Children's Online Privacy Protection Rule

Federal RegisterJan 17, 2013

Ask Donna

What actually matters in this document.

Text

FEDERAL TRADE COMMISSION

16 CFR Part 312

RIN 3084-AB20

Children's Online Privacy Protection Rule

AGENCY:

Federal Trade Commission (“FTC” or “Commission”).

ACTION:

Final rule amendments.

SUMMARY:

The Commission amends the Children's Online Privacy Protection Rule (“COPPA Rule” or “Rule”), consistent with the requirements of the Children's Online Privacy Protection Act, to clarify the scope of the Rule and strengthen its protections for children's personal information, in light of changes in online technology since the Rule went into effect in April 2000. The final amended Rule includes modifications to the definitions of

operator, personal information,

and

Web site or online service directed to children.

The amended Rule also updates the requirements set forth in the notice, parental consent, confidentiality and security, and safe harbor provisions, and adds a new provision addressing data retention and deletion.

DATES:

The amended Rule will become effective on July 1, 2013.

ADDRESSES:

The complete public record of this proceeding will be available at

www.ftc.gov.

Requests for paper copies of this amended Rule and Statement of Basis and Purpose (“SBP”) should be sent to: Public Reference Branch, Federal Trade Commission, 600 Pennsylvania Avenue NW., Room 130, Washington, DC 20580.

FOR FURTHER INFORMATION CONTACT:

Phyllis H. Marcus or Mamie Kresses, Attorneys, Division of Advertising Practices, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW., Washington, DC 20580, (202) 326-2854 or (202) 326-2070.

SUPPLEMENTARY INFORMATION:

Statement of Basis and Purpose

I. Overview and Background

A. Overview

This document states the basis and purpose for the Commission's decision to adopt certain amendments to the COPPA Rule that were proposed and published for public comment on September 27, 2011 (“2011 NPRM”),

and supplemental amendments that were proposed and published for public comment on August 6, 2012 (“2012 SNPRM”).

After careful review and consideration of the entire rulemaking record, including public comments submitted by interested parties, and based upon its experience in enforcing and administering the Rule, the Commission has determined to adopt amendments to the COPPA Rule. These amendments to the final Rule will help to ensure that COPPA continues to meet its originally stated goals to minimize the collection of personal information from children and create a safer, more secure online experience for them, even as online technologies, and children's uses of such technologies, evolve.

2011 NPRM, 76 FR 59804,

available at http://ftc.gov/os/2011/09/110915coppa.pdf.

2012 SNPRM, 77 FR 46643,

available at http://ftc.gov/os/2012/08/120801copparule.pdf.

The final Rule amendments modify the definitions of

operator

to make clear that the Rule covers an operator of a child-directed site or service where it integrates outside services, such as plug-ins or advertising networks, that collect personal information from its visitors;

Web site or online service directed to children

to clarify that the Rule covers a plug-in or ad network when it has actual knowledge that it is collecting personal information through a child-directed Web site or online service;

Web site or online service directed to children

to allow a subset of child-directed sites and services to differentiate among users, and requiring such properties to provide notice and obtain parental consent only for users who self-identify as under age 13;

personal information

to include geolocation information and persistent identifiers that can be used to recognize a user over time and across different Web sites or online services; and

support for internal operations

to expand the list of defined activities.

The Rule amendments also streamline and clarify the direct notice requirements to ensure that key information is presented to parents in a succinct “just-in-time” notice; expand the non-exhaustive list of acceptable methods for obtaining prior verifiable parental consent; create three new exceptions to the Rule's notice and consent requirements; strengthen data security protections by requiring operators to take reasonable steps to release children's personal information only to service providers and third parties who are capable of maintaining the confidentiality, security, and integrity of such information; require reasonable data retention and deletion procedures; strengthen the Commission's oversight of self-regulatory safe harbor programs; and institute voluntary pre-approval mechanisms for new consent methods and for activities that support the internal operations of a Web site or online service.

B. Background

The COPPA Rule, 16 CFR part 312, issued pursuant to the Children's Online Privacy Protection Act (“COPPA” or “COPPA statute”), 15 U.S.C. 6501

et seq.,

became effective on April 21, 2000. The Rule imposes certain requirements on operators of Web sites or online services directed to children under 13 years of age, and on operators of other Web sites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age (collectively, “operators”). Among other things, the Rule requires that operators provide notice to parents and obtain verifiable parental consent prior to collecting, using, or disclosing personal information from children under 13 years of age.

The Rule also requires operators to keep secure the information they collect from children, and prohibits them from conditioning children's participation in activities on the collection of more personal information than is reasonably necessary to participate in such activities.

The Rule contains a “safe harbor” provision enabling industry groups or others to submit to the Commission for approval self-regulatory guidelines that would implement the Rule's protections.

See

16 CFR 312.3.

See

16 CFR 312.7 and 312.8.

See

16 CFR 312.10.

The Commission initiated review of the COPPA Rule in April 2010 when it published a document in the

Federal Register

seeking public comment on whether the rapid-fire pace of technological changes to the online environment over the preceding five years warranted any changes to the Rule.

The Commission's request for public comment examined each aspect of the COPPA Rule, posing 28 questions for the public's consideration.

The Commission also held a public roundtable to discuss in detail several of the areas where public comment was sought.

See

Request for Public Comment on the Federal Trade Commission's Implementation of the Children's Online Privacy Protection Rule (“2010 FRN”), 75 FR 17089 (Apr. 5, 2010).

Id.

Information about the June 2010 public roundtable is located at

http://www.ftc.gov/bcp/workshops/coppa/index.shtml.

The Commission received 70 comments from industry representatives, advocacy groups, academics, technologists, and

individual members of the public in response to the April 5, 2010 request for public comment.

After reviewing the comments, the Commission issued the 2011 NPRM, which set forth several proposed changes to the COPPA Rule.

The Commission received over 350 comments in response to the 2011 NPRM.

After reviewing these comments, and based upon its experience in enforcing and administering the Rule, in the 2012 SNPRM, the Commission sought additional public comment on a second set of proposed modifications to the Rule.

Public comments in response to the Commission's 2010 FRN are located at

http://www.ftc.gov/os/comments/copparulerev2010/index.shtm.

Comments cited herein to the

Federal Register

Notice are designated as such, and are identified by commenter name, comment number, and, where applicable, page number.

See supra

note 1.

Public comments in response to the 2011 NPRM are located at

http://www.ftc.gov/os/comments/copparulereview2011/.

Comments cited herein to the 2011 NPRM are designated as such, and are identified by commenter name, comment number, and, where applicable, page number.

The 2012 SNPRM proposed modifying the definitions of both

operator

and

Web site or online service directed to children

to allocate and clarify the responsibilities under COPPA when independent entities or third parties,

e.g.,

advertising networks or downloadable software kits (“plug-ins”), collect information from users through child-directed sites and services. In addition, the 2012 SNPRM proposed to further modify the definition of

Web site or online service directed to children

to permit Web sites or online services that are directed both to children and to a broader audience to comply with COPPA without treating all users as children. The Commission also proposed modifying the definition of

screen or user name

to cover only those situations where a screen or user name functions in the same manner as

online contact information.

Finally, the Commission proposed to further modify the revised definitions of

support for internal operations

and

persistent identifiers.

The Commission received 99 comments in response to the 2012 SNPRM.

After reviewing these additional comments, the Commission now announces this final amended COPPA Rule.

Public comments in response to the 2012 SNPRM are available online at

http://ftc.gov/os/comments/copparulereview2012/index.shtm.

Comments cited herein to the SNPRM are designated as such, and are identified by commenter name, comment number, and, where applicable, page number.

II. Modifications to the Rule

A. Section 312.2: Definitions

1. Definition of Collects or Collection

a. Collects or Collection, Paragraph (1)

In the 2011 NPRM, the Commission proposed amending paragraph (1) to change the phrase “requesting that children submit personal information online” to “requesting, prompting, or encouraging a child to submit personal information online.” The proposal was to clarify that the Rule covers the online collection of personal information both when an operator requires it to participate in an online activity, and when an operator merely prompts or encourages a child to provide such information.

The comments received divided roughly equally between support of and opposition to the proposed change to paragraph (1). Those in favor cited the increased clarity of the revised language as compared to the existing language.

One commenter, Go Daddy, expressed concern that the definition of

collects or collection

is silent as to personal information acquired from children offline that is uploaded, stored, or distributed to third parties by operators. Go Daddy (comment 59, 2011 NPRM), at 2. However, Congress limited the scope of COPPA to information that an operator collects

online

from a child; COPPA does not govern information collected by an operator offline.

See

15 U.S.C. 6501(8) (defining the personal information as “individually identifiable information about an individual collected online * * *.”); 144 Cong. Rec. S11657 (Oct. 7, 1998) (Statement of Sen. Bryan) (“This is an online children's privacy bill, and its reach is limited to information collected online from a child.”).

See

Institute for Public Representation (comment 71, 2011 NPRM), at 19; kidSAFE Seal Program (comment 81, 2011 NPRM), at 5; Alexandra Lang (comment 87, 2011 NPRM), at 1.

Several commenters opposed the revised language of paragraph (1). For example, the National Cable and Telecommunications Association (“NCTA”) expressed concern that the revised language suggests that “COPPA obligations are triggered even without the actual or intended collection of personal information.”

NCTA asked the Commission to clarify that “prompting” or “encouraging” does not trigger COPPA unless an operator

actually

collects personal information from a child.

NCTA (comment 113, 2011 NPRM), at 17-18.

Id.

The Rule defines

collection

as “the gathering of any personal information from a child by any means,” and the terms “prompting” and “encouraging” are merely exemplars of the means by which an operator gathers personal information from a child.

This change to the definition of

collects or collection

is intended to clarify the longstanding Commission position that an operator that provides a field or open forum for a child to enter personal information will not be shielded from liability merely because entry of personal information is not mandatory to participate in the activity. It recognizes the reality that such an operator must have in place a system to provide notice to and obtain consent from parents to deal with the moment when the information is “gathered.”

Otherwise, once the child posts the personal information, it will be too late to obtain parental consent.

See

16 CFR 312.2: “

Collects

collection

means the gathering of any personal information from a child by any means, including but not limited to * * * ”

Several other commenters raised concern that the language “prompting, or encouraging” could make sites or services that post third-party “Like” or “Tweet This” buttons subject to COPPA.

See

Association for Competitive Technology (comment 5, 2011 NPRM), at 6; Direct Marketing Association (“DMA”) (comment 37, 2011 NPRM), at 6;

see also

American Association of Advertising Agencies (comment 2, 2011 NPRM), at 2-3; Interactive Advertising Bureau (“IAB”) (comment 73, 2011 NPRM), at 12. The collection of personal information by plug-ins on child-directed sites is addressed fully in the discussion regarding changes to the definition of

operator. See

Part II.A.4.a.,

infra.

After reviewing the comments, the Commission has decided to modify paragraph (1) of the definition of

collects or collection

as proposed in the 2011 NPRM.

b. Collects or Collection, Paragraph (2)

Section 312.2(b) of the Rule defines “collects or collection” to cover enabling children to publicly post personal information (

e.g.,

on social networking sites or on blogs), “except where the operator deletes

all

individually identifiable information from postings by children before they are made public, and also deletes such information from the operator's records.”

This exception, often referred to as the “100% deletion standard,” was designed to enable sites and services to make interactive content available to children, without providing parental notice and obtaining consent, provided that all personal information was deleted prior to posting.

Under the Rule, operators who offered services such as social networking, chat, and bulletin boards and who did not pre-strip (

i.e.,

completely delete) such information were deemed to have “disclosed” personal information under COPPA's definition of

disclosure. See

16 CFR 312.2.

See

P. Marcus, Remarks from

COPPA's Exceptions to Parental Consent

Panel at the Federal Trade Commission's Roundtable: Protecting Kids' Privacy Online 310 (June 2, 2010),

available at http://www.ftc.gov/bcp/workshops/coppa/COPPARuleReview_Transcript.pdf.

The 2010 FRN sought comment on whether to change the 100% deletion standard, whether automated systems used to review and post child content could meet this standard, and whether

the Commission had provided sufficient guidance on the deletion of personal information.

In response, several commenters urged a new standard, arguing that the 100% deletion standard, while well-intentioned, was an impediment to operators' implementation of sophisticated automated filtering technologies that may actually aid in the detection and removal of personal information.

See

75 FR at 17090, Question 9.

See

Entertainment Software Association (“ESA”) (comment 20, 2010 FRN), at 13-14; R. Newton (comment 46, 2010 FRN), at 4; Privo, Inc. (comment 50, 2010 FRN), at 5; B. Szoka (comment 59, 2010 FRN), at 19;

see also

Wired Safety (comment 68, 2010 FRN), at 15.

In the 2011 NPRM, the Commission stated that the 100% deletion standard set an unrealistic hurdle to operators' implementation of automated filtering systems that could promote engaging and appropriate online content for children, while ensuring strong privacy protections by design. To address this, the Commission proposed replacing the 100% deletion standard with a “reasonable measures” standard. Under this approach, an operator would not be deemed to have collected personal information if it takes reasonable measures to delete all or virtually all personal information from a child's postings before they are made public, and also to delete such information from its records.”

See

76 FR at 59808.

Although the Institute for Public Representation raised concerns about the effectiveness of automated filtering techniques,

most comments were resoundingly in favor of the “reasonable measures” standard. For example, one commenter stated that the revised language would enable the use of automated procedures that could provide “increased consistency and more effective monitoring than human monitors,”

while another noted that it would open the door to “cost-efficient and reliable means of monitoring children's communications.”

Several commenters noted that the proposed reasonable measures standard would likely encourage the creation of more rich, interactive online content for children.

Another commenter noted that the revised provision, by offering greater flexibility for technological solutions, should help minimize the burden of COPPA on children's free expression.

See

Institute for Public Representation (comment 71, 2011 NPRM), at 19.

See

NCTA (comment 113, 2011 NPRM), at 8.

DMA (comment 37, 2011 NPRM), at 7.

See

DMA

id.;

Institute for Public Representation (comment 71, 2011 NPRM), at 3; kidSAFE Seal Program (comment 81, 2011 NPRM), at 5; NCTA (comment 113, 2011 NPRM), at 8; Toy Industry Association (comment 163, 2011 NPRM), at 8.

See

TechFreedom (comment 159, 2011 NPRM), at 6.

