[Federal Register: January 14, 2005 (Volume 70, Number 10)]
[Proposed Rules]
[Page 2580-2582]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr14ja05-19]
=======================================================================
-----------------------------------------------------------------------
FEDERAL TRADE COMMISSION
16 CFR Part 312
RIN 3084-AB00
Children's Online Privacy Protection Rule
AGENCY: Federal Trade Commission (FTC).
ACTION: Notice of proposed rulemaking, request for comment.
-----------------------------------------------------------------------
SUMMARY: The Federal Trade Commission proposes amending the Children's
Online Privacy Protection Rule (``the Rule'') to permanently allow
website operators and online services to obtain verifiable parental
consent for the collection of personal information from children for
internal use by the website operator through sending an e-mail message
to parents coupled with additional steps.
DATES: Comments must be received by February 14, 2005.
ADDRESSES: Interested parties are invited to submit written comments.
Comments should refer to ``Sliding Scale 2005, Project No. P054503'' to
facilitate the organization of comments. A comment filed in paper form
should include this reference both in the text and on the envelope, and
should be mailed or delivered to the following address: Federal Trade
Commission/Office of the Secretary, Room 159-H (Annex Y), 600
Pennsylvania Avenue, NW., Washington, DC 20580. Comments containing
confidential material must be filed in paper form, must be clearly
labeled ``Confidential,'' and must comply with Commission Rule 4.9(c).
16 CFR 4.9(c) (2004).\1\
---------------------------------------------------------------------------
\1\ The comment must be accompanied by an explicit request for
confidential treatment, including the factual and legal basis for
the request, and must identify the specific portions of the comment
to be withheld from the public record. The request will be granted
or denied by the Commission's General Counsel, consistent with
applicable law and the public interest. See Commission Rule 4.9(c),
16 CFR 4.9(c).
---------------------------------------------------------------------------
Comments filed in electronic form should be submitted by clicking
on the following Web link: https://secure.commentworks.com/ftcslidingscale/
and following the instructions on the Web-based form.
To ensure that the Commission considers an electronic comment, you must
file it on the Web-based form at the https://secure.commentworks.com/ftcslidingscale/
Web link. You may also visit http://
http://www.regulations.gov to read this notice of proposed rulemaking, and may
file an electronic comment through that Web site. The Commission will
consider all comments that regulations.gov forwards to it.
The FTC Act and other laws the Commission administers permit the
collection of public comments to consider and use in this proceeding as
appropriate. All timely and responsive public comments, whether filed
in paper or electronic form, will be considered by the Commission, and
will be available to the public on the FTC Web site, to the extent
practicable, at http://www.ftc.gov/privacy/privacyinitiatives/childrens_lr.html.
As a matter of discretion, the FTC makes every
effort to remove home contact information for individuals from the
public comments it receives before placing those comments on the FTC
Web site. More information, including routine uses permitted by the
Privacy Act, may be found in the FTC's privacy policy, at http://www.ftc.gov/ftc/privacy.htm
.
FOR FURTHER INFORMATION CONTACT: Rona Kelner, (202) 326-2752, or Karen
Muoio, (202) 326-2491, Division of Advertising Practices, Bureau of
Consumer Protection, Federal Trade Commission, 601 New Jersey Avenue
NW., Washington, DC 20580.
SUPPLEMENTARY INFORMATION:
I. Background
On October 20, 1999, the Commission issued its final Rule \2\
pursuant to the Children's Online Privacy Protection Act (``COPPA''),
15 U.S.C. 6501, et seq. The Rule imposes certain requirements on
operators of websites or online services directed to children under 13
years of age, or other websites or online services that have actual
knowledge that they have collected personal information from a child
under 13 years of age. Among other things, the Rule requires that
website operators or online services obtain verifiable parental consent
prior to collecting, using, or disclosing personal information from
children under 13 years of age.
---------------------------------------------------------------------------
\2\ 64 FR 59888 (1999).
---------------------------------------------------------------------------
II. The Sliding Scale
The Rule provides that, ``[a]ny method to obtain verifiable
parental consent must be reasonably calculated, in light of available
technology, to ensure that the person providing consent is the child's
parent.'' \3\ The Rule sets forth a sliding scale approach to obtaining
verifiable parental consent. If the website operator is collecting
personal information for its internal use only, the Rule allows
verifiable parental consent to be obtained through the use of an e-mail
message to the parent, coupled with additional steps to provide
assurances that the parent is providing the consent. Such additional
steps include: sending a confirmatory e-mail to the parent after
receiving consent or obtaining a postal address or telephone number
from the parent and confirming the parent's consent by letter or
telephone call.\4\
---------------------------------------------------------------------------
\3\ 16 CFR 312.5(b)(1).
\4\ Id.
---------------------------------------------------------------------------
In contrast, for uses of personal information that will involve
disclosing the information to the public or third parties, the Rule
requires that website operators use more reliable methods of obtaining
verifiable parental consent. These methods include: using a print-and-
send form that can be faxed or mailed back to the website operator;
requiring a parent to use a credit card in connection with a
transaction; having a parent call a toll-free telephone number staffed
by trained personnel; using a digital certificate that uses public key
technology; and using e-mail accompanied by a PIN or password obtained
through one of the above methods.\5\
---------------------------------------------------------------------------
\5\ 16 CFR 312.5(b)(2).
