[Federal Register Volume 67, Number 95 (Thursday, May 16, 2002)]
[Notices]
[Pages 34928-34929]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 02-12264]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION


Agency Information Collection Activities; Proposed Collection; 
Comment Request; Extension

AGENCY: Federal Trade Commission (``FTC'').

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: The FTC has submitted to the Office of Management and Budget 
(OMB) for review under the Paperwork Reduction Act (PRA) information 
collection requirements contained in its Children's Online Privacy 
Protection Act Rule (``COPPA Rule'' or ``Rule''). The FTC is seeking 
public comments on its proposal to extend through June 30, 2005 the 
current PRA clearance for information collection requirements contained 
in the Rule.

DATES: Comments must be submitted on or before June 17, 2002.

ADDRESSES: Send written comments to the Office of Information and 
Regulatory Affairs, Office of Management and Budget, New Executive 
Office Building, Room 10202, Washington, DC 20503, ATTN.: Desk Officer 
of the Federal Trade Commission (comments in electronic form should be 
sent to [email protected]), and to Secretary, Federal Trade 
Commission, Room H-159, 600 Pennsylvania Ave., NW., Washington, DC 
20580 (comments in electronic form should be sent to 
[email protected]). All comments should be captioned ``COPPA Rule: 
Paperwork comment,'' as prescribed below.

FOR FURTHER INFORMATION CONTACT: Requests for additional information or 
copies of the proposed information requirements should be addressed to 
Elizabeth Delaney, Attorney, Division of Advertising Practices, Bureau 
of Consumer Protection, Federal Trade Commission, Room S-4002, 601 
Pennsylvania Ave., NW., Washington, DC 20580, (202) 326-2903.

SUPPLEMENTARY INFORMATION: Under the PRA (44 U.S.C. 3501-3520), Federal 
agencies must obtain approval from OMB for each collection of 
information they conduct or sponsor. On March 6, 2002, the FTC sought 
comment on the information collection requirements associated with the 
COPPA Rule, 16 CFR Part 312 (OMB Control Number: 3084-0117). See 67 FR 
10211 (March 6, 2002). No comments were received. Pursuant to the OMB 
regulations that implement the PRA (5 CFR Part 1320), the FTC is 
providing this second opportunity for public comment while seeking OMB 
approval to extend the existing paperwork clearance for the Rule.
    If a comment contains nonpublic information, it must be filed in 
paper form, and the first page of the document must be clearly labeled 
``confidential.'' Comments that do not contain any nonpublic 
information may instead be filed in electronic form (in ASCII format, 
WordPerfect, or Microsoft Word) as part of or as an attachment to email 
messages directed to the following email box: [email protected] 
Such comments will be considered by the Commission and will be 
available for inspection and copying at its principal office in 
accordance with section 4.9(b)(6)(ii) of the Commission's rules of 
practice, 16 CFR 4.9(b)(6)(ii).
    The COPPA Rule prohibits unfair and deceptive acts and practices in 
connection with the collection and use of personally identifiable 
information from and about children on the Internet. Under the terms of 
the Act, the Commission's rules must:
    (1) Require each website and online service operator directed to 
children, and any website or online service operator with actual 
knowledge that it is collecting personal information from children, to 
provide notice of how it collects, uses and discloses such information 
and, with exceptions, to obtain the prior consent of the child's parent 
in order to engage in such collection, use and disclosure;
    (2) Require the operator to provide the parent with notice of the 
specific types of personal information being collected from the child, 
to give the parent the opportunity to forbid the operator at any time 
from further collecting, using, or maintaining such information, and to 
provide reasonable means for the parent to obtain the information;
    (3) Prohibit a child's participation in a game, a prize offer, or 
other activity from being conditioned on the child's disclosure of more 
personal information than is ``reasonably necessary'' for the child to 
participate in that activity; and
    (4) Require web site and online service operators to establish 
procedures that protect the confidentiality, security and integrity of 
personal information collected from children.\1\
---------------------------------------------------------------------------

    \1\ 15 U.S.C. 6502(b)(1)(A)-(D).
---------------------------------------------------------------------------

    The above-described ``notice'' requirements do not mandate the 
maintenance or reporting of any records or other information for or on 
behalf of the government. Nonetheless, the FTC seeks OMB approval 
because the aforementioned provisions constitute ``collection(s) of 
information'' under the PRA.\2\ Likewise, the FTC seeks OMB clearance 
regarding the information collected under the Rule's safe harbor 
provisions because, while the submission by operators of such requests 
to the agency is voluntary, the Rule includes specific information 
requirements that all such requesters must provide to receive 
Commission approval.\3\ Thus, the safe harbor provisions include a 
``collection of information'' under the PRA and implementing OMB 
regulations. See 44 U.S.C. 3502(3)(A), 5 CFR 1320.3(c).
---------------------------------------------------------------------------