The Commission is persuaded that the 100% deletion standard should be replaced with a reasonable measures standard. The reasonable measures standard strikes the right balance in ensuring that operators have effective, comprehensive measures in place to prevent public online disclosure of children's personal information and ensure its deletion from their records, while also retaining the flexibility operators need to innovate and improve their mechanisms for detecting and deleting such information. Therefore, the final Rule amends paragraph (2) of the definition of

collects or collection

to adopt the reasonable measures standard proposed in the 2011 NPRM.

c. Collects or Collection, Paragraph (3)

In the 2011 NPRM, the Commission proposed to modify paragraph (3) of the Rule's definition of

collects or collection

to clarify that it includes all means of passively collecting personal information from children online, irrespective of the technology used. The Commission sought to accomplish this by removing from the original definition the language “or use of any identifying code linked to an individual, such as a cookie.”

76 FR at 59808.

The Commission received several comments supporting,

and several comments opposing,

this proposed change. Those opposing the change generally believed that this change somehow expanded the definition of

personal information.

As support for their argument, these commenters also referenced the Commission's proposal to include persistent identifiers within the definition of

personal information.

Privacy Rights Clearinghouse indicated its belief that this change would give operators added incentive to notify parents of their information collection practices, particularly with regard to online tracking and behavioral advertising.

See

Privacy Rights Clearinghouse (comment 131, 2011 NPRM), at 2;

see also

Consumers Union (comment 29, 2011 NPRM), at 2; kidSAFE Seal Program (comment 81, 2011 NPRM), at 6.

See

DMA (comment 37, 2011 NPRM), at 9-10; IAB (comment 73, 2011 NPRM), at 12; NCTA (comment 113, 2011 NPRM), at 17-18; National Retail Federation (comment 114, 2011 NPRM), at 2-3; TechAmerica (comment 157, 2011 NPRM), at 5-6.

The Commission believes that paragraph (3), as proposed in the 2011 NPRM, is sufficiently understandable. The paragraph does nothing to alter the fact that the Rule covers only the collection of

personal information.

Moreover, the final Rule's exception for the limited use of persistent identifiers to support internal operations—312.5(c)(7)—clearly articulates the specific criteria under which an operator will be exempt from the Rule's notice and consent requirements in connection with the passive collection of a persistent identifier.

Accordingly, the Commission adopts the definition of

collects or collection

as proposed in the 2011 NPRM.

See

Part II.C.10.g.,

infra.

2. Definition of Disclose or Disclosure

In the 2011 NPRM, the Commission proposed making several minor modifications to Section 312.2 of the Rule's definition of

disclosure,

including broadening the title of the definition to

disclose or disclosure

to clarify that in every instance in which the Rule refers to instances where an operator “disclose[s]” information, the definition of

disclosure

shall apply.

In addition, the Commission proposed moving the definitions of

release of personal information

and

support for the internal operations of the Web site or online service

contained within the definition of

disclosure

to make them stand-alone definitions within Section 312.2 of the Rule.

See

2011 NPRM, 76 FR at 59809.

The Commission intended this change to clarify what was meant by the terms

release of personal information

and

support for the internal operations of the Web site or online service,

where those terms are referenced elsewhere in the Rule and are not directly connected with the terms

disclose or disclosure.

One commenter asked the Commission to modify paragraph (2) of the proposed definition by adding an opening clause linking it to the definition of

collects or collection.

While this commenter did not state its reasons for the proposed change, the Commission believes that the language of paragraph (2) is sufficiently clear so as not to warrant making the change suggested. Therefore, the Commission modifies the definition of

disclosure or disclosure

as proposed in the 2011 NPRM.

See

kidSAFE Seal Program (comment 81, 2011 NPRM), at 8 (“[P]aragraph (b) under the definition of “disclose or disclosure” should have the following opening clause: Subject to paragraph (b) under the definition of “collects or collection,” making personal information collected by an operator from a child publicly available * * *.”).

3. Definition of Online Contact Information

Section 312.2 of the Rule defines

online contact information

as “an email address or any other substantially similar identifier that permits direct contact with a person online.” The 2011 NPRM proposed clarifications to the definition to flag that the term broadly covers all identifiers that permit direct

contact with a person online and to ensure consistency between the definition of

online contact information

and the use of that term within the definition of

personal information.

The proposed revised definition identified commonly used online identifiers, including email addresses, instant messaging (“IM”) user identifiers, voice over Internet protocol (“VOIP”) identifiers, and video chat user identifiers, while also clarifying that the list of identifiers was non-exhaustive and would encompass other substantially similar identifiers that permit direct contact with a person online.

The Commission received few comments addressing this proposed change.

The Rule's definition of

personal information

included the sub-category “an email address or other online contact information, including but not limited to an instant messaging user identifier, or a screen name that reveals an individual's email address.” The 2011 NPRM proposed replacing that sub-category of personal information with

online contact information.

76 FR at 59810.

One commenter opposed the modification, asserting that IM, VOIP, and video chat user identifiers do not function in the same way as email addresses. The commenter's rationale for this argument was that not all IM identifiers reveal the IM system in use, which information is needed to directly contact a user.

The Commission does not find this argument persuasive. While an IM address may not reveal the IM program provider in every instance, it very often does. Moreover, several IM programs allow users of different messenger programs to communicate across different messaging platforms. Like email, instant messaging is a communications tool that allows people to communicate one-to-one or in groups B sometimes in a faster, more real-time fashion than through email. The Commission finds, therefore, that IM identifiers provide a potent means to contact a child directly.

See

DMA (comment 37, 2011 NPRM), at 11.

Another commenter asked the Commission to expand the definition of

online contact information

to include mobile phone numbers. The commenter noted that, given the Rule's coverage of mobile apps and web-based text messaging programs, operators would benefit greatly from collecting a parent's mobile phone number (instead of an email address) in order to initiate contact for notice and consent.

The Commission recognizes that including mobile phone numbers within the definition of

online contact information

could provide operators with a useful tool for initiating the parental notice process through either SMS text or a phone call. It also recognizes that there may be advantages to parents for an operator to initiate contact via SMS text B among them, that parents generally have their mobile phones with them and that SMS text is simple and convenient.

However, the statute did not contemplate mobile phone numbers as a form of online contact information, and the Commission therefore has determined not to include mobile phone numbers within the definition.

Thus, the final Rule adopts the definition of

online contact information

as proposed in the 2012 SNPRM.

kidSAFE Seal Program (comment 81, 2011 NPRM), at 7. Acknowledging the Commission's position that cell phone numbers are outside of the statutory definition of

online contact information,

kidSAFE advocates for a statutory change, if needed, to enable mobile app operators, in particular, to reach parents using contact information “relevant to their ecosystem.”

At the same time, the Commission believes it may be impractical to expect children to correctly distinguish between mobile and land-line phones when asked for their parents' mobile numbers.

Moreover, given that the final Rule's definition of

online contact information

encompasses a broad, non-exhaustive list of online identifiers, operators will not be unduly burdened by the Commission's determination that cell phone numbers are not online contact information.

4. Definitions of Operator and Web Site or Online Service Directed to Children

In the 2012 SNPRM, the Commission proposed modifying the definitions of both

operator

and

Web site or online service directed to children

to allocate and clarify the responsibilities under COPPA when independent entities or third parties,

e.g.,

advertising networks or downloadable plug-ins, collect information from users through child-directed sites and services. Under the proposed revisions, the child-directed content provider would be strictly liable for personal information collected by third parties through its site. The Commission reasoned that, although the child-directed site or service may not own, control, or have access to the personal information collected, such information is collected on its behalf due to the benefits it receives by adding more attractive content, functionality, or advertising revenue. The Commission also noted that the primary-content provider is in the best position to know that its site or service is directed to children, and is appropriately positioned to give notice and obtain consent.

By contrast, if the Commission failed to impose obligations on the content providers, there would be no incentive for child-directed content providers to police their sites or services, and personal information would be collected from young children, thereby undermining congressional intent. The Commission also proposed imputing the child-directed nature of the content site to the entity collecting the personal information only if that entity knew or had reason to know that it was collecting personal information through a child-directed site.

2012 SNPRM, 77 FR at 46644. The Commission acknowledged that this decision reversed a previous policy choice to place the burden of notice and consent entirely upon the information collection entity.

In so doing, the Commission noted that it believed it could hold the information collection entity strictly liable for such collection because, when operating on child-directed properties, that portion of an otherwise general audience service could be deemed

directed to children.

2012 SNPRM, 77 FR at 46644-46645.

Most of the comments opposed the Commission's proposed modifications. Industry comments challenged the Commission's statutory authority for both changes and the breadth of the language, and warned of the potential for adverse consequences. In essence, many industry comments argued that the Commission may not apply COPPA where independent third parties collect personal information through child-directed sites,

and that even if the Commission had some authority, exercising it would be impractical because of the structure of the “online ecosystem.”

Many privacy and children's advocates agreed with the 2012 SNPRM proposal to hold child-directed content providers strictly liable, but some expressed concern about holding plug-ins and advertising networks to a lesser standard.

See, e.g.,

Facebook (comment 33, 2012 SNPRM), at 3-4.

See

Microsoft (comment 66, 2012 SNPRM), at 6; IAB (comment 49, 2012 SNPRM), at 5; DMA (comment 28, 2012 SNPRM), at 5.

See, e.g.,

Institute for Public Representation (comment 52, 2012 SNPRM), at 20; Common Sense Media (comment 20, 2012 SNPRM), at 6.

For the reasons discussed below, the Commission, with some modifications to the proposed Rule language, will retain the strict liability standard for child-directed content providers that allow other online services to collect personal information through their sites. The Commission will deem a plug-in or other service to be a covered co-operator only where it has actual knowledge that it is collecting information through a child-directed site.

a. Strict Liability for Child-Directed Content Sites: Definition of Operator

Implementing strict liability as described above requires modifying the current definition of

operator.

The Rule, which mirrors the statutory language, defines

operator

in pertinent part, as

“any person who operates a Web site located on the Internet or an online service and who collects or maintains personal information from or about the users of or visitors to such Web site or online service, or on whose behalf such information is collected or maintained, where such Web site or online service is operated for commercial purposes, including any person offering products or services for sale through that Web site or online service, involving commerce * * *”

15 U.S.C. 6501(2). The Rule's definition of

operator

reflects the statutory language.

See

16 CFR 312.2.

In the 2012 SNPRM, the Commission proposed adding a proviso to that definition stating that personal information is

collected or maintained on behalf of

an operator where it is collected in the interest of, as a representative of, or for the benefit of, the operator.

Industry, particularly online content publishers, including app developers, criticized this proposed change.

Industry comments argued that the phrase “on whose behalf” in the statute applies only to agents and service providers,

and that the Commission lacks the authority to interpret the phrase more broadly to include any incidental benefit that results when two parties enter a commercial transaction.

Many commenters pointed to an operator's post-collection responsibilities under COPPA,

e.g.,

mandated data security and affording parents deletion rights, as evidence that Congress intended to cover only those entities that control or have access to the personal information.

See, e.g.,

Application Developers Alliance (comment 5, 2012 SNPRM), at 3-4; Association of Competitive Technology (comment 7, 2012 SNPRM), at 4-5; IAB (comment 49, 2012 SNPRM), at 5-6; Online Publishers Association (comment 72, 2012 SNPRM), at 10-11; Magazine Publishers of America (comment 61, 2012 SNPRM), at 3-5; The Walt Disney Co. (comment 96, 2012 SNPRM), at 4-5; S. Weiner (comment 97, 2012 SNPRM), at 1-2; WiredSafety (comment 98, 2012 SNPRM), at 3.

See

DMA (comment 28, 2012 SNPRM), at 12; Internet Commerce Coalition (comment 53, 2012 SNPRM), at 5; TechAmerica (comment 87, 2012 SNPRM), at 2-3.

See, e.g.,

Gibson, Dunn & Crutcher (comment 39, 2012 SNPRM), at 7-9; Facebook (comment 33, 2012 SNPRM), at 6 (entities acting primarily for their own benefit not considered to be acting on behalf of another party).

See, e.g.,

Business Software Alliance (comment 12, 2012 SNPRM), at 2-4; Internet Commerce Coalition (comment 53, 2012 SNPRM), at 5;

see also

Gibson, Dunn & Crutcher (comment 39, 2012 SNPRM), at 7.

Application Developers Alliance (comment 5, 2012 SNPRM), at 4.

Id.; see also

Association for Competitive Technology (comment 7, 2012 SNPRM), at 5;

see generally

DMA (comment 28, 2012 SNPRM), at 5; Facebook (comment 33, 2012 SNPRM), at 3; Online Publishers Association (comment 72, 2012 SNPRM), at 11.

In many cases, child-directed properties integrate plug-ins to enhance the functionality or content of their properties or gain greater publicity through social media in an effort to drive more traffic to their sites and services. Child-directed properties also may obtain direct compensation or increased revenue from advertising networks or other plug-ins. These benefits to child-directed properties are not merely incidental; as the comments point out, the benefits may be crucial to their continued viability.

Id.

The Commission recognizes the potential burden that strict liability places on child-directed content providers, particularly small app developers. The Commission also appreciates the potential for discouraging dynamic child-directed content. Nevertheless, when it enacted COPPA, Congress imposed absolute requirements on child-directed sites and services regarding restrictions on the collection of personal information; those requirements cannot be avoided through outsourcing offerings to other operators in the online ecosystem. The Commission believes that the potential burden on child-directed sites discussed by the commenters in response to the 2012 SNPRM will be eased by the more limited definition of persistent identifiers, the more expansive definition of

support for internal operations

adopted in the Final Rule, and the newly-created exception to the Rule's notice and parental consent requirements that applies when an operator collects only a persistent identifier and only to support the operator's internal operations.

See

Part II.A.5.b.,

infra

(discussion of persistent identifiers and support of internal operations).

The Commission considered including the “due-diligence” safe harbor for child-directed content providers that many of the comments proposed.

Nevertheless, as many other comments pointed out, it cannot be the responsibility of parents to try to pierce the complex infrastructure of entities that may be collecting their children's personal information through any one site.

For child-directed properties, one entity, at least, must be strictly responsible for providing parents notice and obtaining consent when personal information is collected through that site. The Commission believes that the primary-content site or service is in the best position to know which plug-ins it integrates into its site, and is also in the best position to give notice and obtain consent from parents.

Although the Commission, in applying its prosecutorial discretion, will consider the level of due diligence a primary-content site exercises, the Commission will not provide a safe harbor from liability.

The type of due diligence advocated ranged from essentially relying on a plug-in or advertising network's privacy policy to requiring an affirmative contract.

See, e.g.,

The Walt Disney Co. (comment 96, 2012 SNPRM), at 5 (operator should be able to rely on third party's representations about its information collection practices, if operator makes reasonable efforts to limit unauthorized data collection); Gibson, Dunn & Crutcher (comment 39, 2012 SNPRM), at 23-24 (provide a safe harbor for operators that certify they do not receive, own, or control any personal information collected by third parties; alternatively, grant a safe harbor for operators that also certify they do not receive a specific benefit from the collection, or that obtain third party's certification of COPPA compliance); Internet Commerce Coalition (comment 53, 2012 SNPRM), at 6-7 (provide a safe harbor for operators whose policies prohibit third party collection on their sites).

