 8-10.
\37\ See IAB (comment 73), at 5; KidSafe Seal Program (comment 81), at 9; Scholastic (comment 144), at 14; TRUSTe (comment 164), at 5-6; The Walt Disney Co. (comment 170), at 20-21; WiredSafety (comment 177), at 11.
\38\ See Scholastic (comment 144), at 14; TRUSTe (comment 164), at 5.
\39\ See The Walt Disney Co. (comment 170), at 22.
---------------------------------------------------------------------------
Several commenters urged the Commission to alter its approach to persistent identifiers to focus more directly on their use, or potential misuse, rather than on their collection.\40\ Moreover, several commenters maintained that the proposed definition of support for internal operations is too narrow to cover the very types of activities the Commission intended to permit, e.g., user authentication, improving site navigation, maintaining user preferences, serving contextual advertisements, and protecting against fraud or theft.\41\ Others raised concerns that it was unclear whether the collection of data within persistent identifiers for the purpose of performing site performance or functioning analyses, or analytics, would be included within the definition of support for internal operations.\42\
---------------------------------------------------------------------------
\40\ ``A straightforward way to regulate the ability of operators to target children with behavioral advertising would be to simply prohibit operators from engaging in the practice as it has previously been defined by the FTC. But the FTC instead focuses on the types of information operators collect rather than on how operators use the information.'' Future of Privacy Forum (comment 55), at 2; see also VISA, Inc. (comment 168), at 2; WiredTrust (comment 177), at 11.
\41\ See CTIA (comment 32), at 15; KidSafe Seal Program (comment 81), at 6-7; Scholastic (comment 144), at 13; Toy Industry Association (comment 163), at 10; TRUSTe (comment 164), at 8; The Walt Disney Co. (comment 170), at 7; WiredSafety (comment 177), at 13.
\42\ Association for Competitive Technology (comment 5), at 5; CTIA (comment 32), at 14; Direct Marketing Association (comment 37), at 14-15; IAB (comment 73), at 4; NCTA (comment 113), at 15; Scholastic (comment 144), at 14; ; TechFreedom (comment 159), at 9-
10; Toy Industry Association (comment 163), at 7, 9; TRUSTe (comment 164), at 5; WiredTrust (comment 177), at 11.
---------------------------------------------------------------------------
In response to these concerns, the Commission is proposing revised language for the definitions regarding persistent identifiers and support for internal operations. The proposed revised language is intended to: (1) Address the concerns about the confusion caused by having two different sub-definitions dealing with persistent identifiers, paragraphs (g) and (h); and (2) provide more specificity to the types of activities that will be considered support for internal operations.
The newly proposed definition regarding persistent identifiers is:
Personal information means individually identifiable information about an individual collected online, including:
(g) A persistent identifier that can be used to recognize a user over time, or across different Web sites or online services, where such persistent identifier is used for functions other than or in addition to support for the internal operations of the Web site or online service. Such persistent identifier includes, but is not limited to, a customer number held in a cookie, an Internet Protocol (IP) address, a processor or device serial number, or unique device identifier;
* * * * *
This proposal combines the two previous definitions into one and makes clear that an operator can only identify users over time or across Web sites for the enumerated activities set forth in the definition of support for internal operations.
Page 46648
The newly proposed definition of support for internal operations is:
Support for the internal operations of the Web site or online service means those activities necessary to: (a) Maintain or analyze the functioning of the Web site or online service; (b) perform network communications; (c) authenticate users of, or personalize the content on, the Web site or online service; (d) serve contextual advertising on the Web site or online service; (e) protect the security or integrity of the user, Web site, or online service; or (f) fulfill a request of a child as permitted by '' 312.5(c)(3) and (4); so long as the information collected for the activities listed in (a)-(f) is not used or disclosed to contact a specific individual or for any other purpose.
This revision incorporates into the Rule many of the types of activities B user authentication, maintaining user preferences, serving contextual advertisements, and protecting against fraud or theft B that the Commission initially discussed as permissible in the 2011 COPPA NPRM.\43\ It would also specifically permit the collection of persistent identifiers for functions related to site maintenance and analysis, and to perform network communications, that many commenters view as crucial to their ongoing operations.\44\ The Commission notes the importance of the proviso at the end of the proposed definition: To be considered support for internal operations, none of the information collected may be used or disclosed to contact a specific individual, including through the use of behaviorally-targeted advertising, or for any other purpose.
