Children, Privacy and the Internet

1. Children, Privacy and the Internet

2. Why do we need special protection for children?

3. 1. Children are using technology with increasing frequency • According to a 2001 study by the U.S. Department of Education • 90% of children and adolescents ages 5-17 use computers (47 million) • 59% of children and adolescents ages 5-17 use the internet (31 million)

4. 2. Use begins at an early age • 25% of five-year-olds use the internet • By age nine, usage increases to 50% • At ages 15-17, usage is over 75%

5. 3. Children are an attractive segment for marketers • Children spend billions of dollars a year and influence the expenditure of billions more • It is estimated that in 1997 • children aged 4 though 12 spent $24.4 billion themselves • Children aged 2 through 14 directly influenced spending by their parents of as much as $188 billion

6. One of the most attractive age groups is the “tweens” • Approximately 8-12 years old • 30 million tweens in the US in 2003 • Double the number 10 years ago • Spend $10 billion annually • Influence an additional $74 billion in family spending • More than 50% of tweens use the internet

7. Commercial websites collect personal information from children • FTC survey of 212 commercial web sites in 1998 found that almost 90% of children’s sites collected personal information • Means used to collect this information include: • Registration pages • User surveys • Online contests • Electronic pen pal programs • Guest books • Application forms • Chat rooms

8. In the real world, such information would ordinarily be solicited from young children only with parental involvement • However, of the sites visited by the FTC • Only 23% even told children to seek parental permission before providing personal information • 7% said they would notify parents of their information practices • 1% obtained parental permission prior to collecting such information

9. Some of the information might have serious consequences for financial and personal security • One child-directed site identified by the FTC asked for the following information: • Full name, postal address, e-mail, gender, and age • Whether the child had received gifts in the form of stocks, cash, savings bonds, mutual funds, or CDs • Who had given these gifts • Whether the child had purchased mutual funds, stocks or bonds with monetary gifts • Whether the child’s parents owned mutual funds

10. Children surfing the internet have experienced problems such as • Attempted password theft • Inappropriate advances by adults in children’s chat rooms • According to the FBI, online services and bulletin boards are becoming the most prevalent sources used by pedophiles and other sexual predators to identify contact children

11. Industry self-regulation did not work • In 1997, the Children’s Advertising Review Unit (CARU) of the BBB developed guidelines addressing online collection of personal information from children • The Direct Marketing Association (DMA) proposed guidelines urging web sites to provide notice to parents and obtain parental consent before collecting and using children’s personal information • However, the FTC’s survey indicated that the vast majority of child-oriented commercial sites did not implement these protections

12. FTC brought its first case internet privacy case against GeoCities, one of the most popular sites on the web • FTC charged that Geocities had • Disclosed identifying information collected via its member registration application to third parties who used it to target members, including children, for solicitations beyond those that members had agreed to receive • Promoted children’s activities that solicited personal identifying information from children in a manner that suggested that it was collecting the information, when in fact the information was going directly to third parties

13. FTC concluded that passage of a comprehensive statute was preferable to bringing individual cases • Supported COPPA because it places parents in control of the online collection and use of personal information from their children

14. Who is covered by COPPA? • COPPA applies to • operators of commercial websites and online services directed to children under 13 that collect personal information from children • operators of general audience sites with actual knowledge that they are collecting information from children under 13

15. What are the requirements of COPPA? • post clear and comprehensive Privacy Policies on the website describing their information practices for personal information • provide notice to parents, and with limited exceptions, obtain verifiable parental consent before collecting personal information from children • give parents the choice to consent to the operator's collection and use of a child's information while prohibiting the operator from disclosing that information to third parties • provide parents access to their child's personal information to review and/or have it deleted • give parents the opportunity to prevent further collection or use of the information • maintain the confidentiality, security, and integrity of information they collect from children

16. The Rule also prohibits operators from conditioning a child's participation in an online activity on the child's providing more information than is reasonably necessary to participate in that activity

17. What determines whether a website is directed to children? The FTC considers a number of factors: • subject matter • language • use of animated characters • whether advertising appearing on the site is directed to children • empirical evidence regarding the ages of the site's visitors

18. Why does COPPA apply only to children under 13? What about the privacy of teens? • young children may not understand the safety and privacy issues created by the online collection of personal information, and are therefore particularly vulnerable • age 13 has often been the standard for distinguishing adolescents from young children who may need special protections • the FTC encourages operators to afford teens privacy protections, given the risks inherent in the disclosure of personal information for all ages

19. Will COPPA keep children from accessing pornography? • COPPA is meant to give parents control over the collection of their children's personal information • it does not limit children's access to information publicly available on the Internet. • COPPA may help keep a child off email lists • COPA (Child Online Protection Act of 1998) was intended to regulate the content of information available on the internet • prohibited publishing material that is "harmful to minors" • COPA has been declared unconstitutional by federal courts

20. Do websites set up and run abroad have to comply with the Rule? Foreign-run websites must comply with COPPA • if they are directed to children in the U.S. • if they knowingly collect information from children in the U.S.

21. FTC enforcement of COPPA

22. 2001 compliance survey • FTC reviewed information collection practices of 144 children’s web sites • Found much progress had been made since 1998 survey • 90% of sites that collected information had privacy policies • Up from 23% in 1998 • But many sites were still not in full compliance • About half the sites complied with notice requirements such as • informing parents of their right to review information collected from their child, have it deleted and to refuse to allow further collection

23. Education and warnings • To improve compliance, FTC published a booklet to assist operators of children’s web sites entitled “You, Your Privacy Policy and COPPA” • Sent warning letters to more than 50 web site operators identified through the 2001 survey

24. FTC legal actions under COPPA • 2002 settled case against Ohio Art Company, manufacturer of Etch-A-Sketch • Collected personal information from children registering for “Etchy’s Birthday Club” • Site directed children to “get your parent or guardian’s permission first” but collected information without obtaining parental consent first • Collected more information than was necessary to participate in the “birthday club” activity • Site also failed to provide parents the opportunity to review personal information collected from their children

25. 2003 settled case with Mrs. Fields’ Cookies • Mrsfields.com • Pretzeltime.com • Pretzelmaker.com • Sites offered birthday clubs to children 12 and under • Provided birthday greetings and coupons for free cookies and pretzels • Collected personal information from over 84,000 children • full name • address • e-mail address • birth date • without obtaining parental consent first

26. 2003 settled case with Hershey Foods • Hershey operates over 30 websites • Many candy-related and directed to children • Method of obtaining parental permission was online parental consent form • FTC alleged that Hershey • Made no effort to ensure that a parent or guardian saw or filled out the form • Collected information even if the form was not completed • First case to challenge the method of obtaining parental consent