See

Common Sense Media (comment 20, 2012 SNPRM), at 4-5; EPIC (comment 31, 2012 SNPRM), at 6; Institute for Public Representation (comment 52, 2012 SNPRM), at 18-19.

Some commenters, although not conceding the need to impose strict liability on any party, noted that if the burden needed to fall on either the primary content provider or the plug-in, it was better to place it on the party that controlled the child-directed nature of the content.

See, e.g.,

CTIA (comment 24, 2012 SNPRM), at 8-9; CDT (comment 15, 2012 SNPRM), at 4-5. Not surprisingly, industry members primarily in the business of providing content did not share this view.

See, e.g.,

Association for Competitive Technology (comment 7, 2012 SNPRM), at 4-5; Business Software Alliance (comment 12, 2012 SNPRM), at 2-4; Entertainment Software Association (comment 32, 2102 SNPRM), at 9; Online Publishers Association (comment 72, 2012 SNPRM), at 10-11; The Walt Disney Co. (comment 96, 2012 SNPRM), at 6.

When it issued the 2012 SNPRM, the Commission never intended the language describing “on whose behalf” to encompass platforms, such as Google Play or the App Store, when such stores merely offer the public access to someone else's child-directed content. In these instances, the Commission meant the language to cover only those entities that designed and controlled the content,

i.e.,

the app developer or site owner. Accordingly, the Commission has revised the language proposed in the 2012 SNPRM to clarify that personal information will be deemed to be collected on behalf of an operator where it benefits by allowing another person to collect personal information

directly from

users of such operator's site or service, thereby limiting the provision's coverage to operators that design or control the child-directed content.

Accordingly, the Final Rule shall state that personal information is

collected or maintained on behalf of

an operator when it is collected or maintained by an agent or service provider of the operator; or the operator benefits by allowing another person to collect personal information directly from users of such operator's Web site or online service.

This clarification to the term “on behalf of” is intended only to address platforms in instances where they function as an conduit to someone else's content. Platforms may well wear multiple hats and are still responsible for complying with COPPA if they themselves collect personal information directly from children.

b. Operators Collecting Personal Information Through Child-Directed Sites and Online Services: Moving to an Actual Knowledge Standard

In the 2012 SNPRM, the Commission proposed holding responsible as a co-operator any site or online service that “knows or has reason to know” it is collecting personal information through a host Web site or online service directed to children. Many commenters criticized this standard. Industry comments contended that such a standard is contrary to the statutory mandate that general audience services be liable only if they have actual knowledge they are collecting information from a child.

They further

argued that the standard is vague because it is impossible to determine what type of notification would provide a “reason to know.” Thus, the commenters argued that the standard triggers a duty to inquire.

In addition, commenters stated that even after inquiring, it might be impossible to determine which sites are truly directed to children (particularly in light of the Commission's revised definition of

Web site directed to children

to include those sites that are likely to attract a disproportionate percentage of children under 13).

Conversely, many privacy advocates believed it is necessary to impose some duty of inquiry, or even strict liability, on the entity collecting the personal information.

See

Business Software Alliance (comment 12, 2012 SNPRM), at 4-5; Digital Advertising Alliance (comment 27, 2012 SNPRM), at 2; Google (comment 41, 2012 SNPRM), at 4; Internet Commerce Coalition (comment 53, 2012 SNPRM), at 7; Magazine Publishers of America (comment 61, 2012

SNPRM), at 8; Toy Industry Association (comment 89, 2012 SNPRM), at 10-11;

see also

ACLU (comment 3, 2012 SNPRM), at 2-3; TechAmerica (comment 87, 2012 SNPRM), at 3.

See

CDT (comment 15, 2012 SNPRM), at 2; CTIA (comment 24, 2012 SNPRM), at 10; Entertainment Software Association (comment 32, 2012 SNPRM), at 9; Marketing Research Association (comment 62, 2012 SNPRM), at 2; Tangman (comment 85, 2012 SNPRM).

See

DMA (comment 28, 2012 SNPRM), at 9; Magazine Publishers of America (comment 61, 2012 SNPRM), at 8; Menessec (comment 65, 2012 SNPRM); Privo (comment 76, 2012 SNPRM), at 8.

See

Common Sense Media (comment 20, 2012 SNPRM), at 6; Institute for Public Representation (comment 52, 2012 SNPRM), at 20-22.

After considering the comments, the Commission has decided that while it is appropriate to hold an entity liable under COPPA for collecting personal information on Web sites or online services directed to children, it is reasonable to hold such entity liable only where it has

actual knowledge

that it is collecting personal information directly from users of a child-directed site or service. In striking this balance by moving to an actual knowledge standard, the Commission recognizes that this is still contrary to the position advocated by many industry comments: That a plug-in or advertising network that collects personal information from users of both general audience and child-directed sites must be treated monolithically as a general audience service, liable only if it has actual knowledge that it is collecting personal information from a specific child.

However, the COPPA statute also defines

Web site or online service directed to children

to include “that portion of a commercial Web site or online service that is targeted to children.” Where an operator of an otherwise general audience site or online service has actual knowledge it is collecting personal information directly from users of a child-directed site, and continues to collect that information, then, for purposes of the statute, it has effectively adopted that child-directed content as its own and that portion of its service may appropriately be deemed to be directed to children.

See

Digital Advertising Alliance (comment 27, 2012 SNPRM), at 2; DMA (comment 28, 2012 SNPRM), at 8-9; Entertainment Software Association (comment 32, 2012 SNPRM), at 13-14.

Similarly, when a behavioral advertising network offers age-based advertising segments that target children under 13, that portion of its service becomes an

online service directed to children. Contra

DMA (comment 28, 2012 SNPRM), at 12. The Commission also believes that narrowing the definition of persistent identifiers and further revisions to the definition of

Web site or online service directed to children

ease (although not entirely eliminate) many of the concerns expressed in industry comments.

See, e.g.,

CDT (comment 15, 2012 SNPRM), at 3; Digital Advertising Alliance (comment 27, 2012 SNPRM), at 2; Entertainment Software Association (comment 32, 2012 SNPRM), at 14 (combination of reason to know standard and expanded definition of persistent identifiers creates an unworkable result).

Commenters urged that, whatever standard the Commission ultimately adopts, it provide guidance as to when a plug-in or advertising network would be deemed to have knowledge that it is collecting information through a child-directed site or service.

Knowledge, by its very nature, is a highly fact-specific inquiry. The Commission believes that the actual knowledge standard it is adopting will likely be met in most cases when: (1) A child-directed content provider (who will be strictly liable for any collection) directly communicates the child-directed nature of its content to the other online service; or (2) a representative of the online service recognizes the child-directed nature of the content. The Commission does not rule out that an accumulation of other facts would be sufficient to establish actual knowledge, but those facts would need to be analyzed carefully on a case-by-case basis.

See

Microsoft (comment 66, 2012 SNPRM), at 2; TRUSTe (comment 90, 2012 SNPRM), at 4;

see also

Association for Competitive Technology (comment 7, 2012 SNPRM), at 3-4; Google (comment 41, 2012 SNPRM), at 4; DMA (comment 28, 2012 SNPRM), at 7; Viacom (comment 95, 2012 SNPRM), at 8-9.

5. Definition of Personal Information

a. Screen or User Names

The Rule defines

personal information

as including “a screen name that reveals an individual's email address.”

In the 2011 NPRM, the Commission proposed to modify this definition to include “a screen or user name where such screen or user name is used for functions other than or in addition to support for the internal operations of the Web site or online service.”

The Commission intended this change to address scenarios in which a screen or user name could be used by a child as a single credential to access multiple online properties, thereby permitting him or her to be directly contacted online, regardless of whether the screen or user name contained an email address.

See

16 CFR 312.2 (paragraph (n), definition of

personal information

2011 NPRM, 76 FR at 59810.

Id.

Some commenters expressed concern that the Commission's screen-name proposal would unnecessarily inhibit functions that are important to the operation of child-directed Web sites and online services.

In response to this concern, the 2012 SNPRM proposed covering screen names as

personal information

only in those instances in which a screen or user name rises to the level of

online contact information.

In such cases, the Commission reasoned, a screen or user name functions much like an email address, an instant messaging identifier, or “any other substantially similar identifier that permits direct contact with a person online.”

See

DMA (comment 37, 2011 NPRM), at 15-16; ESA (comment 47, 2011 NPRM), at 9; NCTA (comment 113, 2011 NPRM), at 12; Scholastic (comment 144, 2011 NPRM), at 12; A. Thierer (comment 162, 2011 NPRM), at 6; TRUSTe (comment 164, 2011 NPRM), at 3; The Walt Disney Co. (comment 170, 2011 NPRM), at 21.

See

2011 NPRM, 76 FR at 59810 (proposed definition of

online contact information

The Commission received a number of comments in support of this change from industry associations and advocacy groups.

Commenters recognized the change as providing operators with the flexibility to use screen or user names both for internal administrative purposes and across affiliated sites, services, or platforms without requiring prior parental notification or verifiable parental consent.

See

Common Sense Media (comment 20, 2012 SNPRM), at 7; Information Technology Industry Council (comment 51, 2012 SNPRM), at 2; Marketing Research Association (comment 62, 2012 SNPRM), at 3; Promotion Marketing Association (comment 77, 2012 SNPRM), at 8; TechAmerica (comment 87, 2012 SNPRM), at 5-6.

See, e.g.,

Promotion Marketing Association,

id.

A number of commenters, however, despite clear language otherwise in the 2012 SNPRM, continued to express concern that the Commission's proposed revision would limit operators' use of anonymized screen names in place of children's real names in filtered chat, moderated interactive forums, or as log-in credentials providing users with seamless access to content across multiple platforms and devices.

Some of these commenters

urged the Commission to refine the definition further, for example, by explicitly recognizing that the use of screen names for activities such as moderated chat will not be deemed as permitting “direct contact” with a child online and therefore will not require an operator using anonymous screen names to notify parents or obtain their consent.

Others suggested a return to the Commission's original definition of screen or user names,

i.e.,

only those that reveal an individual's online contact information (as newly defined).

Yet others hoped to see the Commission carve out from the definition of screen or user name uses to support an operator's internal operations (such as using screen or user names to enable moderated or filtered chat and multiplayer game modes).

See

DMA (comment 28, 2012 SNPRM), at 16; ESA (comment 32, 2012 SNPRM), at 5; kidSAFE Seal Program (comment 56, 2012 SNPRM), at 5; NCTA (comment 69, 2012 SNPRM), at 4-5; Online

Publishers Association (comment 72, 2012 SNPRM), at 12; Toy Industry Association (comment 89, 2012 SNPRM), at 13; TRUSTe (comment 90, 2012 SNPRM), at 5-6.

See

Online Publishers Association (comment 72, 2012 SNPRM), at 12; TRUSTe TRUSTe (comment 90, 2012 SNPRM), at 5-6.

See

kidSAFE Seal Program (comment 56, 2012 SNPRM), at 5.

See

ESA (comment 32, 2012 SNPRM), at 5.

The Commission sees no need to qualify further the proposed description of

screen or user name.

The description identifies precisely the form of direct, private, user-to-user contact the Commission intends the Rule to cover—

i.e.,

“online contact [that] can now be achieved via several methods besides electronic mail.”

The Commission believes the description permits operators to use anonymous screen and user names in place of individually identifiable information, including use for content personalization, filtered chat, for public display on a Web site or online service, or for operator-to-user communication via the screen or user name. Moreover, the definition does not reach single log-in identifiers that permit children to transition between devices or access related properties across multiple platforms. For these reasons, the Commission modifies the definition of

personal information,

as proposed in the 2012 SNPRM, to include “a screen or user name where it functions in the same manner as

online contact information,

as defined in this Section.”

See

Common Sense Media (comment 20, 2012 SNPRM), at 7.

Persistent Identifiers

and

Support for Internal Operations

Persistent identifiers have long been covered by the COPPA Rule, but only where they are associated with individually identifiable information.

In the 2011 NPRM, and again in the 2012 SNPRM, the Commission proposed broader Rule coverage of persistent identifiers.

See

16 CFR 312.2 of the existing Rule (paragraph (f), definition of

personal information

First, in the 2011 NPRM, the Commission proposed covering persistent identifiers in two scenarios—(1) where they are used for functions other than or in addition to support for the internal operations of the Web site or online service, and (2) where they link the activities of a child across different Web sites or online services.

After receiving numerous comments on the proposed inclusion of persistent identifiers within the definition of

personal information,

the Commission refined its proposal in the 2012 SNPRM.

See

2011 NPRM, 76 FR at 59812 (proposed definition of

personal information,

paragraphs (g) and (h)).

Those comments are discussed in the 2012 SNPRM, 77 FR at 46647.

In the Commission's refined proposal in the 2012 SNPRM, the definition of

personal information

would include a persistent identifier “that can be used to recognize a user over time, or across different Web sites or online services, where such persistent identifier is used for functions other than or in addition to support for the internal operations of the Web site or online service.”

The Commission also proposed to set forth with greater specificity the types of permissible activities that would constitute

support for internal operations.

The proposed revision to this latter definition was intended to accomplish three goals: (1) To incorporate into the Rule text many of the types of activities—user authentication, maintaining user preferences, serving contextual advertisements,

and protecting against fraud or theft—that the Commission initially discussed as permissible in the 2011 NPRM; (2) to specifically permit the collection of persistent identifiers for functions related to site maintenance and analysis, and to perform network communications that many commenters viewed as crucial to their ongoing operations;

and (3) to make clear that none of the information collected may be used or disclosed to contact a specific individual, including through the use of behavioral advertising.

Id.

The proposed definition of

support for internal operations

was published at 77 FR 46648.

Contextual advertising is “the delivery of advertisements based upon a consumer's current visit to a Web page or a single search query, without the collection and retention of data about the consumer's online activities over time.”

See

Preliminary FTC Staff Report, “Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers,” (Dec. 2010), at 55 n.134,

available at http://ftc.gov/os/2010/12/101201privacyreport.pdf.

Such advertising is more transparent and presents fewer privacy concerns as compared to the aggregation and use of data across sites and over time for marketing purposes.

See id.

For example, the term “personalize the content on the Web site or online service” was intended to permit operators to maintain user-driven preferences, such as game scores, or character choices in virtual worlds.

Id.

Most of the commenters who responded to the 2012 SNPRM opposed the Commission's refinement. Many continued to argue, as they had done in response to the 2011 NPRM, that because persistent identifiers only permit contact with a device, not a specific individual, the Commission was exceeding its statutory authority by defining them as

personal information.

