GeoCities; Analysis to Aid Public Comment

FEDERAL TRADE COMMISSION

[File No. 982-3015]

GeoCities; Analysis to Aid Public Comment

AGENCY: Federal Trade Commission.

ACTION:Proposed Consent Agreement.

-----------------------------------------------------------------------

SUMMARY: The consent agreement in this matter settles alleged

violations of federal law prohibiting unfair or deceptive acts or

practices or unfair methods of competition. The attached Analysis to

Aid Public Comment describes both the allegations in the draft

complaint that accompanies the consent agreement and the terms of the

consent order--embodied in the consent agreement--that would settle

these allegations.

DATES: Comments must be received on or before October 19, 1998.

ADDRESSES: Comments should be directed to: FTC/Office of the Secretary,

Room 159, 6th St. and Pa. Ave., NW., Washington, DC 20580.

FOR FURTHER INFORMATION CONTACT: Lee Peeler or Joel Winston, FTC/S-

4002, Washington, DC 20580. (202) 326-3090 or 326-3153.

SUPPLEMENTARY INFORMATION: Pursuant to Section 6(f) of the Federal

Trade Commission Act, 38 Stat. 721, 15 U.S.C. 46 and Section 2.34 of

the Commission's Rules of Practice (16 CFR 2.34), notice is hereby

given that the above-captioned consent agreement containing a consent

order to cease and desist, having been filed with and accepted, subject

to final approval, by the Commission, has been placed on the public

record for a period of sixty (60) days. The following Analysis to Aid

Public Comment describes the terms of the consent agreement, and the

allegations in the complaint. An electronic copy of the full text of

the consent agreement package can be obtained from the FTC Home Page

(for August 13, 1998), on the World Wide Web, at ``http://www.ftc.gov/

os/actions97.htm.'' A paper copy can be obtained from the FTC Public

Reference Room, Room H-130, Sixth Street and Pennsylvania Avenue, N.W.,

Washington, DC 20580, either in person or by calling (202) 326-3627.

Public comment is invited. Such comments or views will be considered by

the Commission and will be available for inspection and copying at its

principal office in accordance with Section 4.9(b)(6)(ii) of the

Commission's Rules of Practice (16 CFR 4.9(b)(6)(ii)).

Analysis of Proposed Consent Order to Aid Public Comment

The Federal Trade Commission has accepted, subject to final

approval, an agreement containing a consent order from GeoCities, the

operator of a Web site on the World Wide Web (``Web''), located at

http://www.geocities.com.

The proposed consent order has been placed on the public record for

sixty (60) days for reception of comments by interested persons.

Comments received during this period will become part of the public

record. After sixty (60) days, the Commission will again review the

agreement and the comments received and will decide whether it should

withdraw from the agreement or make final the agreement's proposed

order.

The GeoCities Web site is a ``virtual community'' consisting of

members' personal home pages organized into 40 themed areas, called

``neighborhoods,'' One such neighborhood is the ``Enchanted Forest''

described as a ``community for and by kids.'' GeoCities provides

numerous services to its members, including free and fee-based personal

home pages, free e-mail service, contests, and children's clubs, among

other activities. Persons wishing to become a member of GeoCities must

complete an application form. The

[[Page 44625]]

application form requests certain mandatory personally identifiable

information about the applicant and certain other information it

designates as ``optional.'' The form also asks applicants to designate

whether they wish to receive specific ``special offers'' from

advertisers, and specific products or services from individual

companies.

The Commission's complaint in this matter alleges that GeoCities

engaged in three deceptive practices in connection with its collection

and use of personal identifying information from consumers. First, the

complaint alleges that GeoCities falsely represented that the personal

identifying information it collects through the membership application

form is used only to provide members the specific advertising offers

and products or services they request. In fact, according to the

complaint, that information has been sold, rented or otherwise

disclosed to third parties who have used it for purposes other than

those for which members have given permission.

Second, the complaint alleges that GeoCities falsely represented

that the ``optional information'' it collects through the application

form is not disclosed to third parties without the member's permission.

In fact, the complaint alleges, GeoCities has disclosed this

information to third parties who have used it to target advertising

back to the member.

The third allegation relates to two specific activities in the

Enchanted Forest neighborhood. GeoCities promotes the Official

GeoCities' GeoKidz Club; children wishing to join are required to

complete the Membership Request Form that solicits personal identifying

information. GeoCities also promotes certain Enchanted Forest contests;

children wishing to participate are required to complete an entry form

that solicits personal identifying information. The complaint alleges

that GeoCities has falsely represented that it collects and maintains

the children's personal identifying information collected through the

GeoKidz Club Membership Request Form and the Enchanted Forest Contest

Entry form. In fact, the Club and contest are run by third party

``community leaders'' hosted on the GeoCities Web site, and those third

parties actually collect and maintain the children's information.

Part I of the proposed order prohibits GeoCities from making any

misrepresentation about its collection or use of personal identifying

information from or about consumers, including what information will be

disclosed to third parties and how the information will be used. The

order defines ``personal identifying information'' as including but not

limited to, ``first and last name, home or other physical address (e.g.

school), e-mail address, telephone number, or any information that

identifies a specific individual, or any information which when tied to

the above becomes identifiable to a specific individual.''

Part II of the proposed order prohibits GeoCities from

misrepresenting either the identity of a party collecting any personal

identifying information or the sponsorship of any activity on its Web

site.