---------------------------------------------------------------------------
\43\ See 2011 COPPA NPRM, 76 FR at 59812.
\44\ This proposed revised definition is consistent with the Commission's position in its recent privacy report that notice need not be provided to consumers regarding data practices that are sufficiently accepted or necessary for public policy reasons. See FTC, Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers, at 36, 38-40, available athttp://ftc.gov/os/2012/03/120326privacyreport.pdf.
---------------------------------------------------------------------------
-
-
-
Request for Comment
The Commission invites interested persons to submit written comments on any issue of fact, law, or policy that may bear upon the proposals under consideration. Please include explanations for any answers provided, as well as supporting evidence where appropriate. After evaluating the comments, the Commission will determine whether to issue specific amendments.
Comments should refer to ``COPPA Rule Review: FTC File No. P104503'' to facilitate the organization of comments. Please note that your comment B including your name and your state B will be placed on the public record of this proceeding, including on the publicly accessible FTC Web site, at http://www.ftc.gov/os/publiccomments.shtm. Comments must be received on or before September 10, 2012, to be considered by the Commission.
You can file a comment online or on paper. For the Commission to consider your comment, we must receive it on or before September 10, 2012. Write ``COPPA Rule Review, 16 CFR Part 312, Project No. P104503'' on your comment. Your comment B including your name and your state B will be placed on the public record of this proceeding, including, to the extent practicable, on the public Commission Web site, at http://www.ftc.gov/os/publiccomments.shtm. As a matter of discretion, the Commission tries to remove individuals' home contact information from comments before placing them on the Commission Web site.
Because your comment will be made public, you are solely responsible for making sure that your comment does not include any sensitive personal information, such as anyone's Social Security number, date of birth, driver's license number or other state identification number or foreign country equivalent, passport number, financial account number, or credit or debit card number. You are also solely responsible for making sure that your comment does not include any sensitive health information, such as medical records or other individually identifiable health information. In addition, do not include any ``trade secret or any commercial or financial information which is obtained from any person and which is privileged or confidential,'' as provided in Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2). In particular, don't include competitively sensitive information such as costs, sales statistics, inventories, formulas, patterns, devices, manufacturing processes, or customer names.
If you want the Commission to give your comment confidential treatment, you must file it in paper form, with a request for confidential treatment, and you must follow the procedure explained in FTC Rule 4.9(c), 16 CFR 4.9(c).\45\ Your comment will be kept confidential only if the FTC General Counsel, in his or her sole discretion, grants your request in accordance with the law and the public interest.
---------------------------------------------------------------------------
\45\ In particular, the written request for confidential treatment that accompanies the comment must include the factual and legal basis for the request, and must identify the specific portions of the comment to be withheld from the public record. See FTC Rule 4.9(c), 16 CFR 4.9(c).
---------------------------------------------------------------------------
Postal mail addressed to the Commission is subject to delay due to heightened security screening. As a result, we encourage you to submit your comments online. To make sure that the Commission considers your online comment, you must file it at https://ftcpublic.commentworks.com/ftc/2012copparulereview, by following the instructions on the web-based form. If this document appears at http://www.regulations.gov/#!home, you also may file a comment through that Web site.
If you file your comment on paper, write ``COPPA Rule Review, 16 CFR Part 312, Project No. P104503'' on your comment and on the envelope, and mail or deliver it to the following address: Federal Trade Commission, Office of the Secretary, Room H-113 (Annex E), 600 Pennsylvania Avenue NW., Washington, DC 20580. If possible, submit your paper comment to the Commission by courier or overnight service.
Visit the Commission Web site at http://www.ftc.gov to read this document and the news release describing it. The FTC Act and other laws that the Commission administers permit the collection of public comments to consider and use in this proceeding as appropriate. The Commission will consider all timely and responsive public comments that it receives on or before September 10, 2012.\46\ You can find more information, including routine uses permitted by the Privacy Act, in the Commission's privacy policy, at http://www.ftc.gov/ftc/privacy.htm.