Others argued strenuously for the benefits to children, parents, operators, and commerce of collecting anonymous information on, and delivering advertisements to, unknown or unnamed users.

Some commenters maintained that, to comply with COPPA's notice and consent requirements in the context of persistent identifiers, sites would be forced to collect more personal information on their users, contrary to COPPA's goals of data minimization.

15 U.S.C. 6501(8)(F) defines personal information to include “any other identifier that the Commission determines permits the physical or online contacting of a specific individual.”

See, e.g.,

Gibson Dunn & Crutcher (comment 39, 2012 SNPRM), at 20 (“This expansion of the definition of `personal information' is inconsistent with the text of COPPA, which limits `personal information' to categories of information that

by themselves

can be used to identify and contact a specific individual. Every category of information that COPPA enumerates—name, physical address, email address, telephone number, and Social Security number—as well as the catch-all for `any other identifier that the Commission determines permits the physical or online

contacting

of a specific individual,' 15 U.S.C. § 6501(8)(A)-(F)—is information that makes it possible to identify and contact a specific individual”);

see also

Business Software Alliance (comment 12, 2012 SNPRM), at 5-6; CTIA (comment 24, 2012 SNPRM), at 14-17; Chappell (comment 18, 2012 SNPRM), at 1; DMA (comment 28, 2012 SNPRM), at 10; Facebook (comment 33, 2012 SNPRM), at 9; Information Technology Industry Council (comment 51, 2012 SNPRM), at 2; Internet Commerce Coalition (comment 53, 2012 SNPRM), at 11-13; Microsoft (comment 66, 2012 SNPRM), at 3; NetChoice (comment 70, 2012 SNPRM), at 7; TechFreedom (comment 88, 2012 SNPRM), at 5-6.

See

Application Developers Alliance (comment 5, 2012 SNPRM), at 6; Business Software Alliance (comment 12, 2012 SNPRM), at 6); Information Technology and Innovation Foundation (comment 50, 2012 SNPRM), at 6-7; NetChoice (comment 70, 2012 SNPRM), at 6.

Facebook (comment 33, 2012 SNPRM), at 9-10; Google (comment 41, 2012 SNPRM), at 5; J. Holmes (comment 47, 2012 SNPRM).

Because the proposed definition of persistent identifiers ran hand-in-hand with the proposed carve-out for

permissible activities, most commenters also opined on the proposed scope of the definition of

support for internal operations.

100

Unsurprisingly, these commenters urged the Commission to broaden the definition either to make the list of permissible activities non-exhaustive,

101

or to clarify that activities such as ensuring legal and regulatory compliance, intellectual property protection, payment and delivery functions, spam protection, statistical reporting, optimization, frequency capping, de-bugging, market research, and advertising and marketing more generally would not require parental notification and consent on COPPA-covered sites or services.

102

Other commenters expressed confusion about which entities operating on or through a property could take advantage of the

support for internal operations

exemption.

103

Children's advocacy groups, by contrast, expressed fear that the proposed definition was already “so broad that it could exempt the collection of many persistent identifiers used to facilitate targeted marketing.”

104

100

Association for Competitive Technology (comment 7, 2012 SNPRM), at 5; Business Software Alliance (comment 12, 2012 SNPRM), at 6-7; CTIA (comment 24, 2012 SNPRM), at 17-18; DMA (comment 28, 2012 SNPRM), at 10-12; Internet Commerce Coalition (comment 53, 2012 SNPRM), at 12; Microsoft (comment 66, 2012 SNPRM), at 3-5; NetChoice (comment 70, 2012 SNPRM), at 8-9.

101

See

DMA (comment 28, 2012 SNPRM), at 11 (warning that an exhaustive list is likely to have unintended consequences if companies are not afforded flexibility as technologies evolve); Digital Advertising Alliance (comment 27, 2012 SNPRM), at 3; Internet Commerce Coalition (comment 53, 2012 SNPRM), at 3-4, 12 (“[T]he definition of `support for the internal operations' of a Web site is too narrow. * * * This list of `exempt' collections is incomplete and risks quickly becoming outmoded.”); Magazine Publishers of America (comment 61, 2012 SNPRM), at 11; Online Publishers Association (comment 72, 2012 SNPRM), at 8; Promotion Marketing Association (comment 77, 2012 SNPRM), at 7; Computer and Communications Industry Association (comment 27, 2011 NPRM), at 4 (the exceptions are narrow and “immobile short of another rulemaking”).

102

See, e.g.,

Association for Competitive Technology (comment 7, 2012 SNPRM), at 5; IAB (comment 49, 2012 SNPRM), at 4; TechFreedom (comment 88, 2012 SNPRM), at 11; Toy Industry Association (comment 89, 2012 SNPRM), at 15; Viacom Inc. (comment 95, 2012 SNPRM), at 13.

103

CDT (comment 15, 2012 SNPRM), at 6-7; Google (comment 41, 2012 SNPRM), at 5; Toy Industry Association (comment 89, 2012 SNPRM), at 14.

104

Institute for Public Representation (comment 52, 2012 SNPRM), at 13.

Several commenters supported the Commission's premise that the collection of certain persistent identifiers permits the physical or online contacting of a specific individual, but asked the Commission to take a different tack to regulating such identifiers. Rather than cover all persistent identifiers and then carve out permissible uses, these commenters suggested a simpler approach: the Commission should apply the Rule only to those persistent identifiers used for the purposes of contacting a specific child, including through online behavioral advertising.

105

See

CDT (comment 15, 2012 SNPRM), at 6 (“We do, however, agree with the Commission that behavioral targeting of children using unique identifiers should trigger COPPA compliance obligations”); Internet Commerce Coalition (comment 53, 2012 SNPRM), at 12;

see also

AT&T (comment 8, 2011 NPRM), at 7; Future of Privacy Forum (comment 55, 2011 NPRM), at 2; WiredTrust (comment 177, 2011 NPRM), at 9; Visa Inc. (comment 168, 2011 NPRM), at 2.

The Commission continues to believe that persistent identifiers permit the online contacting of a specific individual. As the Commission stated in the 2011 NPRM, it is not persuaded by arguments that persistent identifiers only permit the contacting of a device.

106

This interpretation ignores the reality that, at any given moment, a specific individual is using that device. Indeed, the whole premise underlying behavioral advertising is to serve an advertisement based on the perceived preferences of the individual user.

107

106

See

2011 NPRM, 76 FR at 59811.

107

See

J. Bowman, “Real-time Bidding—How It Works and How To Use It,” Warc Exclusive (Feb. 2011),

available at http://www.improvedigital.com/en/wp-content/uploads/2011/09/Warc-RTB-Feb11.pdf

(“With real-time bidding, advertisers can decide to put a specific ad in front of a specific individual web user on a given site, bid for that impression and—if they win the bid—serve the ad, all in the time it takes for a page to load on the target consumer's computer.”); L. Fisher, “eMarketer's Guide to the Digital Advertising Ecosystem: Mapping the Display Advertising Purchase Paths and Ad Serving Process” (Oct. 2012),

available at http://www.emarketer.com/Corporate/reports

(media buyers can deliver personalized, impression-by-impression, ads based on what is known about individual viewer attributes, behaviors, and site context).

Nor is the Commission swayed by arguments noting that multiple individuals could be using the same device. Multiple people often share the same phone number, the same home address, and the same email address, yet Congress still classified these, standing alone, as “individually identifiable information about an individual.”

108

For these reasons, and the reasons stated in the 2011 NPRM, the Commission will retain persistent identifiers within the definition of personal information.

108

15 U.S.C. 6501(8).

However, the Commission recognizes that persistent identifiers are also used for a host of functions that have little or nothing to do with contacting a specific individual, and that these uses are fundamental to the smooth functioning of the Internet, the quality of the site or service, and the individual user's experience. It was for these reasons that the Commission proposed to expand the definition of

support for internal operations

in the 2012 SNPRM.

The Commission has determined to retain the approach suggested in the 2011 NPRM and refined in the 2012 SNPRM, with certain revisions. First, the final Rule modifies the proposed definition of

persistent identifier

to cover “a persistent identifier that can be used to recognize a user over time

and

across different Web sites or online services.” This modification takes into account concerns several commenters raised that using a persistent identifier within a site or service over time serves an important function in conducting site performance assessments and supporting intra-site preferences.

109

However, in this context, not every Web site or service with a tangential relationship will be exempt—the term “different” means either sites or services that are unrelated to each other, or sites or services where the affiliate relationship is not clear to the user.

110

109

See

Toy Industry Association (comment 89, 2012 SNPRM), at 14;

see also

ESA (comment 32, 2012 SNPRM), at 8; NetChoice (comment 70, 2012 SNPRM), at 7-8.

110

This interpretation of affiliate relationships is consistent with prior Commission articulations.

See

FTC Report,

Protecting Consumer Privacy in an Era of Rapid Change

(March 2012), at 41-42,

available at http://ftc.gov/os/2012/03/120326privacyreport.pdf

(“The Commission maintains the view that affiliates are third parties, and a consumer choice mechanism is necessary unless the affiliate relationship is clear to consumers”);

see also

kidSAFE Seal Program (comment 56, 2012 SNPRM), at 5 (asking the Commission to clarify what is meant by the phrase “ `across

different

Web sites or online services' in the context of persistent identifiers”).

Second, the Commission has determined that the carve-out for use of a persistent identifier to provide support for the internal operations of a Web site or online service is better articulated as a separate exception to the Rule's requirements. For this reason, it has amended Section 312.5(c) (“

Exceptions to prior parental consent

”) to add a new exception providing that where an operator collects only a persistent identifier for the sole purpose of providing support for its internal operations, the operator will have no notice or consent obligations under the Rule. This is a change in organization, rather than a substantive change, from the Commission's earlier proposals.

In addition, in response to the arguments made in a number of comments, the Commission has further modified the 2012 SNPRM proposed definition of

support for internal operations

to add frequency capping of advertising and legal or regulatory compliance to the permissible uses

enumerated therein.

111

The Commission declines to add certain other language proposed by commenters, such as intellectual property protection, payment and delivery functions, spam protection, optimization, statistical reporting, or de-bugging, because it believes that these functions are sufficiently covered by the definitional language permitting activities that “maintain or analyze” the functions of the Web site or service, or protect the “security or integrity” of the site or service. Under this revised definition, most of the activities that commenters cite to as important to permitting the smooth and optimal operation of Web sites and online services will be exempt from COPPA coverage.

111

See, e.g.,

Digital Advertising Alliance (comment 27, 2012 SNPRM), at 3; DMA (comment 28, 2012 SNPRM), at 11; IAB (comment 73, 2011 NPRM), at 10-11; Magazine Publishers of America (comment 61, 2012 SNPRM), at 11; Microsoft (comment 66, 2012 SNPRM), at 5; Online Publishers Association (comment 123, 2011 NPRM), at 4-5; Viacom Inc. (comment 95, 2012 SNPRM), at 14.

The Commission also is cognizant that future technical innovation may result in additional activities that Web sites or online services find necessary to support their internal operations. Therefore, the Commission has created a voluntary process—new Section 312.12(b)—whereby parties may request Commission approval of additional activities to be included within the definition of

support for internal operations.

Any such request will be placed on the public record for notice and comment, and the Commission will act on it within 120 days.

The final amended language makes clear that operators may only engage in activities “necessary” to support the covered functions. The Commission agrees with commenter EPIC that “[t]he presence of the word `necessary' [in the statute] * * * indicates that the use of persistent identifiers is to be limited to the above activities, and that these activities are to be narrowly construed.”

112

Moreover, operators may not use persistent identifiers that fall within the Rule's definition of

personal information

for any purposes other than those listed within the definition of

support for internal operations.

Accordingly, the Rule will require operators to obtain parental consent for the collection of persistent identifiers where used to track children over time and across sites or services. Without parental consent, operators may not gather persistent identifiers for the purpose of behaviorally targeting advertising to a specific child. They also may not use persistent identifiers to amass a profile on an individual child user based on the collection of such identifiers over time and across different Web sites in order to make decisions or draw insights about that child, whether that information is used at the time of collection or later.

113

112

See

EPIC (comment 31, 2012 SNPRM), at 9. The Commission disagrees with the contention by certain commenters that the word “necessary” is confusing and unduly restrictive.

See

Online Publishers Association (comment 72, 2012 SNPRM), at 9. In this context, the term means that an operator may collect a covered persistent identifier if it uses it for the purposes listed in the definition of

support for internal operations.

The operator need not demonstrate that collection of the identifier was the only means to perform the activity.

113

144 Cong. Rec. S8482 (Statement of Sen. Bryan (1998)).

Several commenters sought clarification of whether a party's status as a first party or a third party would affect its ability to rely upon the

support for internal operations

definition.

114

To the extent that a child-directed content site or service engages service providers to perform functions encompassed by the definition of

support for internal operations,

those functions will be covered as support for the content-provider's internal operations. If a third party collecting persistent identifiers is deemed an

operator

under the Rule (

e.g.,

because it has actual knowledge it is collecting personal information from users of a child-directed site or service, or it has actual knowledge it is collecting personal information from a child through a general audience site or service), that operator may rely on the Rule's

support for internal operations

definition when it uses persistent identifier information for functions that fall within it.

114

See, e.g.,

Association for Competitive Technology (comment 7, 2012 SNPRM), at 5; IAB (comment 73, 2011 NPRM), at 11.

c. Photographs, Videos, and Audio Files

The Rule's existing definition of

personal information

includes photographs only when they are combined with “other information such that the combination permits physical or online contacting.” Given the prevalence and popularity of posting photos, videos, and audio files online, in the 2011 NPRM, the Commission reevaluated the privacy and safety implications of such practices as they pertain to children. The Commission determined that the inherently personal nature of photographs, and the fact that they may contain information such as embedded geolocation data, or can be paired with facial recognition technology, makes them identifiers that “permit the physical or online contacting of a specific individual.”

115

The Commission found the same risks attendant with the online uploading of video and audio files.

116

Accordingly, the Commission proposed creating a new category within the definition of

personal information

covering a photograph, video, or audio file where such file contains a child's image or voice.

115

See

2011 NPRM, 76 FR at 59813.

116

Id.

Some commenters supported this proposal. For example, the Institute for Public Representation, on behalf of a group of children's privacy advocates, stated that “[b]ecause photographs, videos, and audio files can convey large amounts of information about children that can make them more vulnerable to behavioral advertising, and possibly put their personal safety at risk as well, these types of information should be included in the definition of personal information.”

117

Institute for Public Representation (comment 71, 2011 NPRM), at 33; Privacy Rights Clearinghouse (comment 131, 2011 NPRM), at 2.