Part III prohibits GeoCities from collecting personal identifying

information from any child if GeoCities has actual knowledge that the

child does not have a parent's permission to provide the information.

The order defines ``child'' as ages twelve and under.

Parts IV and V of the order are designed as fencing-in provisions

to prevent violations of consumers' information privacy in the future.

Part IV orders GeoCities to post a clear and prominent notice on its

Web Site explaining GeoCities' practices with regard to its collection

and use of personal identifying information. The notice must include

the following:

(a) What information is being collected;

(b) Its intended use(s);

(c) The third parties to whom it will be disclosed;

(d) How the consumer can obtain access to the information; and

(e) How the consumer can have the information removed from

GeoCities' databases.

The notice must appear on the Web site's home page and at each

location on the site at which such information is collected, although

the collection of so-called ``tracking'' information need only be

disclosed on the home page.

Part IV includes a ``safe harbor'' provision that deems a specified

procedure to be in compliance with this Part. It would allow GeoCities

to post a Privacy Notice on its home page along with a clear and

prominent hyperlink to that notice at each location on the site at

which personal identifying information is collected. The hyperlink

would be accompanied by the following statement:

NOTICE: We collect personal information on this site. To learn more

about how we use your information click here.

Part V of the proposed order sets forth the principles of parental

choice and control. This Part requires GeoCities to implement a

procedure to obtain ``express parental consent'' prior to collection

and using children's identifying information, a procedure commonly

referred to as ``opt-in''. The proposed order provides GeoCities with

flexibility in designing its procedures, so long as they meet the

objective of ensuring prior parental consent. This flexibility reflects

the likelihood of future technological developments to facilitate

parental consent in the online medium.

In addition, this Part includes a ``safe harbor'' procedure. Under

it, GeoCities may collect certain, limited screening information from

prospective site registrants to identify those twelve and under. Prior

to collecting any further information, GeoCities will then send the

parent an e-mail providing notice of the child's interest in

registering and instructing the parent to go to a specified location on

the site to register the child and provide consent to GeoCities'

collection and use of the information. The order provides several means

by which GeoCities may obtain express parental consent, including (1) a

statement signed by the parent that is mailed or faxed to GeoCities,

(2) a credit card authorization, (3) e-mail from the parent with an

electronically verifiable signature, (4) a procedure authorized by

statute, rule or FTC guideline, or (5) any other procedure that ensures

verified parental consent and the parent's identity. GeoCities must

hold secure all screening information and may use it only to provide

notice to the child or parent, or to block the child from further

attempts to register without parental consent.

Part VI addresses the information that GeoCities previously

collected from consumers. It requires GeoCities to notify all such

consumers (in the case of children, their parents) and to give them an

opportunity to have their information removed from GeoCities' and third

parties' databases. Those over the age of twelve will be given notice

and the opportunity to remove their information (commonly referred to

as ``opt-out''). For children, GeoCities must remove all such

information (including home pages and e-mail accounts) unless a parent

grants express consent to its continued retention and use (``opt-in'')

GeoCities' information removal obligations also include the

responsibility to contact third parties to whom it previously has

disclosed the information and to request that those parties delete that

information as well. GeoCities must obtain a statement from all such

third parties that they intend to comply with the above requirements,

and must cease doing business with any such party that refuses to

provide the statement or who

[[Page 44626]]

GeoCities knows or has reason to know is failing to delete the

information upon request. GeoCities must also provide consumers with a

reasonable and secure means to access the information that GeoCities

previously collected from them.

Part VII permits GeoCities to retain certain personally

identifiable information in its ``archived database'' for the limited

purposes of site maintenance, computer file back-up, blocking a child's

attempt to register without parental consent, or to respond to requests

for such information from law enforcement agencies or pursuant to

judicial process. GeoCities must disclose its retention of information

in the archived database in its privacy notice.

Part VIII is a consumer education provision. It requires that for

five years GeoCities place a clear and prominent hyperlink within its

privacy notice directing visitors to the FTC's Web site to view

educational material on consumer privacy. Currently, the FTC site

contains a brochure entitled: ``Site-Seeing on the Internet,'' which

can be found at www.ftc.gov/bcp/conline/pubs/online/sitesee/index.html.

Part IX outlines GeoCities' recordkeeping requirements under the

proposed order. Part X requires GeoCities to deliver a copy of the

order to certain company officers and personnel. Part XI requires

GeoCities to establish an ``information practices training program''

for employees and GeoCities Community Leaders, volunteers who provide a

variety of services to GeoCities' members. The program must include

training about GeoCities' privacy policies, information security

procedures, and disciplinary procedures for violations of its privacy

policies.

Parts XII and XIII require GeoCities to notify the Commission of

any change in its corporate structure that might affect compliance with

the order; and to file compliance reports with the Commission. Part XIV

is a ``sunset'' provision, dictating that the order will terminate in

twenty years absent certain circumstances.

The purpose of this analysis is to facilitate public comment on the

proposed order. It is not intended to constitute an official

interpretation of the agreement and proposed order or to modify in any

way their terms.

By direction of the Commission.

Benjamin I. Berman,

Acting Secretary.

[FR Doc. 98-22444 Filed 8-19-98; 8:45 am]

BILLING CODE 6750-01-M