Federal Register: April 22, 2005 (Volume 70, Number 77)
DOCID: FR Doc 05-8159
FEDERAL TRADE COMMISSION
CFR Citation: 16 CFR Part 312
NOTICE: Part IV
DOCUMENT ACTION: Final rule amendment.
Children's Online Privacy Protection Rule
DATES: Effective April 21, 2005.
The Federal Trade Commission (``the Commission'') issues a final amendment to the Children's Online Privacy Protection Rule (``the Rule''), to extend the sliding scale mechanism which allows Web site operators to use email, coupled with additional steps, to obtain verifiable parental consent for the collection of personal information from children for internal use by the Web site operator, until the conclusion of the Commission's proceeding to undertake a comprehensive review of the Rule. As explained in a separate document being published elsewhere in this issue of the Federal Register, the Commission is requesting additional comment on the sliding scale mechanism.
Federal Trade Commission,
FOR FURTHER INFORMATION CONTACT
Karen Muoio, (202) 326-2491, or Rona
Kelner, (202) 3262752, Federal Trade Commission, 600 Pennsylvania Avenue, NW., Mail Drop NJ3212, Washington, DC 20580.
Statement of Basis and Purpose
As part of the effort to protect children's online privacy, Congress enacted the Children's Online Privacy Protection Act of 1998 (``COPPA''), 15 U.S.C. 65016508, to prohibit unfair or deceptive acts or practices in connection with the collection, use, or disclosure of personally identifiable information from children on the Internet. On October 20, 1999, the Commission issued its final Rule implementing COPPA, which became effective on April 21, 2000.\1\ The Rule imposes certain requirements on operators of Web sites or online services directed to children under 13 years of age, and on operators of other Web sites or online services that have actual knowledge that they are collecting information from a child under 13 years of age. Among other things, the Rule requires that Web site operators obtain verifiable parental consent prior to collecting, using, or disclosing personal information from children under 13 years of age.
\1\ 64 FR 59888 (1999).
The Rule provides that ``[a]ny method to obtain verifiable parental
consent must be reasonably calculated, in light of available
technology, to ensure that the person providing consent is the child's
parent.'' \2\ Prior to issuing the Rule, the Commission studied
extensively the state of available parental consent technologies.\3\ In
July 1999, the Commission held a workshop on parental consent, which
revealed that more reliable electronic methods of verification were not
widely available and affordable.\4\ In making its initial determination
to adopt the sliding scale mechanism in 1999, the Commission balanced
the costs imposed by the method of obtaining parental consent and the
risks associated with the intended uses of information.\5\ Because of
the limited availability and affordability of the more reliable methods
of obtaining consentincluding electronic methods of verificationthe
Commission found that these methods should only be required when
obtaining consent for uses of information that posed the greatest risks
to children.\6\ Accordingly, the Commission implemented the sliding
scale, noting that it would ``provide operators with costeffective
options until more reliable electronic methods became available and
affordable, while providing parents with the means to protect their children.'' \7\
\2\ 16 CFR 312.5(b)(1).
\3\ See, e.g., public comments received on the initial 1999 rulemaking, available on the FTC's Web site at http://www.ftc.gov/privacy/comments/index.html .
\4\ See press release announcing workshop and transcript of workshop, available on the FTC's Web site at http://www.ftc.gov/privacy/chonlpritranscript.pdf. \5\ 64 FR 59901, 59902 (1999).
\7\ Id. at 59902.
Therefore, the Rule sets forth a sliding scale approach to obtaining verifiable parental consent. If the Web site operator is collecting personal information for its internal use only, the Rule allows verifiable parental consent to be obtained through the use of an email message to the parent, coupled with additional steps to provide assurances that the person providing the consent is, in fact, the parent. Such additional steps include: sending a delayed confirmatory email to the parent after receiving consent or obtaining a postal address or telephone number from the parent and confirming the parent's consent by letter or telephone call.\8\
In contrast, for uses of personal information that involve
disclosing the information to the public or third parties, the Rule
requires that Web site operators use more reliable methods of obtaining
verifiable parental consent. These methods include: using a printand
send form that can be faxed or mailed back to the Web site operator;
requiring a parent to use a credit card in connection with a
transaction; having a parent call a tollfree telephone number staffed
by trained personnel; using a digital certificate that uses public key
technology; and using email accompanied by a PIN or password obtained
through one of the above methods.\9\ As noted in the Rule's Statement
of Basis and Purpose, ``the record shows that disclosures to third
parties are among the most sensitive and potentially risky uses of children's personal information.'' \10\
\9\ 16 CFR 312.5(b)(2).
\10\ 64 FR 59899 (1999).
At the time it issued the Rule, the Commission anticipated that the
sliding scale was necessary only in the short term because more
reliable methods of obtaining verifiable parental consent would soon be
widely available and affordable.\11\ Accordingly, the sliding scale was
originally set to expire on April 21, 2002, two years after the Rule
went into effect.\12\ However, when public comment revealed that the
expected progress in available technology had not occurred, the
Commission in 2002 extended the sliding scale for an additional three years until April 21, 2005.\13\
\11\ 64 FR 59902 (1999).