---------------------------------------------------------------------------
An effect of the sliding scale is that the relatively lower cost of
seeking permission for internal use of children's information may
encourage website operators to collect personal information for their
internal use only, rather than for disclosure to third parties and the
public. As noted in the Rule's Statement of Basis and Purpose, ``the
record shows that disclosures to third parties are among the most
sensitive and potentially risky uses of children's personal
information.'' \6\
---------------------------------------------------------------------------
\6\ 64 FR 59899 (1999).
---------------------------------------------------------------------------
The sliding scale was originally set to expire on April 21, 2002,
but was extended, following a notice and public comment period, for an
additional three years.\7\ It is now scheduled to expire on April 21,
2005, at which time website operators would have to obtain verifiable
parental consent using the more reliable (and costly) methods for all
uses of personal information.\8\ At the time it issued the final Rule,
the Commission anticipated that the sliding scale was necessary only in
the short term because more reliable methods of obtaining verifiable
parental consent would soon be widely available at a
[[Page 2581]]
reasonable cost. At the present time, however, as in 2002, it appears
that the expected progress in available technology has not occurred.
The Commission therefore proposes to amend the Rule to make the sliding
scale mechanism permanent.\9\ The Commission requests public comment on
this proposed amendment.
---------------------------------------------------------------------------
\7\ See http://www.ftc.gov/privacy/privacyinitiatives/childrens_lr.html
for notice and public comments.
\8\ 67 FR 18818 (2002).
\9\ The Commission would continue to monitor developments in the
technology available to obtain verifiable parental consent at a
reasonable cost.
---------------------------------------------------------------------------
III. Request for Comments
The Commission proposes to amend the Children's Online Privacy
Protection Rule to make permanent the sliding scale mechanism for
obtaining verifiable parental consent. Members of the public are
invited to comment on any issues or concerns they believe are relevant
or appropriate to the Commission's consideration of this proposed
amendment, including written data, views, facts, and arguments
addressing the proposed amendment to the Rule. All comments should be
filed as prescribed in the ADDRESSES section above, and must be
received by February 14, 2005. The Commission is particularly
interested in comments addressing the following questions:
(1) Are secure electronic mechanisms now widely available to
facilitate verifiable parental consent at a reasonable cost? Please
include comments on the following:
(a) Digital signature technology;
(b) Digital certificate technology;
(c) Other digital credentialing technology;
(d) P3P technology; and
(e) Other secure electronic technologies.
(2) Are infomediary services now widely available to facilitate
verifiable parental consent at a reasonable cost?
(3) When are secure electronic mechanisms and/or infomediary
services for obtaining verifiable parental consent anticipated to
become available at a reasonable cost? To what extent would the
Commission's decision to eliminate, make permanent, or extend the
sliding scale mechanism affect the incentive to develop and deploy
these means of obtaining verifiable parental consent?
(4) What effect would eliminating the sliding scale have on the
information collection and use practices of website operators? For
example, would the elimination of the sliding scale mechanism encourage
website operators to collect children's personal information for uses
other than the operators' own internal use because the cost of
obtaining parental consent would be the same for internal as well as
external uses?
(5) Is there any evidence that the sliding scale mechanism is being
misused, or is not working effectively?
(6) Should the sliding scale mechanism be extended? If so, why and
for how long?
(7) Should the sliding scale mechanism be eliminated? If so, why?
(8) Should the sliding scale mechanism be made permanent? If so,
why?
IV. Communications by Outside Parties to Commissioners or Their
Advisors
Written communications and summaries of transcripts of oral
communications respecting the merits of this proceeding from any
outside party to any Commissioner or Commissioner's advisor will be
placed on the public record. See 16 CFR 1.26(b)(5).
V. Paperwork Reduction Act
The proposed amendment to the Rule does not change any information
collection requirements that have previously been reviewed and approved
by the Office of Management and Budget pursuant to the Paperwork
Reduction Act, 44 U.S.C. 3501 et seq.
VI. Regulatory Flexibility Act
The Regulatory Flexibility Act (``RFA''), 5 U.S.C. 601-612,
requires that the Commission provide an Initial Regulatory Flexibility
Analysis (``IRFA'') with a proposed rule and a Final Regulatory
Flexibility Analysis (``FRFA''), if any, with the final rule, unless
the Commission certifies that the rule will not have a significant
economic impact on a substantial number of small entities. 5 U.S.C.
603-605.
The Commission does not anticipate that the proposed amendment to
the Rule will have a significant economic impact on a substantial
number of small entities. The proposed amendment is merely extending a
sliding scale mechanism that is already in place. The proposed
amendment does not alter the status quo, and would postpone the
potential economic impact, if any, of the expiration of the sliding
scale mechanism. Thus, the economic impact of the amendment to the Rule
is expected to be comparatively minimal.
