Children's Online Privacy

Co-Written By James E. Long

Enforcement Actions Commenced by FTC

On April 19, 2001, the Federal Trade Commission (FTC) charged

three Web site owners with collecting personal information from children in

violation of the Children's Online Privacy Protection Act (COPPA). The FTC also

announced that it had accepted a second "safe harbor" program, a

privately developed industry self-regulatory plan, adherence to which provides

companies the assurance they are complying with COPPA.

These actions by the FTC demonstrate that the agency will be enforcing COPPA

and underscore the importance of knowing and complying with the regulations that

implement the legislation. Internet privacy will be a significant public policy

and business issue in the coming years and many of the principles around which

COPPA has been built could become compliance essentials for all companies, not

just those that are geared toward children.

Compliance

Both general audience Web sites that collect personal information from

children and sites devoted to serving the specific needs and interests of

children may be subject to COPPA, which became effective April 21, 2000. That

Act is administered by the FTC, which has issued guidelines that apply to online

services directed to children age 13 and under in situations where personal

information is collected.

Compliance with the Children's Online Privacy Protection Act requires the following:

1. The Web site operator must post a link to a child privacy notice on

   the homepage of the Web site and each area where personal information from

   children may be collected. That link must be clear and prominent, generally

   requiring use of a larger type font size or different type color on a

   contrasting background to make it standout from other text. A link in small

   print at the bottom of a Web page may not be considered sufficient.

2. The linked notice must contain the following information:

   the name and contact information (address, telephone number and email

   address) of the operator of the site or, if more than one operator is

   collecting information from a site, contact information for all such site

   operators

   an identification of the personal information collected from children

   (e.g., name, address, email address, hobbies, etc.) and how the information

   will be collected (e.g., by direct response from the child or passively

   through cookies)

   in what manner the site operator will use the personal information (e.g.,

   only to notify contest...