---------------------------------------------------------------------------
\46\ Questions for the public regarding proposed revisions to the Rule are found at Part VII, infra.
---------------------------------------------------------------------------
Comments on any proposed recordkeeping, disclosure, or reporting requirements subject to review under the Paperwork Reduction Act should additionally be submitted to OMB. If sent by U.S. mail, they should be addressed to Office of Information and Regulatory Affairs, Office of Management and Budget, Attention: Desk Officer for the Federal Trade Commission, New Executive Office Building, Docket Library, Room 10102, 725 17th Street NW.,Washington, DC 20503. Comments sent to OMB by U.S. postal mail, however, are subject to delays due to heightened security precautions. Thus, comments instead should be sent by facsimile to (202) 395-5167.
-
Regulatory Flexibility Act
The Regulatory Flexibility Act of 1980 (``RFA''), 5 U.S.C. 601 et seq., requires
Page 46649
a description and analysis of proposed and final rules that will have significant economic impact on a substantial number of small entities. The RFA requires an agency to provide an Initial Regulatory Flexibility Analysis (``IRFA'') with the proposed Rule, and a Final Regulatory Flexibility Analysis (``FRFA''), if any, with the final Rule.\47\ The Commission is not required to make such analyses if a Rule would not have such an economic effect.\48\
---------------------------------------------------------------------------
\47\ See 5 U.S.C. 603-04.
\48\ See 5 U.S.C. 605.
---------------------------------------------------------------------------
As described below, the Commission anticipates that the proposed changes to the Rule addressed in this Revised COPPA NPRM will result in more Web sites and online services being subject to the Rule and to the Rule's disclosure, reporting, and compliance requirements. The Commission believes that a number of operators of Web sites and online services potentially affected by these revisions are small entities as defined by the RFA. It is unclear whether the Revised COPPA NPRM will have a significant economic impact on these small entities. Thus, to obtain more information about the impact of the Revised COPPA NPRM on small entities, the Commission has decided to publish the following IRFA pursuant to the RFA and to request public comment on the impact on small businesses of its Revised COPPA NPRM.
-
Description of the Reasons That Agency Action Is Being Considered
As described in Part I above, in September 2011, the Commission issued a Notice of Proposed Rulemaking setting forth proposed changes to the Commission's COPPA Rule. Among other things, the Commission proposed modifying the Rule's definitions of personal information to include persistent identifiers and screen or user names other than where they are used to support internal operations, and Web site or online service directed to children to include additional indicia that a site or service may be targeted to children. The Commission received over 350 comments on the proposed changes, a number of which addressed the proposed changes to these two definitions. After reviewing these comments, and based upon its experience in enforcing and administering the Rule, the Commission now proposes additional modifications to the definitions of personal information, support for internal operations, and Web site or online service directed to children, and also proposes to modify the definition of operator.
-
Succinct Statement of the Objectives of, and Legal Basis for, the Additional Proposed Modifications to the Rule's Definitions
The objectives of the additional proposed modifications to the Rule's definitions are to update the Rule to ensure that children's online privacy continues to be protected, as directed by Congress, even as new online technologies evolve, and to clarify existing obligations for operators under the Rule. The legal basis for the proposed amendments is the Children's Online Privacy Protection Act, 15 U.S.C. 6501 et seq.
-
Description and Estimate of the Number of Small Entities to Which the Proposed Modifications to the Rule's Definitions Will Apply
The proposed modifications to the Rule's definitions will affect operators of Web sites and online services directed to children, as well as those operators that have actual knowledge that they are collecting personal information from children. The proposed Rule amendments will impose costs on entities that are ``operators'' under the Rule.
The Commission staff is unaware of any empirical evidence concerning the number of operators subject to the Rule. However, based on the public comments received and the modifications proposed here, the Commission staff estimates that approximately 500 additional operators may newly be subject to the Rule's requirements and that there will be approximately 125 new operators per year for a prospective three-year period.
