SUPPORTING STATEMENT FOR INFORMATION COLLECTION PROVISIONS OF THE CHILDREN'S ONLINE PRIVACY PROTECTION RULE 16 C.F.R. Part 312 Background The Children's Online Privacy Protection Act (COPPA), Title XIII of Pub. L. No. 105-277 (Omnibus Consolidated and Emergency Supplemental Appropriations Act, 1999), 112 Stat. 2681 (Oct. 21, 1998), prohibits unfair and deceptive acts and practices in connection with the collection and use of personally identifiable information from and about children on the Internet.(1) The Act gives the Federal Trade Commission one year from the date of enactment, i.e., until October 21, 1999, to promulgate implementing rules.(2) The Commission's notice of proposed rulemaking is scheduled for publication in the Federal Register on or about Tuesday, April 27, 1999. Under the terms of the Act, the Commission's rules must:
The Commission's proposed rule, 16 C.F.R. Part 312, comprises eleven sections, 16 C.F.R. §§ 312.1-312.11. Section 312.1 describes the scope of the rule. Section 312.2 contains key definitions. Section 312.3 describes the requirements of the rule generally. Section 312.4 sets forth the parental notification requirements and exceptions. Section 312.5 discusses the parental consent requirements and procedures. Section 312.6 describes parents' right to review their children's personal information. Section 312.7 sets forth the prohibition on conditioning a child's participation in activities on the collection of the child's personal information beyond what is "reasonably necessary" for such participation. Section 312.8 provides for the confidentiality, security and integrity of information collected from children. Section 312.9 provides for enforcement under the FTC Act. Section 312.10 contains procedures for website and online service operators to obtain FTC approval for self-regulatory guidelines as a "safe harbor" from the rule. Finally, section 312.11 addresses the severability of the rule's provisions. "Information Collection" Provisions At Issue The Commission seeks approval of the Office of Management and Budget (OMB) under the Paperwork Reduction Act for the statutory "notice"(4) requirements reflected in sections 312.3, 312.4, 312.5, and 312.6 of the proposed rule. Proposed section 312.3 ("General requirements"), paragraph (a), provides generally that website and online operators covered by the rule must provide "notice" on their websites or online services of what information is collected from children, how the operators use such information, and how and the extent to which they disclose it to others. Proposed section 312.4 ("Notice") specifically describes the notice required under the Act. Paragraph (a) requires that all notices must be clear and complete, (b) prescribes the placement and content of the required website or online notice, and (c) describes the contents of parental notice. Proposed section 312.5 ("Parental consent") requires follow-up parental notification in certain situations in which the rule otherwise permits personal information to be collected from the child without prior parental notification. See proposed 16 C.F.R. § 312.5(c)(3) ("contact" information to respond more than once to a child's specific request and for no purpose beyond that request), (c)(4) (information reasonably necessary to protect the child's safety). Finally, proposed section 312.6 ("Right of parent to review personal information provided by child") requires that website and online service operators provide parents, upon their request, with a description (i.e., notice) of the specific types or categories of personal information being collected from their children. See proposed 16 C.F.R. § 312.6(a)(1). The above-described "notice" requirements do not mandate the maintenance or reporting of any records or other information for or on behalf of the government, regardless of the fact that regulated entities may choose voluntarily to retain records or information in the ordinary course for their own business or compliance purposes. Nonetheless, the Commission is seeking OMB approval because the proposed provisions, to the extent they will require that regulated parties make certain standard disclosures to ten or more parties, constitute government "information collection" requirements within the meaning of the Paperwork Reduction Act.(5) (1) Necessity for Collecting the Information The proposed requirements are necessary because: (a) they are expressly mandated by the statute; and (b) the requirements will ensure that parents and others know what specific kinds of information are being collected from their children, how that information is used, and how it may be disclosed to others. These requirements will assist in preventing unfair and deceptive acts and practices in the collection of personal information from children through the Internet, and specifically in enhancing parental involvement in their children's online activities and limiting collection of personal information about their children by website and online operators without parental consent, consistent with the stated goals of the COPPA. See supra note 1. (2) Use of the Information As noted above, the requirement will serve to disclose to parents the types of personal information that websites and online services collect from their children over the Internet, and how such information is used and/or disclosed to others. An important secondary use of this information is by children's parents, in deciding, among other things, whether to seek access from a website or online service operator to review their children's personal information and whether to object to any further collection, maintenance or use of such information. (3) Consideration to Use Improved Information Technology to Reduce Burden By their terms and the very nature of the regulated industry, the proposed notice requirements make use of improved information technology (i.e., electronic communications over the Internet) to reduce the burden of such requirements. In