[Federal Register Volume 66, Number 211 (Wednesday, October 31, 2001)]
[Proposed Rules]
[Pages 54963-54964]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 01-27390]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION

16 CFR Part 312


Children's Online Privacy Protection Rule

AGENCY: Federal Trade Commission.

ACTION: Notice of proposed rulemaking.

-----------------------------------------------------------------------

SUMMARY: The Federal Trade Commission (``the Commission'') proposes 
amending the Children's Online Privacy Protection Rule (``the Rule'') 
to extend the time period during which website operators may use an e-
mail message from the parent, coupled with additional steps, to obtain 
verifiable parent consent for the collection of personal information 
from children for internal use by the website operator. The Commission 
proposes to extend the time period from April 21, 2002 until April 21, 
2004.

DATES: Written comments will be accepted until November 30, 2001.

ADDRESSES: Written comments should be submitted to: Secretary, Federal 
Trade Commission, Room H-159, 600 Pennsylvania Avenue, NW., Washington, 
DC 20580. The Commission requests that commenters submit the original 
plus five copies, if feasible. To enable prompt review and public 
access, comments also should be submitted, if possible, in electronic 
form, on a 3\1/2\-inch computer disk, with a disk label stating the 
name of the commenter and the name and version of the word processing 
program used to create the document. (Programs based on DOS or Windows 
are preferred. Files from other operating systems should be submitted 
in ASCII text format.) Alternatively, the Commission will accept 
comments submitted to the following e-mail address 
[email protected]. Individual members of the public filing comments 
need not submit multiple copies or comments in electronic form. All 
submissions should be captioned: ``Children's Online Privacy Protection 
Rule Amendment--Comment, P994504.'' Comments will be posted on the 
Commission's website: http://www.ftc.gov.

FOR FURTHER INFORMATION CONTACT: Elizabeth Delaney, (202) 326-2903, 
Mamie Kresses, (202) 326-2070, or Kial Young, (202) 326-3525, Division 
of Advertising Practices, Bureau of Consumer Protection, Federal Trade 
Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580.

SUPPLEMENTARY INFORMATION:

Section A. Background

    As part of the effort to protect children's online privacy, 
Congress enacted the Children's Online Privacy Protection Act of 1998, 
15 U.S.C. 6501 et seq. (``COPPA''), to prohibit unfair or deceptive 
acts or practices in connection with the collection, use, or disclosure 
of personally identifiable information from children on the Internet. 
On October 20, 1999, the Commission issued its final Rule implementing 
COPPA, which became effective on April 21, 2000.\1\ The Rule imposes 
certain requirements on operators of websites or online services 
directed to children under 13 years of age, or other websites or online 
services that have actual knowledge that they have collected 
information from a child under 13 years of age. Among other things, the 
Rule requires that website operators obtain verifiable parental consent 
prior to collecting, using, or disclosing personal information from 
children under 13 years of age.
---------------------------------------------------------------------------

    \1\ 64 FR 59888 (1999).
---------------------------------------------------------------------------

Section B. Obtaining Verifiable Parent Consent

    The Rule provides that, ``[a]ny method to obtain verifiable 
parental consent must be reasonably calculated, in light of available 
technology, to ensure that the person providing consent is the child's 
parent.'' \2\ In order to allow time for reliable electronic methods of 
verification to become widely available and affordable, the Rule sets 
forth a sliding scale approach to obtaining verifiable parental 
consent. For uses of personal information that will involve disclosing 
the information to the public or third parties, the Rule requires that 
website operators use the more reliable methods of obtaining verifiable 
parental consent. These methods include: using a print-and-send form 
that can be faxed or mailed back to the website operator; requiring a 
parent to use a credit card in connection with a transaction; having a 
parent call a toll-free telephone number staffed by trained personnel; 
using a digital certificate that uses public key technology; and using 
e-mail accompanied by a PIN or password obtained through one of the 
above methods.\3\
---------------------------------------------------------------------------

    \2\ 16 CFR 312.5(b)(1).
    \3\ 16 CFR 312.5(b)(2).
---------------------------------------------------------------------------

    In contrast, if the website operator is collecting personal 
information for its internal use only, the Rule allows verifiable 
parental consent to be obtained through the use of an e-mail message 
from the parent, coupled with additional steps. Such additional steps 
are designed to provide assurances that the person providing the 
consent is the parent and include: sending a confirmatory e-mail to the 
parent after receiving consent; or obtaining a postal address or 
telephone number from the parent and confirming the parent's consent by 
letter or telephone call. The sliding scale is set to expire on April 
21, 2002, at which time website operators must obtain verifiable 
parental consent using the more reliable methods for all uses of 
personal information.\4\
---------------------------------------------------------------------------

    \4\ Id.
---------------------------------------------------------------------------

    At the time it issued the final Rule, the Commission anticipated 
that the sliding scale was necessary only in the short term because the 
more reliable methods of obtaining verifiable parental consent would 
soon be widely available and affordable.\5\ At the present time, 
however, it appears that the expected progress in available technology 
has not occurred. The Commission therefore proposes to amend the Rule 
to extend the sliding scale mechanism for an additional two years to 
April 21, 2004 and requests public comment on this proposed extension 
of time.
---------------------------------------------------------------------------

    \5\ 64 FR 59902 (1999).
---------------------------------------------------------------------------

Section C. Invitation To Comment

    Before adopting this amendment as final, the Commission will give 
consideration to any written comments submitted to the Secretary of the 
Commission on or before November 30, 2001. Comments submitted will be

[[Page 54964]]

available for public inspection in accordance with the Freedom of 
Information Act (5 U.S.C. 552) and Commission regulations, on normal 
business days between the hours of 8:30 a.m. and 5 p.m. at the Public 
Reference Section, Room 130, Federal Trade Commission, 600 Pennsylvania 
Avenue NW., Washington, DC 20580. Comments will also be posted on the 
Commission website, http://www.ftc.gov.