Several commenters criticized the Commission's proposal, claiming that the effect would limit children's participation in online activities involving “user-generated content.”

118

Several commenters issued blanket statements that photos, videos, and audio files, in and of themselves, do not permit operators to locate or contact a child.

119

Other commenters stated that the Commission's proposal is premature, arguing that facial recognition technologies are only in their nascent stages.

120

Finally, several commenters argued that the Commission should narrow the scope of its proposal, exempting from coverage photos, videos, or audio files that have been prescreened to remove any metadata or other individually identifiable information.

121

Others asked the Commission to carve out from coverage photos or videos where used to

support internal operations of a site or service.

122

Commenter WiredSafety urged the Commission to adopt a standard that would permit operators to blur images of children before uploading them, thereby reducing the risks of exposure.

123

118

See

DMA (comment 37, 2011 NPRM), at 17; Promotion Marketing Association (comment 133, 2011 NPRM), at 12; NCTA (comment 113, 2011 NPRM), at 16. Certain commenters interpreted the Commission's proposal as inapplicable to user-generated content, but applicable to an operator's own use of children's images or voices.

See

CTIA (comment 32, 2011 NPRM), at 12; National Retail Federation (comment 114, 2011 NPRM), at 4; F. Page (comment 124, 2011 NPRM).

119

See

American Association of Advertising Agencies (comment 2, 2011 NPRM), at 4; Internet Commerce Coalition (comment 74, 2011 NPRM), at 5; Promotion Marketing Association (comment 133, 2011 NPRM), at 12;

see also

DMA (comment 37, 2011 NPRM), at 17.

120

See

Intel Corp. (comment 72, 2011 NPRM), at 6-7; Motion Picture Association of America (“MPAA”) (comment 109, 2011 NPRM), at 13.

121

See

Privo (comment 76, 2012 SNPRM), at 7; DMA (comment 37, 2011 NPRM), at 17-18; Promotion Marketing Association (comment 133, 2011 NPRM), at 12; WiredSafety (comment 177, 2011 NPRM), at 10.

122

ESA (comment 47, 2011 NPRM), at 14 n.21; kidSAFE Seal Program (comment 81, 2011 NPRM), at 11.

123

See

WiredSafety (comment 177, 2011 NPRM), at 10 (“the risk of using a preteen's clear image in still photos or in video formats is obvious”);

see also

Intel (comment 72, 2011 NPRM), at 7 (“we propose limiting the Commission's new definition to `a photograph, video or audio file where such file contains a child's image or voice

which may reasonably allow identification of the child

' ”). The Commission believes that operators who choose to blur photographic images of children prior to posting such images would not be in violation of the Rule.

The Commission does not dispute that uploading photos, videos, and audio files can be entertaining for children. Yet, it is precisely the very personal nature of children's photographic images, videos, and voice recordings that leads the Commission to determine that such files meet the standard for “personal information” set forth by Congress in the COPPA statute. That is, in and of themselves, such files “

permit

the physical or online contacting of a specific individual.”

124

As the Privacy Rights Clearinghouse stated, “[a]s facial recognition advances, photos and videos have the potential to be analyzed and used to target and potentially identify individuals.”

125

Given these risks, the Commission continues to believe it is entirely appropriate to require operators who offer young children the opportunity to upload photos, videos, or audio files containing children's images or voices to obtain parental consent beforehand.

126

Therefore, the Commission adopts the modification of the definition of

personal information

regarding photos, videos, and audio files as proposed in the 2011 NPRM, without qualification.

124

15 U.S.C. 6501(8)(F) (italics added).

125

Privacy Rights Clearinghouse (comment 131, 2011 NPRM), at 2;

see also

TRUSTe (comment 164, 2011 NPRM), at 7 (“biometrics such as those provided in a photo, video or audio recording are personal information and greater protections need to be provided”).

126

The Commission notes that this amendment would not apply to uploading photos or videos on general audience sites such as Facebook or YouTube, absent actual knowledge that the person uploading such files is a child.

d. Geolocation Information

In the 2011 NPRM, the Commission stated that, in its view, existing paragraph (b) of the definition of

personal information

already covered any geolocation information that provides precise enough information to identify the name of a street and city or town.

127

However, because geolocation information can be presented in a variety of formats (

e.g.,

coordinates or a map), and in some instances can be more precise than street name and name of city or town, the Commission proposed making geolocation information a stand-alone category within the definition of

personal information.

128

127

76 FR at 59813.

128

Id.

Adding new paragraph (10) to the definition of

personal information

in 16 CFR 312.2.

Similar to the comments raised in response to the 2010 FRN, a number of commenters opposed this change. These commenters argued that anonymous, technical geolocation information, without the addition of any other identifier, was insufficient to contact an individual child.

129

The Internet Commerce Coalition stated that in identifying geolocation information “sufficient to identify a street name and name of city or town” as personal information, the Commission has missed the key to what makes an address “personal,” namely the street number.

130

Accordingly, such commenters asked the Commission to clarify that geolocation information will only be deemed personal information if, when combined with some other information or identifier, it would permit contacting an individual.

131

129

See

AT&T (comment 8, 2011 NPRM), at 5;

see also

American Association of Advertising Agencies (comment 2, 2011 NPRM), at 4; CTIA (comment 32, 2011 NPRM), at 9; DMA (comment 37, 2011 NPRM), at 17; Promotion Marketing Association (comment 133, 2011 NPRM), at 13; Software & Information Industry Association (“SIIA”) (comment 150, 2011 NPRM), at 8; Verizon (comment 167, 2011 NPRM), at 6.

130

See

Internet Commerce Coalition (comment 74, 2011 NPRM), at 5;

see also

AT&T (comment 8, 2011 NPRM), at 5-6.

131

See, e.g.,

CTIA (comment 32, 2011 NPRM), at 9; Future of Privacy Forum (comment 55, 2011 NPRM), at 5; Verizon (comment 167, 2011 NPRM), at 6 (“Consistent with Congressional intent, geolocation information should be treated as personal information only when the data is tied to a specific individual.”).

These commenters overlook that the COPPA statute does not require the submission of a street number to make address information “personal.” Nor is it limited to home address, primary residence, or even a static address. Rather, Congress chose to use the words “or other physical address, including street name and name of city or town.”

132

This word choice not only permits the inclusion of precise mobile (

i.e.,

moving) location information, it may very well mandate it.

133

As commenter Consumers Union stated, “[s]ince a child's physical address is already considered personal information under COPPA, geolocation data, which provides precise information about a child's whereabouts at a specific point in time, must also necessarily be covered.”

134

132

15 U.S.C. 6501(8)(B).

133

For this reason, the Commission finds those comments focusing on the potential to capture a large geographic area to be inapposite.

See

IAB (comment 73, 2011 NPRM), at 6 (“without an address or other additional data to identify a household or individual, a street name and city could encompass a large geographic area and as many as 1,000 households. For example, Sepulveda Boulevard, in the Los Angeles area, is over 40 miles long”).

134

See

Consumers Union (comment 29, 2011 NPRM), at 3;

see also

EPIC (comment 41, 2011 NPRM), at 8-9 (“As with IP addresses and user names, geolocation information can be used to track a particular device, which is usually linked to a particular individual.”).

In addition, the Commission disagrees with those commenters who state that geolocation information, standing alone, does not permit the physical or online contacting of an individual within the meaning of COPPA.

135

Just as with persistent identifiers, the Commission rejects the notion that precise geolocation information allows only contact with a specific device, not the individual using the device. By that same flawed reasoning, a home or mobile telephone number would also only permit contact with a device.

135

See

American Association of Advertising Agencies (comment 2, 2011 NPRM), at 4; AT&T (comment 8, 2011 NPRM), at 6; DMA (comment 37, 2011 NPRM), at 17; Promotion Marketing Association (comment 133, 2011 NPRM), at 13; Verizon (comment 167, 2011 NPRM), at 6.

Several commenters asked the Commission to refine the Rule's coverage of geolocation so that it targets particular uses. Commenter CTIA, citing photo-sharing services as an example, asked that geolocation information embedded in metadata (as often is the case with digital photographs) be excluded from the Rule's coverage.

136

Arguing that there should be a legal difference between using geolocation information for convenience or to protect a child's safety and to market to a child, commenter kidSAFE Seal Program suggested that geolocation data only be considered “personal information” when it is being used for marketing purposes.

137

Finally, commenter TRUSTe asked that the Commission amend the definition to cover “precise geolocation data that can be used to identify a child's actual physical location at a given point in time.”

138

136

CTIA (comment 32, 2011 NPRM), at 9.

137

kidSAFE Seal Program (comment 81, 2011 NPRM), at 11.

138

TRUSTe (comment 164, 2011 NPRM), at 3.

The Commission sees no basis for making the suggested revisions. With respect to excluding geolocation

information in metadata, the Commission notes that in the 2011 NPRM, it specifically cited such geolocation metadata as one of the bases for including photographs of children within the definition of

personal information.

139

With respect to the comment from kidSAFE Seal Program, the statute does not distinguish between information collected for marketing as opposed to convenience; therefore, the Commission finds no basis for making such a distinction for geolocation information. Finally, the Commission sees little to no practical distinction between “geolocation data that can be used to identify a child's actual physical location at a given point in time” and geolocation information “sufficient to identify street name and name of a city or town,” and it prefers to adhere to the statutory language. Accordingly, the Commission modifies the definition of

personal information

as proposed in the 2011 NPRM, and covered operators will be required to notify parents and obtain their consent prior to collecting geolocation information from children.

139

See

76 FR at 59813 n.87.

6. Definition of Release of Personal Information

In the 2011 NPRM, the Commission proposed to define the term

release of personal information

separately from the definition of

disclosure,

since the term applied to provisions of the Rule that did not solely relate to disclosures.

140

The Commission also proposed technical changes to clarify that the term “release of personal information” addresses business-to-business uses of personal information, not public disclosures, of personal information.

141

The Commission received little comment on this issue and therefore adopts the proposed changes.

140

See

2011 NPRM, 76 FR at 59804, 59809. The Commission originally proposed to define

release of personal information

as “the sharing, selling, renting, or any other means of providing personal information to any third party.” The Commission's revised definition removes the phrase “or any other means of providing personal information” to avoid confusion and overlap with the second prong of the definition of

disclosure

governing an operator making personal information collected from a child publicly available,

e.g.,

through a social network, a chat room, or a message board.

See

16 CFR 312.2 (definition of

disclosure

141

Id.

7. Definition of Web Site or Online Service Directed to Children

In the 2012 SNPRM, the Commission proposed revising the definition of Web site or online service directed to children to allow a subset of sites falling within that category an option not to treat all users as children. The proposed revision was sparked by a comment from The Walt Disney Company that urged the Commission to recognize that sites and services directed to children fall along a continuum and that those sites targeted to both children and others should be permitted to differentiate among users. Noting that Disney's suggestion in large measure reflected the prosecutorial discretion already applied by the Commission in enforcing COPPA, the Commission proposed revisions to implement this concept. The Commission received numerous comments on this proposal. Although many commenters expressed support for the concept, the proposed implementing language was criticized.

Paragraphs (a) and (b) of the SNPRM's proposed revisions sought to define the subset of sites directed to children that would still be required to treat all users as children: those that knowingly target children under 13 as their primary audience, and those that, based on the overall content of the site, are likely to attract children under 13 as their primary audience. Paragraph (c) sought to describe those child-directed sites that would be permitted to age-screen to differentiate among users—namely those sites that, based on overall content, are likely to draw a disproportionate number of child users.

Although most commenters concurred that operators intentionally targeting children as their primary audience should be covered as Web sites directed to children,

142

some worried about the precise contours of the term “primary audience” and sought guidance as to percentage thresholds.

143

Some commenters also opposed any interpretation of COPPA that required child-directed Web sites to presume all users are children.

144

142

See

ACLU (comment 3, 2012 SNPRM), at 3; Online Publishers Association (comment 72, 2012 SNPRM), at 4.

143

See

DMA (comment 28, 2012 SNPRM), at 13-14; Institute for Public Representation (comment 52, 2012 SNPRM), at 25-27; Privo (comment 76, 2012 SNPRM), at 3; TechFreedom (comment 88, 2012 SNPRM), at 3; Toy Industry Association (comment 89, 2012 SNPRM), at 12; WiredTrust and WiredSafety (comment 98, 2012 SNPRM), at 3-4.

144

See

Facebook (comment 33, 2012 SNPRM), at 10; Viacom Inc. (comment 95, 2012 SNPRM), at 5.

Many commenters argued that the Commission exceeded its authority by defining

Web site or online service directed to children

based on criteria other than the sites' intent to target children. These commenters argued that Congress, by defining Web sites directed to children as those “targeted” to children, was imposing a subjective intent requirement.

145

The Commission disagrees. The Commission believes that if Congress had wanted to require subjective intent on the part of an operator before its site or service could be deemed

directed to children,

it would have done so explicitly.

146

Intent cannot be the only scenario envisioned by Congress whereby a site would be deemed directed to children.

147

Certainly, a Web site or online service that has the attributes, look, and feel of a property targeted to children under 13 will be deemed to be a site or service directed to children, even if the operator were to claim that was not its intent.

145

See, e.g.,

Online Publishers Association (comment 72, 2012 SNPRM), at 4 (“The plain meaning of `targeted' in this context requires a deliberate selection of an audience of children.”).

146

See

15 U.S.C. 6501(10)(A) (“The term `Web site or online service directed to children' means—(i) a commercial Web site or online service that is targeted to children; or (ii) that portion of a commercial Web site or online service that is targeted to children.”).

147

See

ACLU (comment 3, 2012 SNPRM), at 4 (“paragraphs (a) and (b) of the proposed definition are largely noncontroversial”).

Paragraph (c) sought to describe those child-directed sites that would be permitted to age-screen to differentiate among users, namely those sites that, based on overall content, are likely to draw a disproportionate number of child users. While a handful of comments supported this definition,

148

for the most part, it was criticized by a spectrum of interests. On one side were advocates such Common Sense Media, EPIC, and the Institute for Public Representation. These advocates argued that recognizing a category of sites and services directed to mixed-audiences, targeted both to young children and others, would undercut the other revisions the Commission has proposed, thereby lessening privacy protections for children.

149

Such advocates also argued that the proposed category might create incentives, or loopholes, for operators that currently provide child-directed Web sites or services to claim their online properties are covered by paragraph (c) of the definition and become exempt from COPPA by age-gating.

150

148

See, e.g.,

U.S. Conference of Catholic Bishops (comment 92, 2012 SNPRM), at 4.

149

Institute for Public Representation (comment 52, 2012 SNPRM), at (i).

