Tag Archives: Children’s Online Privacy Protection Act

About 4371 days ago Computer Security

Protecting Against Privacy Problems

If e-commerce firms fail to consider issues regarding privacy, they may create an environment ripe for legislative encroachment, future Federal Trade Commission (“FTC”) actions and class action lawsuits. Privacy breaches pertain to a wide range of information collected by Web sites, from addresses, telephone numbers, email addresses and text entries to specific user interests found in registrations and mailing lists. This kind of information is called personally identifiable information (“PII”). In June 1998, the FTC submitted a report to Congress regarding online privacy. This report highlighted five key principles which the FTC recommends e-commerce sites employ in order to promote consumer privacy: Notice. Web firms should give consumers notice of any PII collection practices prior to actual collection, including, among other things, all parties involved in collecting, archiving or receiving PII. Choice. Consumers must first consent to uses of their PII. Such consent should be clear, easily available and sufficiently explanatory. “Choice” requires Web firms to provide either an “Opt-in” (consumers must click to provide their consent) or “Opt-out” method (consumers are presumed to consent unless they indicate otherwise). Access. Consumers must have a right to access their PII and correct errors and omissions. Security. Web firms should have reasonable protections to prevent corruption of and inappropriate access to PII. Enforcement. The FTC contended that enforcement mechanisms should be put into place for privacy regulations, but did not offer firm recommendations. The FTC looks favorably upon Web sites that meet trade association requirements for privacy protection. The principles illustrate the need for all Web sites collecting PII to post and maintain a clearly displayed privacy policy. Those sites that fail to do so risk, in certain circumstances, the prospect of an action by the FTC for unfair and deceptive trade practices. The FTC may sue an e-commerce firm for engaging in a deceptive trade practice if that firm violates its own privacy policy. For instance, the FTC settled a complaint against Geocities Corporation, an Internet service provider and Web hosting entity, regarding its PII collection practices. The complaint stated that Geocities violated its agreement with its users to not share any consumer information without their consent. The FTC also settled a case in May 1999 against Liberty Financial Companies, Inc., in which the FTC accused the company of falsely representing on its Web site that PII collected from children would be maintained anonymously. Today, Liberty’s actions might have also violated the Children’s Online Privacy Protection Act (“COPPA”) and the FTC’s associated regulations, which apply to Web sites geared towards children or sites that have actual knowledge of their collection of children’s PII. Under COPPA, the FTC developed a rule which mandates, among other requirements, detailed notice of PII collection and verifiable parental consent prior to disclosures, parental bans on further collection and dissemination, disclosure limits tied to a child’s participation in games and prize offers, and security procedures holding children’s information confidential. E-commerce firms offering financial services should also ensure compliance with the Gramm-Leach-Bliley Financial Modernization Act, which also imposes substantial privacy responsibilities. More recently, in the summer of 2000 the FTC settled separate charges against Toysmart.com and several online pharmacies. Toysmart.com had attempted to sell PII after it filed for bankruptcy despite the fact that Toysmart.com stated in its privacy policy that it would not do so. The charges against the online pharmacies involved, among other allegations, the sharing of PII and associated medical data with third parties. Sharing such data also implicates the Health Insurance Portability and Accountability Act of 1996, which imposes substantial restrictions and penalties regarding the use of medical data. One avenue often ignored by Web sites that can lead to liability involves advertising. Many Web sites do not realize that when they contract with a third party agency to manage Web site traffic and advertising, that agency’s ability to collect PII on the site can lead to violations of that site’s privacy policy. Ultimately, if Web firms do not take substantial steps to prevent consumer abuses stemming from their commercial practices, they face the specter of FTC complaints and class action lawsuits. Importantly, a number of steps can be taken to reduce the risk that these events will occur, including adherence to a well-drafted privacy policy and clear agreements between Web firms and agencies governing the use of collected data. This article, which may be considered advertising in certain jurisdictions, does not purport to give legal advice pertaining to any particular situation and creates no attorney-client relationship. Readers should seek professional legal advice concerning any particular situation they face. Jason Mark Anderman practices in Goodwin Procter’ s Intellectual Property/Technology Practice Area. He can be reached at janderman@goodwinprocter.com. Copyright © 2001 Goodwin Procter LLP. All Rights Reserved.

About 4828 days ago Data Security

Fair Play?

Come April 21, Zeeks.com will face a new challenge — as if constantly coming up with “kewl” features for its ever-changing young audience wasn’t hard enough. As of that date, the one-and-a-half-year-old Internet playground and search engine for kids ages 6 to 13 will have to comply with the Children’s Online Privacy Protection Act (COPPA). COPPA, which emerged in response to widespread concern about the unregulated online collection of information from children, requires that commercial Web sites catering to the under-13 crowd obtain “verifiable parental consent” before collecting any information that could be used to identify or contact their preteen users. That includes the child’s name, telephone number, and E-mail and street addresses. While COPPA imposes the same requirements on all kid-oriented sites, two factors make the burden especially hard for smaller businesses to bear. One is cost. For instance, if Zeeks.com adds 1,000 members a day, the company would be looking at a compliance cost of at least $240,000 a year, including the tab for records storage and for five new employees, says cofounder Steven Bryan. But a larger problem is the potential loss of traffic. Once parents start receiving those permission requests, says Bryan, familiar brands like Disney will have an advantage over relative unknowns. That could spell trouble for sites that, like Zeeks.com, rely primarily on advertising revenues to stay afloat. Compounding the problem is the fact that some kids may choose to evade the consent process by heading for sites designed for teens or adults. Jorian Clarke, founder of Milwaukee-based KidsCom.com, a five-year-old online activities center for kids, dubs the dynamic the “peas and ice cream factor.” “If everything on a site becomes peas,” she explains, “kids are going to be looking elsewhere for the kind of content that meets their dessert needs.” Clarke worries that COPPA, which layers on extra costs, will help transform the Net into a playing field where only the large can compete. But others take a more optimistic view. Elizabeth Lascoutx, who directs the Children’s Advertising Review Unit at the Council of Better Business Bureaus, believes that the cost of complying with COPPA will soon decline. “I don’t think COPPA will have an enormous impact on the industry,” she says, “except for increasing parents’ comfort level with letting their kids surf the Web.” In fact, Bryan, who like Clarke supports COPPA’s goals, even sees a bright spot in the law. COPPA allows sites to retain information collected before April 2000 without obtaining parental consent. But Zeeks.com’s new competitors will have to comply with COPPA from day one. With 250,000 registered members as of January, Bryan observes, “I now have a position that is going to be very, very hard for a start-up to match.” Getting into the Act If your business must comply with COPPA, consider these tips from Toby Levin, team leader for Internet advertising at the Federal Trade Commission: Decide whether you need identifying information at all. There are lots of ways to provide content that don’t require you to collect information. For example, if you want your site to offer kids a personalized greeting, use screen names, not real ones. Take a look at the exceptions to the consent rule. For example, you can collect a child’s E-mail address in order to respond to a onetime request. If you delete the address after responding, you won’t trigger the other requirements of the rule. Consider methods other than print-and-send for collecting information, such as toll-free numbers, credit-card verification, or E-mail accompanied by a digital signature. For more information, visit www.ftc.gov or E-mail kidsprivacy@ftc.gov.