\12\ 16 CFR 312.5(b)(2).
\13\ 67 FR 18818 (2002).
With the sliding scale mechanism scheduled to sunset this year, the
Commission again undertook a review of the sliding scale. On January
14, 2005, the Commission published a Notice of Proposed Rulemaking and
Request for Public Comment in the Federal Register proposing to make
the sliding scale mechanism for obtaining parental consent a permanent
feature of the Rule.\14\ The Commission noted that the expected
progress in available technology still does not appear to have
transpired. The Commission requested public comment on the proposed
amendment. It also posed several questions regarding: (1) The current
and anticipated availability and affordability of more secure
electronic mechanisms or infomediaries for obtaining parental [[Page 21105]]
consent; (2) the effect of the sliding scale mechanism on the incentive to develop and deploy more secure electronic mechanisms; (3) the effect of the sliding scale on operators' incentives to disclose children's personal information to third parties or the public; and (4) any evidence the sliding scale is being misused or not working effectively. \14\ 70 FR 2580 (2005).
The public comment period closed on February 14, 2005. The
Commission received a total of 91 comments.\15\ Those submitting
comments included: FTCapproved COPPA safe harbor programs; companies
operating Web sites or Internetrelated businesses; marketing,
advertising, media, Internetrelated, and other trade groups; privacy
related organizations; credit unions; educational organizations; and consumers.
\15\ A list of the commenters and their comments appear on the FTC's Web site at http://www.ftc.gov/os/publiccomments.htm.
The comments evidence public interest in the effectiveness of and need for the sliding scale. The Commission therefore has decided it would be beneficial to accept additional comments during the regulatory review comment period and to extend the sliding scale until it completes its review of the full Rule.
II. Regulatory Flexibility Act
The Regulatory Flexibility Act (``RFA''), 5 U.S.C. 601612, requires that the Commission provide an Initial Regulatory Flexibility Analysis (``IRFA'') with a proposed rule and a Final Regulatory Flexibility Analysis (``FRFA''), if any, with the final rule, unless the Commission certifies that the rule will not have a significant economic impact on a substantial number of small entities.\16\ \16\ 5 U.S.C. 603605.
The Commission hereby certifies that the final Rule amendment will not have a significant impact on a substantial number of small business entities. The final Rule amendment extends a sliding scale mechanism that is already in place. The final Rule amendment does not alter the status quo, and postpones the potential economic impact, if any, of the expiration of the sliding scale mechanism. Thus, the economic impact of the amendment to the Rule is expected to be comparatively minimal.
Accordingly, this document serves as notice to the Small Business
Administration of the agency's certification of no effect. Nonetheless,
the Commission has decided to publish a Final Regulatory Flexibility Analysis with this final Rule amendment.
Therefore, the Commission has prepared the following analysis: A. Need for and Objectives of the Rule Amendment
The Rule's sliding scale mechanism for obtaining parental consent
is scheduled to expire on April 21, 2005. At the time it issued the
final Rule, the Commission anticipated that the sliding scale was
necessary only in the short term because more reliable electronic
methods of obtaining verifiable parental consent would soon be widely
available at a reasonable cost. The existing record indicates that
there is public interest in the effectiveness of and need for the
sliding scale. Therefore, the Commission is amending the Rule to extend
the sliding scale mechanism for obtaining verifiable parental consent
to solicit additional data, if any are available, in the larger context of the Rule's overall effectiveness.
B. Significant Issues Raised by Public Comment, Summary of the Agency's Assessment of These Issues, and Changes, if Any, Made in Response to Such Comments
The Commission received few comments in response to its IRFA. These
commenters noted that the amendment to make permanent the sliding scale
mechanism for obtaining verifiable parental consent would be beneficial
to small businesses.\17\ The sliding scale allows commercial operators
of Web sites and online services who collect personal information from
children for internal uses only to obtain verifiable parental consent
through the use of email, coupled with additional steps, instead of
having to use the more reliable (and more costly) methods required when
information will be disclosed to third parties or the public.
Commenters noted that small businesses benefit by having this cost
effective option.\18\ Commenters also noted that allowing the sliding
scale to sunset after companies have made investments to implement this
mechanism would pose financial burdens and have negative consequences
that would especially harm small businesses.\19\ The Commission agrees
that continuing the use of the sliding scale mechanism may be beneficial to small businesses.
\17\ Children's Advertising Review Unit (``CARU'') at 2; Mattel, Inc. at 1; Motion Picture Association of America (``MPAA'') at 34; Software and Information Industry Association (``SIIA'') at 3. \18\ CARU at 2; IT Law Group at 1; Mattel at 1.
\19\ IT Law Group at 1; MPAA at 34; SIIA at 3.