Under the Small Business Size Standards issued by the Small Business Administration, ``Internet publishing and broadcasting and web search portals'' qualify as small businesses if they have fewer than 500 employees.\49\ The Commission staff now estimates that approximately 85-90% of operators potentially subject to the Rule qualify as small entities; this projection is revised upward from the Commission's prior estimate of 80% set forth in the 2011 COPPA NPRM to take into account the growing market for mobile applications, many of which may be subject to the proposed revised Rule. The Commission staff bases this revised higher estimate on its experience in this area, which includes its law enforcement activities, discussions with industry members, privacy professionals, and advocates, and oversight of COPPA safe harbor programs. The Commission seeks comment and information with regard to the estimated number or nature of small business entities on which the proposed Rule would have a significant economic impact.
---------------------------------------------------------------------------
\49\ See U.S. Small Business Administration Table of Small Business Size Standards Matched to North American Industry Classification System Codes, available at http://www.sba.gov/sites/default/files/files/Size_Standards_Table.pdf.
---------------------------------------------------------------------------
-
Description of the Projected Reporting, Recordkeeping, and Other Compliance Requirements
The proposed amended Rule would impose reporting, recordkeeping, and other compliance requirements within the meaning of the Paperwork Reduction Act, as set forth in Part II of this Notice of Proposed Rulemaking. Therefore, the Commission is submitting the proposed revised modifications to the Rule's definitions to OMB for review before issuing a final rule.
The proposed revised modifications to the Rule's definitions likely would increase the number of operators subject to the proposed revised Rule's recordkeeping, reporting, and other compliance requirements. In particular, the proposed revised definition of operator will potentially cover additional child-directed Web sites and online services that choose to integrate other services that collect personal information from visitors. Similarly, the proposed addition of paragraph (d) to the definition of Web site or online service directed to children, which clarifies that the Rule covers a Web site or online service that knows or has reason to know it is collecting personal information through any Web site or online service directed to children, will potentially cover additional Web sites and online services. These proposed improvements to the Rule may entail some added cost burden to operators, including those that qualify as small entities. However, the proposed addition of paragraph (c) to the definition of Web site or online service directed to children, and the proposed modifications to the definitions of personal information and support for internal operations, may offset the added burdens discussed above, by potentially decreasing certain operators' recordkeeping, reporting, and other compliance requirements.
The estimated burden imposed by these proposed modifications to the Rule's definitions is discussed in the Paperwork Reduction Act section of this document, and there should be no difference in that burden as applied to small businesses. While the Rule's compliance obligations apply equally to all entities subject to the Rule, it is unclear whether the economic burden
Page 46650
on small entities will be the same as or greater than the burden on other entities. That determination would depend upon a particular entity's compliance costs, some of which may be largely fixed for all entities (e.g., Web site programming) and others that may be variable (e.g., choosing to operate a family friendly Web site or online service), and the entity's income or profit from operation of the Web site or online service (e.g., membership fees) or from related sources (e.g., revenue from marketing to children through the site or service). As explained in the Paperwork Reduction Act section, in order to comply with the Rule's requirements, operators will require the professional skills of legal (lawyers or similar professionals) and technical (e.g., computer programmers) personnel. As explained earlier, the Commission staff estimates that there are approximately 500 additional Web site or online services that would newly qualify as operators under the proposed modifications to the Rule's definitions, that there will be approximately 125 new operators per year for a three-year period, and that approximately 85-90% of all such operators would qualify as small entities under the SBA's Small Business Size standards. The Commission invites comment and information on these issues.
-
Identification of Other Duplicative, Overlapping, or Conflicting Federal Rules
The Commission has not identified any other federal statutes, rules, or policies that would duplicate, overlap, or conflict with the proposed Rule. The Commission invites comment and information on this issue.
-
Description of Any Significant Alternatives to the Proposed Modifications to the Rule's Definitions
In drafting the proposed modifications to the Rule's definitions, the Commission has attempted to avoid unduly burdensome requirements for entities. The Commission believes that the proposed modifications will advance the goal of children's online privacy in accordance with COPPA. For each of the proposed modifications, the Commission has taken into account the concerns evidenced by the record to date. On balance, the Commission believes that the benefits to children and their parents outweigh the costs of implementation to industry.
The Commission has considered, but has decided not to propose, an exemption for small businesses. The primary purpose of COPPA is to protect children's online privacy by requiring verifiable parental consent before an operator collects personal information. The record and the Commission's enforcement experience have shown that the threats to children's privacy are just as great, if not greater, from small businesses or even individuals than from large businesses.\50\ Accordingly, an exemption for small businesses would undermine the very purpose of the statute and Rule.