150

Common Sense Media (comment 20, 2012 SNPRM), at 9; EPIC (comment 31, 2012 SNPRM), at 4-5; Institute for Public Representation,

supra

note 149, at 27-28.

On the other side were a number of commenters who feared that the proposal would significantly expand the range of Web sites and online services that fall within the ambit of COPPA's coverage, including both teen-oriented and general-audience sites and services that incidentally appeal to children as well as adults. Much of this fear appears

to have been driven by the specific language the Commission proposed; that is, sites or services that, based on their overall content, were “likely to attract an audience that includes a disproportionately large percentage of children under age 13 as compared to the percentage of such children in the general population.” Some argued that the use of the term “disproportionate” is vague,

151

potentially unconstitutional,

152

unduly expansive,

153

or otherwise constitutes an unlawful shift from the statute's actual knowledge standard for general audience sites to one of constructive knowledge.

154

Many worried that the Commission's proposal would lead to widespread age-screening, or more intensive age-verification, across the entire body of Web sites and online services located on the Internet.

155

Other commenters suggested that the Commission implement this approach through a safe harbor, not by revising a definition.

156

151

See, e.g.,

P. Aftab (comment 1, 2012 SNPRM), at 6-7; NCTA (comment 69, 2012 SNPRM), at 14; Marketing Research Association (comment 62, 2012 SNPRM), at 2; NetChoice (comment 70, 2012 SNPRM), at 4-5; SIIA (comment 84, 2012 SNPRM), at 10.

152

See, e.g.,

CDT (comment 15, 2012 SNPRM), at 7-10; Family Online Safety Institute (comment 34, 2012 SNPRM), at 3; Internet Commerce Coalition (comment 53, 2012 SNPRM), at 9; T. Mumford (comment 68, 2012 SNPRM); Online Publishers Association (comment 72, 2012 SNPRM), at 6; Viacom (comment 95, 2012 SNPRM), at 5.

153

See, e.g.,

DMA (comment 28, 2012 SNPRM), at 14; Magazine Publishers of America (comment 61, 2012 SNPRM), at 6-7.

154

See

CDT (comment 15, 2012 SNPRM), at 7.

155

See

ACLU (comment 3, 2012 SNPRM), at 5; DMA (comment 28, 2012 SNPRM), at 14-15; Magazine Publishers of America (comment 61, 2012 SNPRM), at 8; Toy Industry Association (comment 89, 2012 SNPRM), at 7, 11.

156

Entertainment Software Association (comment 32, 2012 SNPRM), at 2; Online Publishers Association (comment 72, 2012 SNPRM), at 7-8; Viacom Inc. (comment 95, 2012 SNPRM), at 6.

The comments reflect a misunderstanding of the purpose and effect of the change proposed in the 2012 SNPRM. The Commission did not intend to expand the reach of the Rule to additional sites and services, but rather to create a new compliance option for a subset of Web sites and online services already considered

directed to children

under the Rule's totality of the circumstances standard.

To make clear that it will look to the totality of the circumstances to determine whether a site or service is directed to children (whether as its primary audience or otherwise), the Commission has revised and reordered the definition of

Web site or online service directed to children

as follows. Paragraph (1) of the definition contains the original Rule language setting forth several factors the Commission will consider in determining whether a site or service is directed to children. In addition, paragraph (1) amends this list of criteria to add musical content, the presence of child celebrities, and celebrities who appeal to children, as the Commission originally proposed in the 2011 NPRM.

157

Although some commenters expressed concern that these additional factors might capture general audience sites,

158

produce inconsistent results,

159

or be overly broad (since musicians and celebrities often appeal both to adults and children),

160

the Commission believes that these concerns are unfounded. The Commission reiterates that these factors are some among many that the Commission will consider in assessing whether a site or service is

directed to children,

and that no single factor will predominate over another in this assessment.

157

2011 NPRM, 76 FR at 59814.

158

See

DMA (comment 37, 2011 NPRM), at 18-19; MPAA (comment 109, 2011 NPRM), at 19.

159

See

Verizon (comment 167, 2011 NPRM), at 10.

160

See

SIIA (comment 150, 2011 NPRM), at 9.

Paragraph (2) of the definition sets forth the actual knowledge standard for plug-ins or ad networks, as discussed in Part II.A.4.b herein, whereby a plug-in, ad network, or other property is covered as a Web site or online service directed to children under the Rule when it has actual knowledge that it is collecting personal information directly from users of a child-directed Web site or online service.

The Commission amends paragraph (3) of the definition to clarify when a child-directed site would be permitted to age-screen to differentiate among users. This paragraph codifies the Commission's intention to first apply its “totality of the circumstances” standard to determine whether any Web site or online service falling under paragraph (3) is

directed to children.

The Commission then will assess whether children under age 13 are the primary audience for the site or service. Paragraph (3) codifies that a site or service that is directed to children, but that does not target children as its primary audience, may use an age screen in order to apply all of COPPA's protections only to visitors who self-identify as under age 13. As the Commission stated in the 2012 SNPRM, at that point, the operator will be deemed to have actual knowledge that such users are under 13 and must obtain appropriate parental consent before collecting any personal information from them and must also comply with all other aspects of the Rule.

161

See

2012 SNPRM, 77 FR at 46646.

The Commission retains its longstanding position that child-directed sites or services whose primary target audience is children must continue to presume all users are children and to provide COPPA protections accordingly.

162

Some commenters contend that the Commission should permit this presumption to be rebutted, even on sites primarily targeting children, by the use of a simple age screen that distinguishes child users from other users.

163

Although the Commission is now permitting this on sites or services that target children only as a secondary audience or to a lesser degree, the Commission believes adopting this standard for

all

child-directed sites would virtually nullify the statutory distinction between “actual knowledge” sites and those directed to children, creating a

de facto

actual knowledge standard for all operators.

164

162

The Commission intends the word “primary” to have its common meaning,

i.e.,

something that stands first in rank, importance, or value. This must be determined by the totality of the circumstances and not through a precise audience threshold cut-off.

See

definition of “primary.”

Merriam-Webster.com

(2012),

available at http://www.merriam-webster.com

(last accessed Nov. 5, 2012).

163

P. Aftab (comment 1, 2012 SNPRM), at 5; Facebook (comment 33, 2012 SNPRM), at 12-13; Future of Privacy Forum (comment 37, 2012 SNPRM), at 8.

164

See

DMA (comment 28, 2012 SNPRM), at 8 (an operator's choice of content serves as a proxy for knowledge that its users are primarily children under 13).

Finally, paragraph (4) of the definition restates the statutory proviso that a site or service will not be deemed to be child-directed where it simply links to a child-directed property.

B. Section 312.4: Notice

1. Direct Notice to a Parent

In the 2011 NPRM, the Commission proposed refining the Rule requirements for the direct notice to ensure a more effective “just-in-time” message to parents about an operator's information practices.

165

As such, the Commission proposed to reorganize and standardize the direct notice requirement to set forth the precise items of information that must be disclosed in each type of direct notice the Rule requires. The proposed revised language of § 312.4 specified, in each instance where the Rule requires direct notice, the precise information that operators must provide to parents regarding the items of personal information the operator already has obtained from the child (generally, the

parent's online contact information either alone or together with the child's online contact information); the purpose of the notification; action that the parent must or may take; and what use, if any, the operator will make of the personal information collected. The proposed revisions also were intended to make clear that each form of direct notice must provide a hyperlink to the operator's online notice of information practices.

166

165

See

2011 NPRM, 76 FR at 59816.

166

Id.

In general, commenters supported the Commission's proposed changes as providing greater clarity and simplicity to otherwise difficult-to-understand statements.

167

These changes were viewed as especially important in an era of children's intense engagement with mobile applications accessed through a third-party app store and where an online notice might not be as readily accessible.

168

Only one commenter objected to the concept of placing greater emphasis on the direct, rather than the online, notice, stating that the changes would unduly necessitate lengthy direct notices and would prove overwhelming for parents and challenging to implement in the mobile environment.

169

167

See

EPIC (comment 41, 2011 NPRM), at 9; Institute for Public Representation (comment 71, 2011 NPRM), at 40-41; kidSAFE Seal Program (comment 81, 2011 NPRM), at 12; NCTA (comment 113, 2011 NPRM), at 22.

168

AssertID (comment 6, 2012 SNPRM), at 2.

169

IAB (comment 73, 2011 NPRM), at 13.

The Commission also proposed adding a paragraph setting out the contours of a new direct notice in situations where an operator voluntarily chooses to collect a parent's online contact information from a child in order to provide parental notice about a child's participation in a Web site or online service that does not otherwise collect, use, or disclose children's personal information. The Commission's proposal for a voluntary direct notice in situations where an operator does not otherwise collect, use, or disclose personal information from a child garnered very little attention. Only one commenter sought clarification of the specific language the Commission proposed.

170

N. Savitt (comment 142, 2011 NPRM), at 2.

Several commenters urged the Commission to use the occasion of the Rule review to develop a model COPPA direct notice form that operators voluntarily could adopt,

171

to mandate that such notifications be optimized for the particular devices on which they are displayed,

172

or to implement a Web site rating system.

173

The Commission believes that these suggestions are better suited as “best practices”

174

rather than as additions to the text of the Rule.

171

H. Valetk (comment 166, 2011 NPRM), at 3.

172

TRUSTe (comment 164, 2011 NPRM), at 10.

173

Lifelock (comment 93, 2011 NPRM), at 1.

174

For example, to be considered by the various Commission-approved COPPA safe harbor programs.

The Commission has determined to retain in the final Rule the modifications proposed in the 2011 NPRM. However, the Commission has reorganized the paragraphs to provide a better flow and guidance for operators, and has clarified that the voluntary direct notice provision described above is, indeed, voluntary for operators who choose to use it.

175

N. Savitt (comment 142, 2011 NPRM), at 2.

2. Notice on the Web Site or Online Service

In the 2011 NPRM, the Commission proposed several changes to the Rule's online notice requirement. First, the Commission proposed requiring all operators collecting, using, or disclosing information on a Web site or online service to provide contact information, including, at a minimum, the operator's name, physical address, telephone number, and email address.

176

This proposal marked a change from the existing Rule's proviso that such operators could designate one operator to serve as the point of contact.

176

Id.

With the exception of the Institute for Public Representation,

177

commenters who spoke to the issue opposed mandating that the online notice list all operators. Some objected to the sheer volume of potentially confusing information this would present to parents,

178

and stated that the proposal provided no additional consumer benefit to parents, given that the existing Rule implies that the single operator designee should be prepared to “respond to all inquiries from parents concerning the operators' privacy policies and use of children's information.”

179

Some also spoke to the burden on the primary operator of having to maintain a current list of all applicable operators' contact information,

180

and expressed confusion as to which operators needed to be listed.

181

177

Institute for Public Representation (comment 71, 2011 NPRM), at 38-39.

178

See

Facebook (comment 50, 2011 NPRM), at 9; NCTA (comment 113, 2011 NPRM), at 22; Toy Industry Association (comment 89, 2012 SNPRM), at 6.

179

IAB (comment 73, 2011 NPRM), at 12.

180

DMA (comment 37, 2011 NPRM), at 20.

181

kidSAFE Seal Program (comment 81, 2011 NPRM), at 12 (“Would this rule apply to one-time joint sponsors of a promotion who co-collect information on a Web site?”).

The Commission believes that a requirement for the primary operator to provide specific, current, contact information for every operator that collects information on or through its Web site or service has the potential to confuse parents, for whom such online notices are intended to be accessible and useful. After considering the comments, the Commission has determined to retain the Rule's “single operator designee” proviso; that is, an operator will be required to list all operators collecting or maintaining personal information from children through the Web site or online service, but need only list the contact information for the one operator who will be responsible for responding to parents' inquiries.

In the 2011 NPRM, the Commission also proposed eliminating the Rule's current lengthy—yet potentially under-inclusive—recitation of an operator's information collection, use, and disclosure practices in favor of a simple statement of: (1) What information the operator collects from children, including whether the Web site or online service enables a child to make personal information publicly available; (2) how the operator uses such information; and (3) the operator's disclosure practices for such information.

182

As a part of this revision, the Commission proposed removing the required statement that the operator may not condition a child's participation in an activity on the child's disclosing more personal information than is reasonably necessary to participate in such activity.

183

This proposal was opposed by the Institute for Public Representation, which views the statement as a way to educate parents as to whether or not the operator actually complies with data minimization principles.

184

This organization also asked the Commission to require operators to disclose information to parents on how the data they collect is secured from potential breaches.

185

The Commission has considered this input but nevertheless adopts both of these changes in the final Rule.

182

76 FR at 59815.

183

Id.

184

Institute for Public Representation (comment 71, 2011 NPRM), at 40.

185

Id.

The Commission sees great value for parents of streamlined online notices and continues to believe that the removal of extraneous information from such notices will further this goal.

186

Accordingly, the Commission modifies the Rule as proposed in the 2011 NPRM to remove an operator's recitation in its online notice that it will not condition a child's participation on the provision of more information than is necessary. Again, however, the substantive requirement of § 312.7 remains in place.

187

In addition, and again in the interest of streamlining the online notices, the Commission declines to require operators to explain the measures they take to protect children's data. Nevertheless, the Rule's enhanced provisions on confidentiality and data security will help protect data collected from children online.

186

See

2011 NPRM, 76 FR at 59815 (“In the Commission's experience, this blanket statement,

often parroted verbatim in operators' privacy policies, detracts from the key information of operators' actual information practices, and yields little value to a parent trying to determine whether to permit a child's participation.”).

187

Id.

Finally, focusing on the part of the Commission's proposal that would require operators of general audience sites or services that have separate children's areas to post links to their notices of children's information practices on the home

or landing page or screen

of the children's area, the Toy Industry Association asked the Commission to forgo mandating links in any location where mobile apps can be purchased or downloaded because, in their view, changing commercial relationships may make it difficult to frequently update privacy policies in apps marketplaces.

188

The final amended Rule does not mandate the posting of such information at the point of purchase but rather on the app's home or landing screen. However, the Commission does see a substantial benefit in providing greater transparency about the data practices and interactive features of child-directed apps at the point of purchase and encourages it as a best practice.

189

188

Toy Industry Association (Comment 163, 2011 NPRM), at 4.

189

FTC Staff Report, “Mobile Apps for Kids: Disclosures Still Not Making the Grade” (Dec. 2012), at 7 (“Mobile Apps for Kids II Report”),

available at http://www.ftc.gov/os/2012/12/121210mobilekidsappreport.pdf

(noting that “information provided prior to download is most useful in parents' decision-making since, once an app is downloaded, the parent already may have paid for the app and the app already may be collecting and disclosing the child's information to third parties”).

