Under a rule issued yesterday by the US Federal Trade Commission, Web sites aimed at children under age 13 will have to notify parents about their information-gathering practices and in most cases get permission from parents before collecting information from children.
The rule, which gives Web site operators six months to comply, implements the Children's Online Privacy Protection Act (COPPA) passed by Congress last year. It applies to Web sites directed at children under age 13 and general-audience Web sites that know children under that age are submitting information, said Toby Levin, team leader for Internet advertising for the FTC.
The under-13 age group traditionally has been given special protection from advertisers because children that young are considered the most vulnerable, Levin said. They typically don't have the decision-making skills necessary to protect their privacy or know when they may be falling prey to marketing ploys.
Congress passed the COPPA in reaction to a high level of parental concern about the widely used practice of collecting information online from children, Levin said. He cited an FTC survey that showed 97 per cent objected to having information about their children released to third parties.
The rules governing prior parental consent provide flexibility to Web-site operators so they can choose among a number of acceptable methods to obtain permission from parents to collect information from their children, Levin said.
"The goal here of the act and the rule is to give parents tools to protect their children's privacy," Levin said. "The rule really tries to strike a balance. It provides strong protection while at the same time recognising the need for exceptions, such as a case when a child is asking for homework help."
The new rules require affected Web sites to display prominently on the home page a link to a notice explaining what they do with the information they collect from children under age 13. The link must also appear wherever personal information is collected from children.
The FTC rules establish what the commission calls a "sliding scale" for obtaining consent that requires varying degrees of consent based on the intended use of the information. More stringent and multiple consent methods must be employed whenever information collected from children is disclosed to third parties or made available to the public, Levin said.
For example, consent granted by an e-mail from a parent would have to be followed up by a letter, telephone call or the exchange of a file that includes a digital signature.
But for something like sending a newsletter or entering the child in a contest, less stringent consent methods may be used, Levin said. In any case, parents will have to provide more than an e-mail to grant a Web site permission to collect information from their under-13 children, Levin said.
The "sliding scale" will expire in April 2002. After that, more reliable methods of consent will be required for all uses of information collected from children. By then the FTC anticipates broad availability of digital signatures and other secure electronic means of identification.
The rules also allow several exceptions to the requirement for prior parental consent that permit Web sites to collect a child's e-mail address for certain purposes.
A summary of the rule has been posted on the FTC Web site.