C. Description and Estimate of Number of Small Entities Subject to the Rule Amendment or Explanation of Why No Estimate Is Available
As described above, the Rule amendment applies to any commercial operator of a Web site or online service, including operators who are small entities, who collects personal information from children for internal uses only. The Commission is unable to ascertain a precise estimate of the number of small entities that are affected by the amendment and received no specific comments to the IRFA that allow it to estimate the number of small entities that will be affected. D. Description of the Projected Reporting, Recordkeeping, and Other Compliance Requirements of the Rule Amendment, Including an Estimate of the Classes of Small Entities That Will Be Subject to the Rule Amendment and the Type of Professional Skills That Will Be Necessary To Comply
The Rule does not directly impose any ``reporting'' or
``recordkeeping'' requirements within the meaning of the Paperwork
Reduction Act, but does require that operators make certain thirdparty
disclosures to the public, i.e., provide parents with notice of their
information practices. The final Rule amendment to extend the sliding
scale mechanism for obtaining parental consent does not impose any
additional reporting or recordkeeping requirements. The Rule does
contain certain compliance requirements, including the requirement to
obtain verifiable parental consent to collect personal information from
children. This obligation does not require operators to file reports or
maintain records within the meaning of the Paperwork Reduction Act,
although the Commission recognizes that there are potential compliance
costs associated with this requirement. For example, an employee may be
needed to review parental responses to the operator's requests for
consent. The Commission has not previously determined the estimated
costs of complying with this obligation in terms of burden hours, and
did not receive any quantitative data in this rulemaking to determine
what these costs might be. Importantly, however, the final Rule
amendment does not impose any additional compliance costs, as it is
merely extending a sliding scale mechanism that has been in place since
the Rule went into effect. If anything, the final Rule amendment may
reduce costs of complying because it allows qualified Web site operators, including small entities, to obtain
parental consent through lowercost emailbased means.
E. Steps the Agency Has Taken To Minimize Any Significant Economic Impact on Small Entities, Consistent With the Stated Objectives of the Applicable Statutes, Including the Factual, Policy, and Legal Reasons for Selecting the Alternative(s) Finally Adopted, and Why Each of the Significant Alternatives, If Any, Was Rejected
The Commission has determined that the Rule amendment, which maintains the status quo, will not have a significant economic impact on small entities. If anything, the final Rule amendment benefits small entities in that it continues to permit qualified Web site operators, including small entities, to obtain parental consent through lowercost emailbased means. One alternative to the final Rule amendment that was considered and rejected was allowing the sliding scale mechanism to sunset as scheduled on April 21, 2005. This alternative likely would be more burdensome for small entities. If the sliding scale were to expire on April 21, 2005, small businesses currently using this mechanism would have to revise their parental consent procedures to adopt one of the more costly means of obtaining parental consentsuch as using a print and send form, processing a credit card transaction, or using a tollfree telephone number staffed by trained personnelor cease their online offerings to children altogether. Accordingly, the Commission has determined that extending the sliding scale pending further review is appropriate.
Therefore, to the extent that small entities are affected by the
Rule amendment, the Commission believes the public comments support its
determination that the adoption of the Rule amendment will not impose
more significant or costly compliance requirements on Web site
operators than the Rule would otherwise impose if it were not amended.
By adopting a final Rule amendment that extends currently effective
compliance options, the Commission is preserving the status quo for all
Web site operators, including any small entities, until the Commission
completes its review of the full Rule. Thus, the change, if any, in the
economic impact of the Rule resulting from the final Rule amendment,
will be less than if the Commission did not amend the Rule and the more
burdensome requirements of the Rule as originally promulgated were
allowed to take effect. Accordingly, for these reasons, the Commission
certifies under the Regulatory Flexibility Act that the final Rule
amendment will not have a significant economic impact on a substantial
number of small entities.\20\ This notice also serves as the required
certification and statement of the Commission's determination to the Small Business Administration.
\20\ 5 U.S.C. 605.
III. Paperwork Reduction Act
This final Rule amendment does not change any information
collection requirements that have previously been reviewed and approved
by the Office of Management and Budget pursuant to the Paperwork Reduction Act, as amended.\21\
\21\ 44 U.S.C. 35013520.
List of Subjects in 16 CFR Part 312
Children, Communications, Consumer protection, Electronic mail, E
mail, Internet, Online service, Privacy, Record retention, Safety, Science and technology, Trade practices, Web site, Youth.
Accordingly, the Federal Trade Commission amends 16 CFR part 312 as follows:
PART 312CHILDREN'S ONLINE PRIVACY PROTECTION RULE
1. Revise the authority citation for part 312 to read as follows:
Authority: 15 U.S.C. 65016508.
2. Amend Sec. 312.5 by revising the second sentence of paragraph (b)(2) to read as follows:
Sec. 312.5 Parental consent.
* * * * *
(b) * * *
(2) * * * Provided that: Until the Commission otherwise determines, methods to obtain verifiable parental consent for uses of information other than the ``disclosures'' defined by Sec. 312.2 may also include use of email coupled with additional steps to provide assurances that the person providing the consent is the parent. * * *
* * * * *
By direction of the Commission, Commissioner Leibowitz not participating.
Donald S. Clark,
[FR Doc. 058159 Filed 42105; 8:45 am]
BILLING CODE 675001P