particular, section 312.3 of the proposed rule requires that notices be posted on the operators' website or online service, and proposed section 312.4 expressly contemplates that operators' shall "tak[e] into account available technology" in ensuring that parents receive notice of the operators' information practices. Notice under proposed section 312.5(c) incorporates by reference the notice requirement of section 312.4, and nothing in the remaining proposed notice requirement, section 312.6, prohibits regulated entities from providing such notice using the least burdensome information technology to reduce compliance burdens. (4) Efforts to Identify Duplication The notice requirements of the proposed rule do not duplicate any other requirements of the Commission or, to its knowledge, the requirements of other federal or state government agencies. The Commission is soliciting public comments on these requirements, including the extent to which they may be unnecessary or duplicative. (5) Efforts to Minimize Burden on Small Businesses The Commission has drafted the proposed rule to make the compliance burden of these requirements as small as possible. The notice requirements are expressly mandated by the COPPA, as described above. The Commission's rule implements these requirements by providing guidance on the contents of such notices while allowing small businesses (and all other regulated businesses) to determine the most cost-effective means of disseminating such notices. Specifically, the notice that the COPPA requires to be posted on websites and online services has been interpreted under the Commission's proposed rule in the least burdensome manner possible, i.e., by permitting a mere "link" to such notice, rather than the complete text of such notice, on each "page" or other website or online location(s) where personal information is collected from children. See proposed section 312.4(b). The requirements for parental notice are even more flexible and open-ended, requiring simply that the operator make "reasonable efforts, taking into account available technology, to ensure" that notice reaches parents. See proposed section 312.4(c). Thus, the Commission's adoption of these "performance" standards will allow regulated entities to meet the rule's requirements in the fashion best-suited to their particular businesses, and will be inherently less burdensome than any specific "design" standard mandating a precise format and method of notice that could be more costly or time-consuming for businesses. At the same time, the Commission's proposed rule alleviates compliance burdens by giving regulated parties clear and detailed guidance on the contents of the required notices. This guidance thus will help eliminate much of the administrative and legal costs that might be incurred by a small or other business trying to determine what needs to be included in a notice in order to comply with the Commission's rule. (6) Consequences of Conducting Collection Less Frequently A less frequent "collection" would violate both the express statutory language and intent of the COPPA. As noted earlier, the statute requires that notice be given on websites, and that separate notice regarding the operator's information practices be given to parents.(6) Parental notice under the proposed rule is also mandated in part by the statute's parental consent requirement.(7) Thus, the rule does not require notices any more frequently than is necessary for operators to comply with the statute and for parents to make an informed decision about an operator's continued collection, maintenance or use of their children's personal information. (7) Special Circumstances Requiring Collection Inconsistent With Guidelines The proposed "collection" is consistent with all applicable OMB Paperwork Reduction Act guidelines under 5 C.F.R. § 1320.5. No collection inconsistent with such guidelines is being proposed. (8) Consultation Outside the Agency As noted earlier, the Commission has published the proposed requirements for public comment along with the rest of the proposed rule. In addition, staff have informally consulted with members of the website and online service industry. Staff have also met with federal, state and local law enforcement agencies in drafting its proposed rule. Staff have balanced the need for requiring compliance in accordance with the express terms of the statute against the need to minimize the burden associated with such compliance. (9) Payments or Gifts to Respondents Not applicable. The Commission makes no payments or gifts to respondents in connection with the proposed requirements. (10) & (11) Assurances of Confidentiality/Matters of a Sensitive Nature The requirements for which the Commission is seeking OMB approval do not involve collection or disclosure of confidential information but, rather, notice (i.e., disclosure) of information practices by website and online service operators to the public and, in particular, parents of children from whom personal information is collected.(8) (12) Hour Burden The estimate of the burden hours imposed by the notice requirement is divided into first year start-up costs and subsequent year costs. For purposes of providing notice, the estimated cost for 300 websites directed to children at 60 hours per site (the estimated time needed to develop the privacy policy, post it on the website and design a mechanism to provide the notice, e.g., an e-mail program), represents a total burden of 18,000 hours for the first year. The estimated 60 hours per site is divided into 50 hours of labor performed by lawyers or similar professionals developing the notice policy and content and 10 hours of labor performed by computer programmers charged with posting the policy on the website. The total first year start-up labor cost for the lawyers and computer programmers for the 300 websites is estimated at $979,950 (lawyers earning $135,886 annual salary: 15,000 hours @ $65.33 per hour) and $69,540 (computer programmers earning $48,214 annual salary: 3,000 hours @ $23.18 per hour).