FTC releases child privacy protection rules

Implementing the Children's Online Privacy Protection Act passed last year by Congress, the FTC's rules go into effect April 21 of next year.

"The rule meets the mandates of the statute. It puts parents in control over the information collected from their children online and is flexible enough to accommodate the many business practices and technological changes occurring on the Internet," FTC chairman Robert Pitofsky said in a statement.

Sites targeting children under age 13, such as Kids.com or Disney's sites for children, will have to post their data-collection practices and in most cases will also have to get "verifiable parental consent," before gathering children's personal information or sharing it with a third party. Sites also will have to give parents access to their children's personal information and allow them to prevent further use of the data.

Although privacy groups have been lobbying for new legal protections for all computer users, the Clinton administration favors industry self-regulation. The most popular sites on the Net usually have privacy policies explaining what type of information they collect and how they plan to use it, but the recourse for violating voluntary principles usually involves losing an industry privacy seal or, at worst, being turned over to the FTC.

Still, the FTC's own studies show that not all sites post privacy policies or take special care when it comes to children. The FTC released a study in June of 1998 showing that 89 percent of children's sites surveyed collected personal details from youngsters, but just over half provided some disclosure of their practices. A similar university study released this May found that more than 90 percent of the posted privacy policies on the Net are inadequate.

The FTC's new children's rules, which were passed by a 4-0 vote, also put a "sliding scale" in place for the next two years that gives Web sites flexibility regarding how they obtain parental consent to collect a child's information.

For online transactions such as e-commerce, which require the collection of sensitive information, sites will have to get parents' written permission through regular mail, fax, credit card verification, a toll-free number, or email that is protected by a password to deter children from forging email from their parents.

But when it comes to harnessing information from children for marketing purposes, sites only will have to get parental permission via email.

"For internal uses of information, such as an operator's marketing back to a child based on the child's personal information, operators will be permitted to use email, as long as additional steps are taken to ensure that the parent is providing consent," the new rules state. "Such steps could include sending a confirmatory email to the parent following receipt of consent, or obtaining a postal address or telephone number from the parent and confirming the parent's consent by letter or telephone call."

The FTC said that the sliding scale method will be dissolved in April 2002 and that "more reliable" methods will be put in place "unless the commission determines more secure electronic methods of consent are not widely available."

Sites won't always have to get parental permission before collecting a child's email address or name. The rules lay out several exceptions, including when a site responds to an email question sent by a child, or when a child enters a contest or subscribes to a newsletter, for example. And sites that sign on to voluntary industry guidelines approved by the FTC will be protected from regulatory action under the rules.

For the most part, consumer advocates seemed pleased with the FTC's action.

"These rules should help guide the development of this powerful new commercial medium," Kathryn Montgomery, president of the Center for Media Education, said in a statement.

But Montgomery did warn that marketers could skirt the rules in some cases.

"We will continue to monitor online practices and report potential violations to the commission," she added.

Others want the FTC to expand the protections for all Net users.

"This is a significant milestone in progress for privacy rights online," said Jason Catlett, founder of Junkbusters, a clearinghouse for privacy-protection measures.

"I wish that they had the same position on teenagers and adults," he added. "Americans should not lose all privacy rights online the day they turn 13."