C. Section 312.5: Parental Consent

A central element of COPPA is its requirement that operators seeking to collect, use, or disclose personal information from children first obtain verifiable parental consent.

190

“Verifiable parental consent” is defined in the statute as “any reasonable effort (taking into consideration available technology), including a request for authorization for future collection, use, and disclosure, described in the notice.”

191

Accordingly, the Rule requires that operators must make reasonable efforts to obtain verifiable parental consent, taking into consideration available technology. Any method to obtain verifiable parental consent must be reasonably calculated in light of available technology to ensure that the person providing consent is the child's parent. § 312.5(b)(1).

190

Paragraph (a) of § 312.5 states that an operator is required to obtain verifiable parental consent before any collection, use, and/or disclosure of personal information from children, including consent to any material change in the collection, use, and/or disclosure practices to which the parent has previously consented. An operator must give the parent the option to consent to the collection and use of the child's personal information without consenting to disclosure of his or her personal information to third parties.

191

15 U.S.C. 6501(9).

The Rule sets forth a non-exhaustive list of methods that meet the standard of verifiable parental consent.

192

Specifically, paragraph (b)(2) states that methods to obtain verifiable parental consent that satisfy the requirements of the paragraph include: Providing a consent form to be signed by the parent and returned to the operator by postal mail or facsimile; requiring a parent to use a credit card in connection with a transaction; having a parent call a toll-free telephone number staffed by trained personnel; using a digital certificate that uses public key technology; and using email accompanied by a PIN or password obtained through one of the verification methods listed in the paragraph.

193

192

See

16 CFR 312.5(b).

193

Paragraph (b)(2) also sets out the sliding scale “email plus” method for obtaining parental consent in the instance where an operator collects a child's personal information only for

internal use.

The Commission's determination to retain the email plus method is discussed in Part II.C.7,

infra.

Participants at the Commission's June 2, 2010 COPPA roundtable

194

and commenters to the 2010 FRN generally agreed that, while no one method provides complete certainty that the operator has reached and obtained consent from a parent, the methods listed in the Rule continue to have utility for operators and should be retained.

195

194

See

Federal Trade Commission's Roundtable: Protecting Kids' Privacy Online at 195, 208-71 (June 2, 2010),

available at http://www.ftc.gov/bcp/workshops/coppa/COPPARuleReview_Transcript.pdf.

195

See

DMA (comment 17, 2010 FRN), at 10, 12; Microsoft (comment 39, 2010 FRN), at 7; Toy Industry Association, Inc. (comment 63, 2010 FRN), at 3; WiredSafety.org. (comment 68, 2010 FRN), at 18.

A number of commenters urged the Commission to expand the list of acceptable mechanisms to incorporate newer technologies, or to otherwise modernize or simplify the Rule's mechanisms for parental consent.

196

Suggested methods of obtaining parental consent included sending a text message to the parent's mobile phone number,

197

offering online payment services other than credit cards,

198

offering parental controls in gaming consoles,

199

offering a centralized parental consent mechanism or parental opt-in list,

200

and permitting electronic signatures.

201

196

See, e.g.,

BOKU (comment 5, 2010 FRN); DMA (comment 17, 2010 FRN), at 11-12; EchoSign, Inc. (comment 18, 2010 FRN); ESA (comment 20, 2010 FRN), at 7-9; Facebook (comment 22, 2010 FRN), at 2; J. Hiller (comment 27, 2010 FRN), at 447-50; M. Hoal (comment 30, 2010 FRN); Microsoft (comment 39, 2010 FRN), at 4; MPAA (comment 42, 2010 FRN), at 12; RelyID (comment 53, 2010 FRN), at 3; TRUSTe (comment 64, 2010 FRN), at 3; H. Valetk (comment 66, 2010 FRN), at 6; WiredSafety.org (comment 68, 2010 FRN), at 7; S. Wittlief (comment 69, 2010 FRN).

197

See

BOKU (comment 5, 2010 FRN); ESA (comment 20, 2010 FRN), at 11-12; TRUSTe (comment 64, 2010 FRN), at 3; H. Valetk (comment 66, 2010 FRN), at 6-7.

198

See

WiredSafety.org (comment 68, 2010 FRN), at 24 (noting that operators are considering employing online financial accounts, such as iTunes, for parental consent).

199

See

ESA (comment 20, 2010 FRN), at 9-10; Microsoft (comment 39, 2010 FRN), at 7.

200

See

ESA (comment 20, 2010 FRN), at 12; Janine Hiller (comment at 27, 2010 FRN), at 447.

201

See

DMA (comment 17, 2010 FRN), at 12; EchoSign (comment 18, 2010 FRN); ESA (comment 20, 2010 FRN), at 10; Toy Industry Association (comment 63, 2010 FRN), at 11.

In the 2011 NPRM, the Commission announced its determination that the record was sufficient to justify certain proposed mechanisms, but insufficient to adopt others. The 2011 NPRM proposed several significant changes to the mechanisms of verifiable parental consent set forth in paragraph (b) of § 312.5, including: Adding several newly recognized mechanisms for parental consent; eliminating the sliding scale approach to parental consent; and adding two new processes for evaluation and pre-clearance of parental consent mechanisms.

1. Electronic Scans and Video Verification

In the 2011 NPRM, the Commission proposed including electronically scanned versions of signed parental consent forms and the use of video verification methods among the Rule's non-exhaustive list of acceptable consent mechanisms. The proposal received support from several commenters, including Yahoo!, the DMA, kidSAFE Seal Program, the

NCTA, and Facebook.

202

Other commenters expressed reservations about whether these new methods would offer practical, economical, or scalable solutions for operators.

203

202

See

Yahoo! (comment 80, 2011 NPRM), at 4; DMA (comment 37, 2011 NPRM), at 23; kidSAFE Seal Program (comment 81, 2011 NPRM), at 16; NCTA (comment 113, 2011 NPRM), at 9; Facebook (comment 50, 2011 NPRM), at 8-9.

203

See

K. Dennis (comment 34, 2011 NPRM), at 2; A. Thierer (comment 162, 2011 NPRM), at 9; R. Newton (comment 118, 2011 NPRM).

As stated in the 2011 NPRM, the Commission finds that electronic scans and video conferencing are functionally equivalent to the written and oral methods of parental consent originally recognized by the Commission in 1999. It does not find the concerns of some commenters, that operators are not likely to widely adopt these methods, a sufficient reason to exclude them from the Rule. The list of consent mechanisms is not exhaustive and operators remain free to choose the ones most appropriate to their individual business models. Therefore, Section 312.5(b) of the final Rule includes electronic scans of signed consent forms and video-conferencing as acceptable methods for verifiable parental consent.

2. Government-Issued Identification

The Commission also proposed in the 2011 NPRM to allow operators to collect a form of government-issued identification—such as a driver's license, or a segment of the parent's Social Security number—from the parent, and to verify the parent's identity by checking this identification against databases of such information, provided that the parent's identification is deleted from the operator's records promptly after such verification is complete. Some operators already use this method of obtaining parental consent, and it is one of several available verification methods offered by the COPPA safe harbor program Privo.

204

In the NPRM, the Commission stated its recognition that information such as Social Security number, driver's license number, or another record of government-issued identification is sensitive data.

205

In permitting operators to use government-issued identification as an approved method of parental verification, the Commission emphasized the importance of limiting the collection of such identification information to only those segments of information needed to verify the data.

206

For example, the Commission noted that the last four digits of a person's Social Security number are commonly used by verification services to confirm a person's identity.

207

The Commission also stated its belief that the requirement that operators immediately delete parents' government-issued identification information upon completion of the verification process provides further protection against operators' unnecessary retention, use, or potential compromise of such information. Commenters in favor of adding this mechanism pointed out that using available technology to check a driver's license number or partial Social Security number reasonably ensures that the person providing consent is the parent.

208

204

See

application of Privo, Inc. to become a Commission-approved COPPA safe harbor program (Mar. 2004),

available at http://www.ftc.gov/os/2004/04/privoapp.pdf,

at 25.

205

The COPPA statute itself lists Social Security number among the items considered to be personal information.

See

16 CFR 312.2. In other contexts, driver's licenses and social security numbers, among other things, have traditionally been considered by Commission staff to be personal, or sensitive, as well.

See

FTC Staff Report, “Self-Regulatory Principles for Online Behavioral Advertising” (Feb. 2009), at 20 n.47, 42, 44,

available at http://www.ftc.gov/os/2009/02/P085400behavadreport.pdf.

206

The use of a driver's license to verify a parent, while not specifically enumerated in the Final Rule as an approved method of parental consent, was addressed in the Statement of Basis and Purpose in connection with a discussion of the methods to verify the identity of parents who seek access to their children's personal information under § 312.6(a)(3) of the Rule.

See

1999 Statement of Basis and Purpose, 64 FR at 59905. There, the Commission concluded that the use of a driver's license was an acceptable method of parental verification.

207

See, e.g.,

Privo, Inc., “Request for Safe Harbor Approval by the Federal Trade Commission for Privo, Inc.'s Privacy Assurance Program under Section 312.10 of the Children's Online Privacy Protection Rule,” 25 (Mar. 3, 2004),

available at http://www.ftc.gov/os/2004/04/privoapp.pdf.

208

For instance, Facebook commented that this mechanism achieves the delicate balance of making it easy for the parent to provide consent, while making it difficult for the child to pose as the parent; when combined with responsible data disposal practices, this method also protects the parent's information against unauthorized use or disclosure.

See

Facebook (comment 50, 2011 NPRM), at 9;

see also

kidSAFE Seal Program (comment 81, 2011 NPRM), at 16.

Other commenters expressed concern that allowing operators to collect sensitive government identification information from parents raises serious privacy implications.

209

Many commenters opined that the serious risks to parents' privacy outweighed the benefits of the proposal.

210

Some further argued that normalizing the use of this sensitive data for such a purpose would diminish users' alertness against identity theft schemes and other potentially nefarious uses.

211

209

Intel and the Marketing Research Association cautioned the Commission to avoid sending mixed messages about using such sensitive information while at the same time advising operators to adhere to principles of data minimization. Intel (comment 72, 2011 NPRM), at 7; Marketing Research Association (comment 97, 2011 NPRM), at 3.

210

See

Institute for Public Representation (comment 71, 2011 NPRM), at 42;

see also

TechFreedom (comment 159, 2011 NPRM), at 8 (requiring users to go through an age verification process would lead to a loss of personal privacy); New York Intellectual Property Law Association (comment 117, 2011 NPRM), at 3 (parents' privacy rights should not needlessly be put at risk in order to protect their children's privacy).

211

See

CDT (comment 17, 2011 NPRM), at 9; A. Thierer (comment 162, 2011 NPRM), at 8.

As the federal agency at the forefront of improving privacy protections for consumers, the Commission is sensitive to the privacy concerns raised by the comments. The Commission is also aware that both operators and parents benefit from having a choice of several acceptable methods for verifiable parental consent. Moreover, the Commission is not compelling any operator to use this method. The Commission believes that, on balance, government-issued ID provides a reliable and simple means of verifying that the person providing consent is likely to be the parent, and that the requirement that operators delete such data immediately upon verification substantially minimizes the privacy risk associated with that collection. Therefore, the Commission adopts this method among the Rule's non-exhaustive list of acceptable consent methods.

212

kidSAFE Seal Program asked the Commission to consider whether operators can retain parents' verification information as proof that the verification occurred.

See

kidSAFE Seal Program (comment 81, 2011 NPRM), at 16. With regard to credit card information or government-issued identifiers, the Commission would consider whether an operator had retained a sufficiently truncated portion of the data as to make it recognizable to the parent but unusable for any other purpose.

3. Credit Cards

The 2011 NPRM also proposed including the term “monetary” to modify “transaction” in connection with use of a credit card to verify parental consent. This added language was intended to make clear the Commission's long-standing position that the Rule limits use of a credit card as a method of parental consent to situations involving actual monetary transactions.

213

The Commission received one comment specifically addressing this proposed language; EPIC supported the change as correctly limiting the circumstances under which

credit cards can be used as verification. The final Rule incorporates this change, stating “credit card in connection with a monetary transaction.”

214

213

See

71 FR at 13247, 13253, 13254 (Mar. 15, 2006) (requirement that the credit card be used in connection with a transaction provides extra reliability because parents obtain a transaction record, which is notice of the purported consent, and can withdraw consent if improperly given); Fed. Trade Comm'n, Frequently Asked Questions about the Children's Online Privacy Protection Rule, Question 33,

available at http://www.ftc.gov/privacy/coppafaqs.shtm#consent.

214

But see

Part II.C.4.,

infra.

Several comments note that some alternative payment systems, such as the use of a username and password in the iTunes store, afford equal notice and protections to parents for both paid and unpaid transactions by providing the primary account holder with a separate, contemporaneous notification of each discrete transaction.

4. Alternative Online Payment Systems

At the outset of the Rule review, the Commission sought comment on whether to consider modifying the Rule to include alternative online payment systems, in addition to credit cards, as an acceptable means of verifying parental consent in connection with a monetary transaction. The Commission stated in the 2011 NPRM that, at such time, the record was insufficient to support a proposal to permit the use of alternative online payment systems for this purpose. The NPRM also indicated that the Commission was mindful of the potential for children's easy access to, and use of, alternative forms of payments (such as gift cards, debit cards, and online accounts). Thus, the Commission welcomed further discussion of the risks and benefits of using electronic payment methods as a consent mechanism.

Several commenters to the 2011 NPRM asked the Commission to reconsider its position that online payment systems are not yet reliable enough to provide verifiable parental consent, arguing that certain online payment options can meet the same stringent criteria as credit cards.

215

In particular, Scholastic stressed the importance to operators, particularly in the context of digital apps and other downloadable content, of providing customers the flexibility to use various convenient electronic payment methods. Scholastic urged the Commission to amend the Rule to provide that payment methods other than credit cards, such as debit cards and electronic payment systems, can satisfy the Rule's consent mechanism requirements if they provide separate notification of each discrete monetary transaction to the primary account holder.

216

215

See, e.g.,

Association for Competitive Technology (comment 5, 2011 NPRM), at 7; DMA (comment 37, 2011 NPRM), at 23; eBay (comment 40, 2011 NPRM), at 3-4; kidSAFE (comment 81, 2011 NPRM), at 16; Scholastic (comment 144, 2011 NPRM), at 9-10.

216

Other commenters similarly urged that the Rule permit the use of alternate payment systems, where such systems are tied to a valid credit card account, require the user to enter a password, and provide the primary account holder with clear notification of each transaction through email confirmation.