Accordingly, this document serves as notice to the Small Business
Administration of the agency's certification of no effect. To ensure
the accuracy of this certification, however, the Commission requests
comment on whether the proposed amendment to the Rule will have a
significant impact on a substantial number of small entities, including
specific information on the effect of the proposed amendment on the
costs, profitability, and competitiveness of, and employment in, small
entities. Although the Commission certifies under the RFA that the
amendment proposed in this notice would not, if promulgated, have a
significant impact on a substantial number of small entities, the
Commission has determined, nonetheless, that it is appropriate to
publish an IRFA in order to inquire into the impact of the proposed
Rule on small entities. Therefore, the Commission has prepared the
following analysis:
A. Description of the Reasons That Action by the Agency Is Being
Considered
The Rule's sliding scale mechanism for obtaining parental consent
is scheduled to expire on April 21, 2005. At the time it issued the
final Rule, the Commission anticipated that the sliding scale was
necessary only in the short term because more reliable methods of
obtaining verifiable parental consent would soon be widely available at
a reasonable cost. At the present time, however, it appears that the
expected progress in available technology has not occurred. Therefore,
in this action, the Commission is proposing, and seeking comment on, a
proposed amendment to the Rule that would make the sliding scale
permanent.
B. Statement of the Objectives of, and Legal Basis for, the Proposed
Amendment to the Rule
The objective of the proposed amendment to the Rule is to allow
operators of websites or online services who collect children's
personal information for internal uses only to continue to have the
option of using email-based parental consent, instead of having to use
one of the more costly methods. The proposed amendment would continue
the status quo instead of allowing the sliding scale to expire in April
2005. The proposed amendment is authorized by and based upon section
312.5 of the Children's Online Privacy Protection Rule, 16 CFR
312.5(b)(2), which in turn is based upon section 1303(b) of COPPA.
C. Small Entities to Which the Proposed Amendment to the Rule Will
Apply
As described above, the proposed amendment to the Rule applies to
any commercial operator of a website or online service, including
operators who are small entities, who collects children's personal
information for
[[Page 2582]]
internal uses only. The Commission does not currently have sufficient
information to determine the number of small entities that may be
affected. The Commission invites comment and information on this issue.
D. Projected Reporting, Recordkeeping, and Other Compliance
Requirements
The Rule does not directly impose any ``reporting'' or
``recordkeeping'' requirements within the meaning of the Paperwork
Reduction Act, but does require that operators make certain third-party
disclosures to the public, i.e., provide parents with notice of their
privacy policies. The proposed amendment to make permanent the sliding
scale mechanism for obtaining parental consent would not impose any
additional reporting, recordkeeping, or other compliance requirements.
In addition, the amendment would not affect the costs of complying with
the Rule because it is merely extending a sliding scale mechanism that
is already in place and that enables qualified website operators to
obtain parental consent through lower-cost email-based means.
E. Duplicative, Overlapping, or Conflicting Federal Rules
The Commission has not identified any other federal statutes,
rules, or policies that duplicate, overlap, or conflict with the
proposed amendment to the Rule. The Commission invites comment and
information on this issue.
F. Significant Alternatives to the Proposed Amendment to the Rule
Under the proposed amendment to the Rule, subject operators will
continue to be able to choose email-based methods of obtaining parental
consent instead of having to rely solely on the more costly methods.
Therefore, the proposed amendment actually permits greater flexibility
for small entities than would allowing the sliding scale to expire in
April 2005. A delayed effective date was not considered here, because
the regulatory uncertainty resulting from such a delay would not
benefit small entities.
The Commission invites comment and information on the economic
impact of the proposed amendment on small entities, including
significant alternatives, if any, to the proposed amendment that would
result in greater flexibility for small businesses, while meeting the
objectives and requirements of COPPA and the Rule. After considering
such comments, if any, the Commission will determine whether
preparation of a final regulatory flexibility analysis (pursuant to 5
U.S.C. 605) is required.
List of Subjects in 16 CFR Part 312
Children, Communications, Consumer protection, Electronic mail, E-
mail, Internet, Online service, Privacy, Record retention, Safety,
Science and technology, Trade practices, Website, Youth.
Accordingly, for the reasons stated in the preamble, the Federal
Trade Commission proposes to amend 16 CFR Part 312 as follows:
PART 312--CHILDREN'S ONLINE PRIVACY PROTECTION RULE
1. The authority citation for Part 312 continues to read as
follows:
Authority: 15 U.S.C. 6501 et seq.
2. Amend Sec. 312.5 by revising the second sentence of paragraph
(b)(2) to read as follows:
Sec. 312.5 Parental consent.
* * * * *
(b) * * *
(2) * * * Provided that: Methods to obtain verifiable parental
consent for uses of information other than the ``disclosures'' defined
by Sec. 312.2 may also include use of e-mail coupled with additional
steps to provide assurances that the person providing the consent is
the parent. * * *
* * * * *
By direction of the Commission.
Donald S. Clark,
Secretary.
[FR Doc. 05-877 Filed 1-13-05; 8:45 am]
BILLING CODE 6750-01-P