---------------------------------------------------------------------------
\50\ See, e.g., United States v. RockYou, Inc., No. 3:12-cv-
01487-SI (N.D. Cal., entered Mar. 27, 2012); United States v. Godwin, No. 1:11-cv-03846-JOF (N.D. Ga., entered Feb. 1, 2012); United States v. W3 Innovations, LLC, No. CV-11-03958 (N.D. Cal., filed Aug. 12, 2011); United States v. Industrious Kid, Inc., No. CV-08-0639 (N.D. Cal., filed Jan. 28, 2008); United States v. Xanga.com, Inc., No. 06-CIV-6853 (S.D.N.Y., entered Sept. 11, 2006); United States v. Bonzi Software, Inc., No. CV-04-1048 (C.D. Cal., filed Feb. 17, 2004); United States v. Looksmart, Ltd., Civil Action No. 01-605-A (E.D. Va., filed Apr. 18, 2001); United States v. Bigmailbox.Com, Inc., Civil Action No. 01-606-B (E.D. Va., filed Apr. 18, 2001).
---------------------------------------------------------------------------
While the proposed modifications to the Rule's definitions potentially will increase the number of Web site and online service operators subject to the Rule, the Rule continues to provide regulated entities with the flexibility to select the most appropriate, cost-
effective, technologies to achieve COPPA's objective results. For example, the proposed new definition of support for internal operations is intended to provide operators with the flexibility to conduct their information collections in a manner they choose consistent with ordinary operation, enhancement, or security measures. Moreover, the proposed changes to Web site or online service directed to children would provide greater flexibility to family friendly sites and services in developing mechanisms to provide the COPPA protections to child visitors.
The Commission seeks comments on ways in which the Rule could be modified to reduce any costs or burdens for small entities.
-
-
Paperwork Reduction Act
The existing Rule contains recordkeeping, disclosure, and reporting requirements that constitute ``information collection requirements'' as defined by 5 CFR 1320.3(c) under the OMB regulations that implement the Paperwork Reduction Act (``PRA''), 44 U.S.C. 3501 et seq. OMB has approved the Rule's existing information collection requirements through July 31, 2014 (OMB Control No. 3084-0117).
The proposed modifications to the Rule's definitions would change the definitions of operator and Web site or online service directed to children, potentially increasing the number of operators subject to the Rule. However, the proposed modifications to the definitions of personal information and support for internal operations may offset these added burdens by potentially decreasing certain operators' recordkeeping, reporting, and other compliance requirements. Thus, the Commission is providing PRA burden estimates for the proposed modifications, set forth below.
The Commission invites comments on: (1) Whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility; (2) the accuracy of the FTC's estimate of the burden of the proposed collection of information; (3) ways to enhance the quality, utility, and clarity of the information to be collected; and (4) ways to minimize the burden of collecting information.
Estimated Additional Annual Hours Burden
-
Number of Respondents
Commission staff estimates that there will be approximately 500 existing operators of Web sites or online services that likely will be newly covered as a result of the modifications proposed herein. This projected number is based upon the Commission staff's expectation that altering the definitions of operator and Web site or online service directed to children will expand the pool of covered operators. Other proposed modifications, however, should offset some of this potential expansion. Specifically, these offsets include clarification of the definition of support for internal operations and the carve-out from the definition of Web site or online service directed to children of family friendly sites and services that take particular measures. The Commission also anticipates that some operators of Web sites or online services will make adjustments to their information collection practices so that they will not be collecting personal information from children, as defined by the proposed revised Rule.
Further, Commission staff estimates that 125 additional new operators per year (over a prospective three-year PRA clearance period \51\) will be covered by the Rule through the proposed modifications. This is incremental to the previously cleared FTC estimates of 100 new operators per year for the current Rule.
---------------------------------------------------------------------------
\51\ Under the PRA, agencies may seek a maximum of three years' clearance for a collection of information. 44 U.S.C. 3507(g).
---------------------------------------------------------------------------
Page 46651
-
Recordkeeping Hours
The proposed modifications to the Rule's definitions will not impose incremental recordkeeping requirements on operators.