See

Association for Competitive Technology (comment 5, 2011 NPRM), at 7; kidSAFE (comment 81, 2011 NPRM), at 16;

see also

eBay (comment 40, 2011 NPRM), at 3-4 (indicating its interest in leveraging PayPal business model to implement a youth account program directly linking children's accounts to verified parent accounts).

The Commission, upon review of all of the relevant comments, is persuaded that it should allow the use of other payment systems, in addition to credit cards, provided that any such payment system can meet the same stringent criteria as a credit card. As Scholastic articulated in its comment, the Rule should allow operators to use any electronic or online payment system as an acceptable means of obtaining verifiable parental consent in connection with a monetary transaction where (just as with a credit card) the payment system is used in conjunction with a direct notice meeting the requirements of § 312.4(c) and the operator provides notification of each discrete monetary transaction to the primary account holder. Accordingly, § 312.5(b)(2) of the final Rule includes the following language “requiring a parent, in connection with a monetary transaction, to use a credit card, debit card, or other online payment system that provides notification of each discrete transaction to the primary account holder.”

5. Electronic or Digital Signatures

In response to the 2010 FRN, several commenters recommended that the Commission accept electronic or digital signatures as a form of verifiable consent.

217

In the 2011 NPRM, the Commission concluded that the term “electronic signature” has many meanings, ranging from “an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record,”

218

to an electronic image of the stylized script associated with a person. The Commission determined that electronic signatures, without more indicia of reliability, were problematic in the context of COPPA's verifiable parental consent requirement.

219

The NPRM welcomed further comment on how to enhance the reliability of these convenient methods.

217

See

DMA (comment 17, 2010 FRN), at 12; EchoSign (comment 18, 2010 FRN); ESA (comment 20, 2010 FRN), at 10; Toy Industry Association (comment 63, 2010 FRN), at 11. For instance, the ESA proposed that the Commission incorporate a “sign and send” method, given that numerous commonly available devices allow users to input data by touching or writing on the device's screen.

218

See

Electronic Signatures in Global and National Commerce Act, 15 U.S.C. 7006(5).

219

See

2011 NPRM at 59818. (The Commission indicated several concerns about allowing electronic signatures, including that, given the proliferation of mobile devices among children and the ease with which children could sign and return an on-screen consent, such mechanisms may not “ensure that the person providing consent is the child's parent.” The Commission also noted that, although the law recognizes electronic signatures for the assertion that an individual signed a document, they do not necessarily confirm the underlying identity of the individual signing the document).

In commenting on the 2011 NPRM, several commenters asked the FTC to reconsider the utility of electronic signatures in the online world.

220

The Commission has determined not to include electronic or digital signatures within the non-exhaustive list of acceptable consent mechanisms provided for in § 312.5, given the great variability in the reliability of mechanisms that may fall under this description. For instance, the Commission believes that simple digital signatures, which only entail the use of a finger or stylus to complete a consent form, provide too easy a means for children to bypass a site or service's parental consent process, and thus do not meet the statutory standard of “reasonably calculated, in light of available technology, to ensure that the person providing consent is the child's parent.”

221

However, the Rule would not prohibit an operator's acceptance of a digitally signed consent form where the signature provides other indicia of reliability that the signor is an adult, such as an icon, certificate, or seal of authenticity that accompanies the signature. At the same time, the Commission does not seek to limit or proscribe other types of digital signatures that may also meet the statutory standard. For these reasons, digital or electronic signatures are not included within the Rule's non-

exhaustive list of parental consent mechanisms.

220

See, e.g.,

DMA (comment 37, 2011 NPRM), at 23 (Congress passed ESIGN Act over a decade ago and consumers prefer completing transactions online with digital signatures over using cumbersome offline processes); ESA (comment 47, 2011 NPRM), at 22-23 (electronic sign-and-send method meets the statutory standard of “reasonably calculated, in light of available technology, to ensure that the person providing consent is the child's parent,” while accommodating parents' use of tablet, mobile device, and small-screen technologies lacking computer peripherals such as printers or scanners); TechFreedom (comment 159, 2011 NPRM), at 8 (urging Commission to promote development of solutions such as electronic signatures now, rather than wait for next Rule revision).

221

While the Commission recognizes that some children also may circumvent the Rule's parental notice and consent mechanisms by signing and sending parental consent forms through mail, fax, or electronic scan, it believes these methods clearly are not as simple for the child as using a computer or handheld device to instantly pen and send a signature.

6. Platform Methods of Parental Consent

In response to the 2010 FRN, several commenters asked the Commission to consider whether, and in what circumstances, parental control features in game consoles, and presumably other devices, could be used to provide notice to parents and obtain verified consent under COPPA.

222

In the 2011 NPRM, the Commission acknowledged that parental control features can offer parents a great deal of control over a child's user experience and can serve as a

complement

to COPPA's parental consent requirements. However, the Commission concluded that, at that time, it did not appear that any such systems were adequately designed to comply with COPPA, and that the record was insufficient for it to determine whether a hypothetical parental consent mechanism would meet COPPA's verifiable parental consent standard. The Commission, in the 2011 NPRM, encouraged continued exploration of the concept of using parental controls in gaming consoles and other devices to notify parents and obtain their prior verifiable consent.

223

222

See

ESA (comment 20, 2010 FRN), at 4; Microsoft (comment 39, 2010 FRN), at 7.

223

2011 NPRM, 76 FR 59818 (Sept. 27, 2011),

available at http://ftc.gov/os/2011/09/110915coppa.pdf.

In response to both the 2011 NPRM and the 2012 SNPRM, numerous stakeholders, including several platform providers, Web site and app developers, and child and privacy advocates, asked the Commission to consider modifications to the Rule to make clear that operators can choose to use a common mechanism—administered by a platform, gaming console, device manufacturer, COPPA safe harbor program,

224

or other entity—for the purpose of providing notice and obtaining parental consent for multiple operators simultaneously.

225

Commenters offered a variety of proposals. For instance, several commenters envisioned that platform providers could provide a general notice and obtain consent to collect personal information for those purposes specified in the general notice, and that app developers wanting to collect or use information in ways differing from the general notice would need to independently provide a second separate notice to parents and obtain their consent.

226

Facebook proposed that operators may also use such common consent mechanisms to meet other COPPA obligations, such as providing parental access to children's data collected by operators.

227

The Walt Disney Company proposed two possible mechanisms: a “ ‘Kids Privacy Portal'—through which parents can express privacy preferences in one place for multiple online activities,” or a joint agreement between the platform operator and application providers “that determines how data will be collected and used, and how parents exercise control.”

228

The Entertainment Software Association (“ESA”) proposed a similar program for video game platforms whereby consoles or hand-held device makers could leverage their existing parental controls technologies.

229

224

The Commission notes that Privo, Inc., one of the approved COPPA safe harbors, offers the option to its members to have Privo administer notice and consent programs for member operators.

225

See, e.g.,

P. Aftab (comment 1, 2012 SNPRM), at 7; Association for Competitive Technology (comment 5, 2011 NPRM), at 7-8 and (comment 7, 2012 SNPRM), at 8; Computer and Communications Industry Association (“CCIA”) (comment 27, 2011 NPRM), at 7-8; CDT (comment 15, 2012 SNPRM), at 5-6; Connect Safely (comment 21, 2012 SNPRM), at 3; ESA (comment 47, 2011 NPRM), at 21-26; Facebook (comment 33, 2012 SNPRM), at 18-20; Future of Privacy Forum (comment 55, 2011 NPRM), at 5-6 and (comment 37, 2012 SNPRM), at 3-6; Microsoft (comment 107, 2011 NPRM), at 13-15 and (comment 66, 2012 SNPRM), at 6; Novachi, Inc. (comment 119, 2011 NPRM); SIIA (comment 150, 2011 NPRM), at 10-12; TechFreedom (comment159, 2011 NPRM), at 7 and (comment 88, 2012 SNPRM), at 13; The Walt Disney Co. (comment 170, 2011 NPRM), at 17-19.

226

See, e.g.,

Association for Competitive Technology (comment 5, 2011 NPRM), at 7-8 and (comment 7, 2012 SNPRM), at 8; CCIA (comment 27, 2011 NPRM), at 7-8; Facebook (comment 33, 2012 SNPRM), at 18-20; Future of Privacy Forum (comment 55, 2011 NPRM), at 5-6 and (comment 37, 2011 SNPRM), at 3-6; Microsoft (comment 107, 2011 NPRM), at 13-15 and (comment 66, 2012 SNPRM), at 13; SIIA (comment 150, 2011 NPRM), at 10-12. Future of Privacy Forum's 2012 comment included proposed Rule language.

see also

ConnectSafely.org (comment 21, 2012 SNPRM), at 3; P. Aftab (comment 1, 2012 SNPRM), at 7; Tech Freedom (comment 159, 2011 NPRM), at 7.

231

For example, Microsoft stated that common consent mechanisms “would benefit parents because requiring each third party separately to obtain parental consent could be confusing, overwhelming, and costly for parents.” Microsoft (comment 66, 2012 SNPRM), at 6.

232

Microsoft,

id.; see also

CCIA (comment 27, 2011 NPRM), at 8; Facebook (comment 33, 2012 SNPRM), at 19 (“A rule that enables operators to leverage a common platform for notice and consent would substantially advance the Commission's goal of ensuring that parents receive clear, understandable, and manageable information; it would also minimize the practical and economic costs to parents as a result of multiple consent requests.”); TechAmerica (comment 87, 2012 SNPRM), at 8.

233

CDT (comment 15, 2012 SNPRM), at 6.

The Commission believes that common consent mechanisms, such as a platform, gaming console, or a COPPA safe harbor program, hold potential for the efficient administration of notice and consent for multiple operators. A well-designed common mechanism could benefit operators (especially smaller ones) and parents alike if it offers a proper means for providing notice and obtaining verifiable parental consent, as well as ongoing controls for parents to manage their children's accounts.

234

The Commission believes

that such methods could greatly simplify operators' and parents' abilities to protect children's privacy.

234

Under the system proposed by the Future of Privacy Forum, parents would be apprised of a common set of information practices to which they could consent on an aggregate basis, then would

receive individualized notices for additional practices that go beyond those outlined in the common notice. The platform would also ensure that parents have access to easy mechanisms through which to retract their consent to the child's use of any particular site or service. Future of Privacy Forum (comment 37, 2012 SNPRM), at 4-6.

Despite the potential benefits, the Commission declines, at this time, to adopt a specific provision for the following reasons. First, even without an express reference in the Rule to such a process, nothing forecloses operators from using a common consent mechanism so long as it meets the Rule's basic notice and consent requirements.

235

Second, the Commission did not specifically seek comment on this precise issue; nor has it proposed any language in either the NPRM or the SNPRM to address this point. Accordingly, the Commission is reluctant to adopt specific language without the benefit of notice and comment on such language to explore all potential legal and practical challenges of using a common consent mechanism.

236

Finally, the Commission believes that parties interested in using a common consent mechanism have the option to participate in the voluntary Commission approval process set forth in Section 312.5(3) of the final Rule.

237

That process would enable the Commission to evaluate, and other interested parties to publicly comment upon, such proposals in an effort to bring to market sound and practical solutions that will serve a broad base of operators.

235

As noted in note 219,

supra,

one such common consent mechanism is currently provided by an approved COPPA safe harbor, and there may be others already in operation as well.

236

The Commission would want to explore further the difficulties of making sure the notice accurately reflects each individual operator's information practices; how to provide parents with a means to access the operator's privacy policy with regard to information collected from children; and giving parents controls sufficient to refuse to permit an operator's further use or future collection of their child's personal information, and to direct the operator to delete the child's personal information and or disable the child's account with that operator.

237

See

Part II.C.8.,

infra.

7. The Sliding Scale (“Email Plus”) Method

In conducting the Rule review, the Commission sought comment on whether the sliding scale set forth in § 312.5(b)(2) remains a viable approach to verifiable parental consent.

238

Under the sliding scale, an operator, when collecting personal information only for its

internal

use, may obtain verifiable parental consent through an email from the parent, so long as the email is coupled with an additional step.

239

Such an additional step has included obtaining a postal address or telephone number from the parent and confirming the parent's consent by letter or telephone call, or sending a delayed confirmatory email to the parent after receiving consent.

240

The purpose of the additional step is to provide greater assurance that the person providing consent is, in fact, the parent. This consent method is often called “email plus.”

241

238

See

2010 Rule Review,

supra

note 6, at 17091.

239

The sliding scale approach was adopted in the Rule in response to comments that stated that internal uses of information, such as marketing to children, presented less risk than external disclosures of the information to third parties or through public postings.

See

1999 Statement of Basis and Purpose, 64 FR at 59901. Other internal uses of children's personal information may include sweepstakes, prize promotions, child-directed fan clubs, birthday clubs, and the provision of coupons.

240

The Commission notes that, assuming an operator has obtained a parent's mobile phone number from the parent in response to the first email, confirmation of a parent's consent may done via an SMS or MMS text to the parent.

241

By contrast, for uses of personal information that involve disclosing the information to the public or third parties, the Rule requires operators to use more reliable methods of obtaining verifiable parental consent, including but not limited to those identified in § 312.5(b)(1).

In adopting the sliding scale approach in 1999, the Commission recognized that the email plus method was not as reliable as the other enumerated methods of verifiable parental consent.

242

However, it believed that this lower cost option was acceptable as a temporary option, in place until the Commission determined that more reliable (and affordable) consent methods had adequately developed.

243

In 2006, the Commission extended use of the sliding scale indefinitely, stating that the agency would continue to monitor technological developments and modify the Rule should an acceptable electronic consent technology develop.

244

242

64 FR at 59902 (“[E]mail alone does not satisfy the COPPA because it is easily subject to circumvention by children.”).

243

See id.

at 59901 (“The Commission believes it is appropriate to balance the costs imposed by a method against the risks associated with the intended uses of the information collected. Weighing all of these factors in light of the record, the Commission is persuaded that temporary use of a “sliding scale” is an appropriate way to implement the requirements of the COPPA until secure electronic methods become more available and affordable.”).

244

See

71 FR at 13247, 13255, 13254 (Mar. 15, 2006).

Email plus has enjoyed wide appeal among operators, who credit its simplicity.

245

The Commission sought comment in response to the 2010 FRN and at the June 2010 public roundtable on whether to retain email plus in the final Rule. Numerous commenters to the 2010 FRN, including associations who represent operators, supported the continued retention of this method as a low-cost means to obtain parents' consent.

246

At the same time, several commenters, including safe harbor programs and proponents of new parental consent mechanisms, challenged the method's reliability, given that operators have no real way of determining whether the email address a child provides is that of the parent, and there is no requirement that the parent's email response to the operator contain any additional information providing assurance that it is from a parent.

247

245

See

WiredSafety.org (comment 68, 2010 FRN), at 21 (“We all assum

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.