Section D. Communications by Outside Parties to Commissioners or 
Their Advisors

    Written communications and summaries or transcripts of oral 
communications respecting the merits of this proceeding from any 
outside party to any Commissioner or Commissioner's advisor will be 
placed on the public record. See 16 CFR 1.26(b)(5).

Section E. Regulatory Flexibility Act

    The provision of the Regulatory Flexibility Act requiring an 
initial regulatory flexibility analysis (5 U.S.C. 605) does not apply 
because it is believed that the proposed amendment to the Rule will not 
have a significant economic impact on a substantial number of small 
entities (5 U.S.C. 605). This notice also serves as certification to 
the Small Business Administration of that determination.
    The economic impact of the proposed amendment to the Rule is not 
anticipated to be significant because it is only extending, for a two-
year period, a sliding scale mechanism that is already in place. The 
proposed amendment does not alter the status quo, and would postpone 
the potential economic impact, if any, of the expiration of the sliding 
scale mechanism. Thus, the economic impact of the amendment to the Rule 
is expected to be comparatively minimal.
    Nonetheless, to ensure that no significant economic impact on a 
substantial number of small entities is overlooked, the Commission 
hereby requests public comment on the effect of the proposed amendment 
to the Rule on the costs, profitability, and competitiveness of, and 
employment in, small entities. After considering such comments, if any, 
the Commission will determine whether preparation of a final regulatory 
flexibility analysis (pursuant to 5 U.S.C. 605) is required.

Section F. Paperwork Reduction Act

    This amendment would not amend any information collection 
requirements that have previously been reviewed and approved by the 
Office of Management and Budget pursuant to the Paperwork Reduction 
Act, as amended, 44 U.S.C. 3501 et seq.

Section G. Questions on the Proposed Amendment

    Members of the public are invited to comment on any issues or 
concerns they believe are relevant or appropriate to the Commission's 
consideration of the proposed amendment to the Children's Online 
Privacy Protection Rule. The Commission proposes to extend the sliding 
scale mechanism for obtaining verifiable parental consent for two years 
until April 21, 2004. The Commission is particularly interested in 
comments addressing the following questions:
    (1) Are secure electronic mechanisms now widely available to 
facilitate verifiable parental consent at a reasonable cost? Please 
include comments on the following:
    (a) Digital signature technology;
    (b) Digital certificate technology;
    (c) Other digital credentialing technology;
    (d) P3P technology; and
    (e) Other secure electronic technologies.
    (2) Are infomediary services now widely available to facilitate 
verifiable parental consent at a reasonable cost?
    (3) Is this proposed extension an adequate amount of time 
considering the current development of secure electronic mechanisms 
and/or infomediary services for obtaining verifiable parental consent 
at a reasonable cost? Please include comments on the following:
    (a) The anticipated availability of secure electronic mechanisms 
and/or infomediary services;
    (b) The anticipated affordability of secure electronic mechanisms 
and/or infomediary services; and
    (c) The likelihood and timeframe of consumer adoption of secure 
electronic mechanisms and/or infomediary services.
    (4) Should the extension be longer than two years?
    (5) Rather than be extended, should the sliding scale mechanism be 
kept in place indefinitely, until the development of secure electronic 
mechanisms and/or infomediary services become widely available to 
facilitate verifiable parental consent at a reasonable cost?
    (6) What, if any, will be the negative impact of extending the time 
period for the sliding scale mechanism for obtaining verifiable 
parental consent? Please include comments on whether the extension will 
serve as a disincentive for industry to develop secure electronic 
mechanisms and/or infomediary services to facilitate verifiable 
parental consent at a reasonable cost.

List of Subjects in 16 CFR Part 312

    Children, Communications, Consumer protection, Electronic mail, E-
mail, Internet, Online service, Privacy, Record retention, Safety, 
Science and technology, Trade practices, Website, Youth.
    Accordingly, the Federal Trade Commission proposes to amend 16 CFR 
Part 312 as follows:

PART 312--CHILDREN'S ONLINE PRIVACY PROTECTION RULE

    1. The authority citation for part 312 continues to read as 
follows:

    Authority: 15 U.S.C. 6501 et seq.

    2. Amend Sec. 312.5 by revising the second sentence of paragraph 
(b)(2) to read as follows:


Sec. 312.5  Parental consent.

* * * * *
    (b) * * *
    (2) * * * Provided that: For the period until April 21, 2004, 
methods to obtain verifiable parental consent for uses of information 
other than the ``disclosures'' defined by Sec. 312.2 may also include 
use of e-mail coupled with additional steps to provide assurances that 
the person providing the consent is the parent. * * *
* * * * *

    By direction of the Commission.
Donald S. Clark,
Secretary.
[FR Doc. 01-27390 Filed 10-30-01; 8:45 am]
BILLING CODE 6750-01-P