-
Disclosure Hours
(1) New Operators' Disclosure Burden
Under the existing OMB clearance for the Rule, the FTC has estimated that new operators will each spend approximately 60 hours to craft a privacy policy, design mechanisms to provide the required online privacy notice and, where applicable, direct notice to parents in order to obtain verifiable consent. Several commenters noted that this 60-hour estimate failed to take into account accurate costs of compliance with the Rule.\52\ None of these commenters, however, provided the Commission with empirical data or specific evidence on the number of hours such activities require. Thus, the Commission does not have sufficient information at present to revise its earlier hours estimate. Applying this estimate of 60 hours per new operator to the above-stated estimate of 125 new operators yields an estimated 7,500 additional disclosure hours, cumulatively.
---------------------------------------------------------------------------
\52\ See Nancy Savitt (comment 142), at 1; NCTA (comment 113), at 23-24.
---------------------------------------------------------------------------
(2) Existing Operators' Disclosure Burden
The proposed modifications to the Rule's definitions will not impose incremental disclosure time per entity, but, as noted above, would result in an estimated 500 additional existing operators that would be covered by the Rule. These entities will have a one-time burden to re-design their existing privacy policies and direct notice procedures that would not carry over to the second and third years of prospective PRA clearance. The Commission estimates that an existing operator's time to make these changes would be no more than that for a new entrant crafting its online and direct notices for the first time, i.e., 60 hours. Annualized over three years of PRA clearance, this amounts to 20 hours ((60 hours + 0 + 0) / 3) per year. Aggregated for the estimated 500 existing operators that would be newly subject to the Rule, annualized disclosure burden would be 10,000 hours.
-
Reporting Hours
The proposed modifications to the Rule's definitions will not impose incremental reporting hours requirements.
-
Labor Costs
(1) Recordkeeping
None.
(2) Disclosure
The Commission staff assumes that the time spent on compliance for new operators and existing operators that would be newly covered by the Rule's proposed modifications would be apportioned five to one between legal (lawyers or similar professionals) and technical (e.g., computer programmers, software developers, and information security analysts) personnel.\53\ Moreover, based on Bureau of Labor Statistics compiled data, FTC staff assumes for compliance cost estimates a mean hourly rate of $180 for legal assistance and $42 for technical labor support.\54\
---------------------------------------------------------------------------
\53\ See 76 FR 7211, 7212-7213 (Feb. 9, 2011); 76 FR 31334, 31335 n. 1 (May 31, 2011) (FTC notices for renewing OMB clearance for the COPPA Rule).
\54\ The estimated rate of $180 per hour is roughly midway between Bureau of Labor Statistics (BLS) mean hourly wages for lawyers ($62.74) in the most recent annual compilation available online and what Commission staff believes more generally reflects hourly attorney costs ($300) associated with Commission information collection activities. The estimate of mean hourly wages of $42 is based on an average of the salaries for computer programmers, software developers, information security analysts, and web developers as reported by the Bureau of Labor Standards. See National Occupational and Wages--May 2011, available at http://www.bls.gov/news.release/archives/ocwage_03272012.pdf.
---------------------------------------------------------------------------
Thus, for the estimated 125 additional new operators per year, 7,500 cumulative disclosure hours would be composed of 6,250 hours of legal assistance and 1,250 hours of technical support. Applied to hourly rates of $180 and respectively. $42, respectively, associated labor costs for the 125 additional new operators potentially subject to the proposed amendments would be $1,177,500.
Similarly, for the estimated 500 existing operators that would be newly covered by the proposed definitional changes, 10,000 cumulative disclosure hours would consist of 8,333 hours of legal assistance and 1,667 hours for technical support. Applied at hourly rates of $180 and $42, respectively, associated labor costs would total $1,569,954. Thus, cumulative labor costs for new and existing operators that would be additionally subject to the Rule through the proposed amendments would be $2,747,454.
(3) Reporting
None.
-
Non-Labor/Capital Costs
None.
-
-
Communications by Outside Parties to the Commissioners or Their Advisors
Written communications and summaries or transcripts of oral communications respecting the merits of this proceeding, from any outside party to any Commissioner or Commissioner's advisor, will be placed on the public record. See 16 CFR 1.26(b)(5).
