Coping with COPPA.

The Children's Online Privacy Protection Act (the "Act") was signed into law on October 21, 1998, and the Federal Trade Commission Rule (the "Rule") implementing Act became effective on April 21, 2000 (collectively, "COPPA"). Working within the parameters established by COPPA should not be complicated, provided that one is aware of them.

COPPA pertains to all personal information collected from children (individuals under the age of 13) after April 21, 2000, regardless of any prior relationship an operator has had with the child. COPPA governs websites and online services ("Operators") that are targeted to children and collect personal information, or general audience websites where the Operators have actual knowledge that they collect information. An Operator will be imputed to have actual knowledge where it learns of a child's age or grade from the child's activities at the site (e.g. registration).

In determining whether a website is directed towards children, the FTC will consider, among other things, the site's content, language, advertising and intended audience, as well as the use of child-oriented graphics or features (e.g. animated characters).

Operators are also persons that do not collect information directly, but have ownership or control over information collected at a site. However, if the Operator of a site A has a link to a site B, and Site A is violating the rule, Site A will not be held liable if there is no ownership or control of the information collected at site B.

Personal information

COPPA applies to individually identifiable information collected or made public online. Individually identifiable information includes the most obvious, being name, address and e-mail address, as well as the more subtle technological means of acquiring information (e.g., "cookies"). Making personal information publicly available may take the form of public posting through various electronic means, including message boards, chat rooms or pen pal services.

Compliance

An information practices notice link must be placed on the home page and in each area where personal information can be collected. General audience sites with a separate children's area must post a link to its notice on the home page of the children's area. The link must be clear and prominent on the page, by using a larger font or contrasting color. Operators are discouraged from placing the notice in the bottom of the page, and making it indistinguishable from other links on the page.

The information practices notice must:

* Provide contact information (name, address, telephone number and email address) of all Operators collecting or maintaining children's personal information.

* Explain the type of personal information collected,

* Explain the information collection process,

* Explain how the Operator intends to use the information,

* State if the information is disclosed to third parties, the type of business of such third parties, the purposes for which the information is to be used, and whether the information will be kept confidential.

* State that the parent has the option to agree to the Operators collection and use of the information, but prohibit the transfer of it to third parties,

* State the operator may not (as a condition to participation) require a child to disclose more information than is reasonably necessary to participate in an activity,

* State the parent can review the child's personal information, ask to have it deleted and refuse to allow any further collection or use of the child's information.

A "third person" is any person who is neither an Operator nor a person who provides support for the internal operations of the website or online service. The FTC will determine an entity's status as Operator or third person by its relationship to the information collected, not by its characterization as a corporate affiliate.

The Operator must notify parents that it wishes to collect personal information from their child and obtain their verifiable, revocable consent to the collection and use of such information. The notice must state the same information included in the information practices notice and inform the parents that their consent is required for such activity, and explain how the parent can provide consent. Operators may use any one of a number of methods to notify a parent, including sending an email message to the parent or a notice by postal mail. The notice to parents must be clearly written and understandable. In addition, Operators must allow parents to review personal information collected from their children.

COPPA provides for a sliding scale to determine the effectiveness of the means to obtain parental consent. This sliding scale approach will be used by the FTC through April 2002. For example, email verification is sufficient if the Operator is merely collecting personal information for internal purposes, such as marketing back to a child based on his or her preferences or communicating promotional updates about the site's content. However, if the Operator is going to sell or give the information to a third party or make it publicly available, consent must come in one of the following forms:

* Signed form from parent via postal mail or fax,

* Verifying via credit card,

* Calls placed into toll-free number,

* Email accompanied by digital signature, or

* Email accompanied by a password obtained through one of the above methods.

Operators must re-notify and obtain parents' consent again if they alter any of their information collection and use practices.

Exceptions

COPPA includes several exceptions, notably:

* Collecting a child's or parent's email address to provide notice and seek consent,

* Collecting a child's name or online contact information to protect the safety of a child participating on the site, and

* Collecting an e-mail address to respond to a onetime request from a child and then delete it from the Operators records.

Enforcement

Any violation of COPPA will be deemed to be an unfair or deceptive act or practice and may be liable for a civil penalty of not more than $11,000 for each violation, and empowers the courts to grant injunctions and other equitable relief. A private cause of action may also be available.

Safe Harbors 

COPPA includes a "Safe Harbor" provision enabling others to submit to the FTC for approval self-regulatory guidelines consistent with COPPA. To be approved by the FTC, the guidelines must include a mechanism for independent assessment of participating Operators' compliance with the guidelines (e.g., a seal program), and effective incentives for Operators' compliance.

As this story goes to press, the FTC has begun a massive email campaign addressing all websites which target children. Not dissimilar to COPPA, the FTC's message is clear -- make sure contacts with children are thoughtful and welcomed.

Mr. Marks and Mr. Klein are associates in the Los Angeles office of Jenkens & Gilchrist, LLP, and focus their practice on counseling clients in a broad range of Internet, corporate and intellectual property matters. The authors wish to thank Shahab Raphaely for his assistance in the preparation of this article.