(9) Subsequent years would be much less, since the start-up costs, such as crafting a privacy policy and posting it online, are generally one-time costs. We estimate the burden-hour in subsequent years would be about 1800 hours to cover the cost of new children's sites coming into the marketplace and providing notice to parents. Thus, the annual labor costs in subsequent years is estimated at $97,995 (lawyers: 1500 hours @ $65.33 per hour) and $6,954 (computer programmers: 300 hours @ $23.18 per hour). The total first year start-up labor cost is $1,049,490 and subsequent year $104,949. (13) Annual Total Cost Burden Since websites will already be equipped with the computer equipment and software necessary to post a privacy policy on the site, no additional hardware or software is needed to comply with the notice requirement of the proposed Rule. The sole costs incurred by the websites are labor costs as calculated above in item 12. (14) Estimated Cost to the Federal Government Staff estimated that enforcing and monitoring compliance with the notice requirement of the COPPA will require the expenditure of approximately 4 attorney/investigator work years at an approximate cost of $77,713 per work year for a total of $310,852. In addition, staff estimated that travel costs or other expenses associated with enforcing and administering the proposed Rule will be approximately $10,000. Therefore, the approximate total cost to the Commission in connection with enforcing and monitoring compliance with the COPPA is $320,852. Clerical and other support services are included in these estimates. (15) Program Changes or Adjustments None. The requirements of the proposed rule, if adopted, would be new, so there are no program changes or adjustments to the annual reporting or recordkeeping hour or cost burdens reported in OMB Form 83-I from any preceding rule. (16) Statistical Use of Information This question applies to "collections of information whose results will be published" and is not applicable, as there no plans to publish information associated with the proposed requirements for statistical use. 1. The underlying goals of the Act are: (1) to enhance parental involvement in a child's online activities in order to protect the privacy of children in the online environment; (2) to help protect the safety of children in online fora such as chat rooms, home pages, and pen-pal services in which children may make public postings of identifying information; (3) to maintain the security of children's personal information collected online; and (4) to limit the collection of personal information from children without parental consent. See 144 Cong. Rec. S11657 (Oct. 7, 1998) (statement of Sen. Bryan). 2. See Pub. L. No. 105-277, § 1303. Because the COPPA has not yet been codified, all citations in this Supporting Statement are to the section numbers used in the public law containing the Act. 3. Pub. L. No. 105-277, §§ 1303(b)(1)(A)-(D). 4. This Supporting Statement tracks the COPPA and uses the terms "notice" or "notification," rather than "disclosure," which would be the corresponding Paperwork Reduction Act term, since "disclosure" is a separately defined term under the COPPA and the Commission's rule (i.e., denoting the release of personal information collected from children). See Pub. L. No. 105-277, § 1302(4). 5. 44 U.S.C. § 3502(3), (13); 5 C.F.R. § 1320.3(c). The Commission does not seek OMB approval for the COPPA requirement that state attorneys general notify the Commission when filing a civil action under the Commission's rule, since the rule does not incorporate that statutory requirement. See Pub. L. No. 105-277, § 1305(a). Likewise, the Commission does not seek OMB approval for the portion of proposed section 312.5 of the rule that requires operators to ensure they have parental consent before collecting information from children, since the rule does not require that operators report or maintain any records of such consent on behalf of the government. See 5 C.F.R. 1320.3(c), (m)(4). Finally, the Commission does not seek OMB approval for proposed section 312.10, allowing the submission and Commission approval of self-regulatory guidelines, which are unique to each submitting party and purely discretionary. See 5 C.F.R. § 1320.3(h)(1); OMB/OIRA Information Collection Review Handbook, p. 32 (1989). 6. See Pub. L. No. 105-277, § 1303(b)(1)(A)(i) (requiring website notice), (B)(i) (notice to parents upon request). These requirements are reflected in the Commission's proposed rule at sections 312.3(a) (website notice), 312.4 (form and content of notices on website and to parents), and 312.6(a)(1) (notice to parents upon their request), as discussed earlier. 7. See Pub. L. No. 105-277, § 1303(b)(1)(A)(ii) (requiring verifiable parental consent), § 1302(9) (defining "verifiable parental consent" to mean, in relevant part, any reasonable efforts, taking into consideration available technology, to ensure parental notice of the operator's personal information collection, use and disclosure practices). These requirements are reflected in the Commission's proposed rule at sections 312.4 (form and contents of notices) and 312.5 (parental consent and exceptions), as discussed earlier. 8. Although not applicable to the "information collection" requirements for which the Commission is seeking OMB approval, the COPPA and the proposed rule do contain strict provisions to ensure the confidentiality, security and integrity of personal information collected from children by website and online service operators. See Pub. L. No. 105-277, § 1303(b)(1)(D); proposed 16 C.F.R. § 312.8 (confidentiality, security, and integrity). 9. Estimated labor costs were derived by adding ten percent to 1996 statistics to account for increases in compensation. "Occupational Compensation Survey: National Summary, 1996," U.S. Department of Labor, Bureau of Labor Statistics. |