-
Questions for the Proposed Revisions to the Rule
The Commission is seeking comment on various aspects of the proposed Rule, and is particularly interested in receiving comment on the questions that follow. These questions are designed to assist the public and should not be construed as a limitation on the issues on which public comment may be submitted in response to this notice. Responses to these questions should cite the numbers and subsection of the questions being answered. For all comments submitted, please submit any relevant data, statistics, or any other evidence upon which those comments are based.
Definition of On Whose Behalf Such Information Is Collected or Maintained
-
The Commission proposes to revise the definition of operator to indicate that personal information is collected or maintained on behalf of an operator where it is collected in the interest of, as a representative of, or for the benefit of, the operator.
-
Is the proposed language sufficiently clear to cover Web sites or online services where they permit the collection of personal information by parties such as advertising networks, providers of downloadable software kits, or ``social plug-ins''?
-
Do the proposed requirements of this provision provide sufficient guidance and clarity for an operator who does not otherwise collect personal information from children?
-
Is the proposed language sufficiently narrow to exclude entities that merely provide access to the Internet without providing content or collecting information from children?
-
Does the proposed language present any practical or technical challenges for implementation by the operator? If so, please describe such challenges in detail.
Definition of Web Site or Online Service Directed to Children
-
-
The Commission proposes to identify four categories of Web sites or online services directed to children (paragraphs (a)-(d)). Does the proposed revised definition adequately capture all
Page 46652
instances where a Web site or online service may be directed to children?
-
Is the newly proposed paragraph (c) within the definition of Web site or online service directed to children sufficiently clear to provide guidance to an operator as to when the operator is permitted to screen users for age and is required to comply with COPPA?
-
The Commission proposes to cover as a Web site or online service directed to children an operator who knows or has reason to know that it is collecting personal information through a child-directed site or service (paragraph (d)).
-
Is the ``knows or has reason to know'' standard appropriate in this case? Should the standard be broadened, or should it be narrowed, in any way?
-
What are the costs and benefits to operators, parents, and children of the proposed revisions?
-
Does the proposed language present any practical or technical challenges for implementation by the operator? If so, please describe such challenges in detail.
-
-
Is there currently technology in use or available that would enable Web sites or online services to publicly signal (through code or otherwise) that they are sites or services ``directed to children''? What are the costs and benefits of the voluntary use of such technology?
Definition of Personal Information
Screen or User Names
-
The Commission proposes revising the definition of personal information to include screen or user name where it functions in the same manner as online contact information, i.e., where it acts as an identifier that permits direct contact with a person online. Are there any other instances not identified by the Commission in which a screen or user name can be used to contact a specific child?
Persistent Identifiers and Support for Internal Operations
-
The Commission proposes to combine the sub-definitions of personal information in proposed paragraphs (g) and (h) covering persistent identifiers, and to broaden the definition of support for internal operations.
-
Is the proposed language sufficiently clear?
-
What are the costs and benefits to operators, parents, and children of the proposed revisions?
-
Do the proposed revisions present any practical or technical challenges for implementation by the operator? If so, please describe such challenges in detail.
Paperwork Reduction Act
-
-
The Commission solicits comments on whether the changes to the definitions (Sec. 312.2) constitute ``collections of information'' within the meaning of the Paperwork Reduction Act. The Commission requests comments that will enable it to:
-
Evaluate whether the proposed collections of information are necessary for the proper performance of the functions of the agency, including whether the information will have practical utility;
-
Evaluate the accuracy of the agency's estimate of the burden of the proposed collections of information, including the validity of the methodology and assumptions used;
-
Enhance the quality, utility, and clarity of the information to be collected; and,
-
Minimize the burden of the collections of information on those who must comply, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology.
-
-
-
Proposed Revisions to the Rule
List of Subjects in 16 CFR Part 312
Children, Communications, Consumer protection, Electronic mail, Email, Internet, Online service, Privacy, Record retention, Safety, Science and technology, Trade practices, Web site, Youth.
For the reasons discussed above, the Commission proposes to amend part 312 of Title 16, Code of Federal Regulations, as follows:
PART 312--CHILDREN'S ONLINE PRIVACY PROTECTION RULE
-
The authority citation for part 312 continues to read as follows:
Authority: 15 U.S.C. 6501-6508.
-
Amend Sec. 312.2 by revising the definitions of operator, personal information, and Web sites or online services directed to children, and by adding after the definition of personal information a new definition of support for internal operations of the Web site or online service, to read as follows:
Sec. 312.2 Definitions.
* * * * *
Operator means any person who operates a Web site located on the Internet or an online service and who collects or maintains personal information from or about the users of or visitors to such Web site or online service, or on whose behalf such information is collected or maintained, or offers products or services for sale through that Web site or online service, where such Web site or online service is operated for commercial purposes involving commerce:
(a) Among the several States or with 1 or more foreign nations;
(b) In any territory of the United States or in the District of Columbia, or between any such territory and
(1) Another such territory, or,
(2) Any State or foreign nation; or,
(c) Between the District of Columbia and any State, territory, or foreign nation. This definition does not include any nonprofit entity that would otherwise be exempt from coverage under Section 5 of the Federal Trade Commission Act (15 U.S.C. 45).
Personal information is collected or maintained on behalf of an operator where it is collected in the interest of, as a representative of, or for the benefit of, the operator.
* * * * *
Personal information means individually identifiable information about an individual collected online, including:
(a) A first and last name;
(b) A home or other physical address including street name and name of a city or town;
(c) Online contact information as defined in this Section;
(d) A screen or user name where it functions in the same manner as online contact information, as defined in this Section;
(e) A telephone number;
(f) A Social Security number;
(g) A persistent identifier that can be used to recognize a user over time, or across different Web sites or online services, where such persistent identifier is used for functions other than or in addition to support for the internal operations of the Web site or online service. Such persistent identifier includes, but is not limited to, a customer number held in a cookie, an Internet Protocol (IP) address, a processor or device serial number, or unique device identifier;
(h) A photograph, video, or audio file where such file contains a child's image or voice;
(i) Geolocation information sufficient to identify street name and name of a city or town; or,
(j) Information concerning the child or the parents of that child that the operator collects online from the child and combines with an identifier described in this definition.
Support for the internal operations of the Web site or online service means those activities necessary to: (a)
Page 46653
Maintain or analyze the functioning of the Web site or online service; (b) perform network communications; (c) authenticate users of, or personalize the content on, the Web site or online service; (d) serve contextual advertising on the Web site or online service; (e) protect the security or integrity of the user, Web site, or online service; or (f) fulfill a request of a child as permitted by Sec. Sec. 312.5(c)(3) and (4); so long as the information collected for the activities listed in (a)-(f) is not used or disclosed to contact a specific individual or for any other purpose.
* * * * *
Web site or online service directed to children means a commercial Web site or online service, or portion thereof, that:
(a) Knowingly targets children under age 13 as its primary audience; or,
(b) based on the overall content of the Web site or online service, is likely to attract children under age 13 as its primary audience; or,
(c) based on the overall content of the Web site or online service, is likely to attract an audience that includes a disproportionately large percentage of children under age 13 as compared to the percentage of such children in the general population; provided however that such Web site or online service shall not be deemed to be directed to children if it: (i) Does not collect personal information from any visitor prior to collecting age information; and (ii) prevents the collection, use, or disclosure of personal information from visitors who identify themselves as under age 13 without first obtaining verifiable parental consent; or,
(d) knows or has reason to know that it is collecting personal information through any Web site or online service covered under paragraphs (a)-(c).
In determining whether a commercial Web site or online service, or a portion thereof, is directed to children, the Commission will consider its subject matter, visual content, use of animated characters or child-oriented activities and incentives, music or other audio content, age of models, presence of child celebrities or celebrities who appeal to children, language or other characteristics of the Web site or online service, as well as whether advertising promoting or appearing on the Web site or online service is directed to children. The Commission will also consider competent and reliable empirical evidence regarding audience composition, and evidence regarding the intended audience. A commercial Web site or online service, or a portion thereof, shall not be deemed directed to children solely because it refers or links to a commercial Web site or online service directed to children by using information location tools, including a directory, index, reference, pointer, or hypertext link.
By direction of the Commission.
Donald S. Clark,
Secretary.
FR Doc. 2012-19115 Filed 8-3-12; 8:45 am
BILLING CODE 6750-01-P
-