    \2\ 44 U.S.C. 3502(3), (13); 5 CFR 1320.3(c) (identical 
questions or reporting requirements directed to ten or more 
persons). The Commission does not seek OMB approval for the COPPA 
requirement that state attorneys general notify the Commission when 
filing a civil action under the Commission's Rule, since the Rule 
does not incorporate that statutory requirements. See 15 U.S.C. 
654(2)(A). Likewise, the Commission does not seek OMB approval for 
the portion of section 312.5 of the Rule that requires operators to 
ensure they have parental consent before collecting information from 
children, since the Rule does not require that operators report or 
maintain any records of such consent on behalf of the government. 
See 5 CFR 1320.3(c),(m).
    \3\ See section 312.10(c). Under section 312.10, operators will 
be deemed to be in compliance with the Rule if they meet the terms 
of industry self-regulatory guidelines approved by the Commission 
after notice and comment.
---------------------------------------------------------------------------

    Estimated annual hours burden: 2,065 hours.
    FTC staff projects an estimated 30 new web entrants each year will 
fall within the Rule's coverage and that each will require, on average, 
60 hours per year to craft a privacy policy, design a mechanism to 
provide the required notice, and post it online.\4\ Accordingly,

[[Page 34929]]

staff estimates that newly affected entities will require approximately 
1,800 hours to comply with these requirements of the Rule.\5\ 
Consistent with staff's prior estimated apportionment (5:1) of legal 
(lawyers or similar professionals) and technical (computer programmers) 
time spent on compliance,\6\ staff estimates that 1,500 hours of this 
total would be time spent by lawyers (developing the notice policy) and 
300 hours would be attributable to computer programmers' efforts 
(posting the policy on the website).
---------------------------------------------------------------------------

    \4\ The hours estimate per new entrant is the same that staff 
projected in its initial PRA analysis published in the notice of 
proposed rulemaking. See 64 FR 22750, 22761 (April 27, 1999). Staff 
also retains its prior projection that roughly 30 new children's 
sites subject to the Rule would be posted each year. Although staff 
cannot determine with any degree of certainty the number of new 
entrants potentially subject to the Rule, it believes its empirical 
estimate is reasonable. Moreover, the Commission received no prior 
comments challenging staff's prior PRA analysis notwithstanding its 
receipt of numerous comments on the Rule itself. Accordingly, staff 
retains those estimates for the instant PRA analysis.
    \5\ Website operators that have previously created or adjusted 
their sites to comply with the Rule will incur no further burden 
associated with the Rule, unless they opt to change their policies 
and information collection in ways that will further invoke the 
Rule's provisions. Moreover, staff believes that existing COPPA-
complaint operators who introduce additional sites beyond those they 
already have created will incur minimal, if any, incremental PRA 
burden. This is because such operators already have been through the 
start-up phase, and can carry over the results of that work to the 
new sites they create.
    \6\ See http://www.ftc.gov/os/1999/9906/childprivsup.htm (text 
of the PRA supporting statement sent to OMB contemporaneous with 
publication of the proposed rule).
---------------------------------------------------------------------------

    With regard to the Rule's safe harbor provisions, staff estimates, 
based on industry input, that it would require, on average, 265 hours 
per new safe harbor program applicant to prepare and submit their safe 
harbor proposal in accordance with section 310.12(c) of the Rule. 
Industry sources have also advised staff that all of this time would be 
attributable to lawyers' time and costs. Based on past experience and 
industry input, staff believes that no more than one applicant per year 
will submit a request. Staff believes, however, that most of the 
records listed in the Rule's safe harbor provisions consist of records 
that marketing and online industry representatives have kept in the 
ordinary course of business preceding the Rule. PRA ``burden'' does not 
include effort expended in the ordinary course of business independent 
of a regulatory requirement. 5 CFR 1320.3(b)(2). Any incremental 
burden, such as that for maintaining the results of independent 
assessments under section 312.10(d)(3), would be, in staff's view, de 
minimis. Accordingly, staff estimates that total hours per year for 
start-up efforts and for safe harbor applications would be 
approximately 2,065 hours (1,800 + 265).
    Labor costs: Labor costs are derived by applying appropriate hourly 
cost figures to the burden hours described above. Staff conservatively 
assumes hourly rates of $75 and $25, respectively, for lawyers and 
computer programmers.\7\ Based on these inputs, staff further estimates 
that the associated annual labor costs for new entrants would be 
$120,000 [(1,500 hours  x  $75/hour for legal) + (300 hours  x  $25/
hour for technical)] and $19,875 for safe harbor applicants [265 hours 
x  $75/hour for legal  x  one application per year] for a total labor 
cost of $140,000, rounded to the nearest thousand.
---------------------------------------------------------------------------

    \7\ Previously, staff's stated estimates for such labor, were 
$65.33/hour for legal and $23.18 for computer programmers, based on 
adding ten percent to 1996 statistics found in ``Occupational 
Compensation Survey: National Summary, 1996,'' U. S. Department of 
Labor, Bureau of Labor Statistics. In September 2001, however, the 
Department of Labor published its ``National Compensation Survey: 
Occupational Wages in the Untied States, 2000,'' which integrates 
data from the Occupational Compensation Survey, the Employment Cost 
Index, and the Employee Benefits Survey. According to this more 
recent compilation, the mean hourly earnings of lawyers and computer 
programmers, based on a survey of all 50 states from June 1999 to 
April 2001, was $38.70 and $23.33, respectively. More generally, 
regarding most other Commission information collection activities 
that invoke the PRA, Commission staff has estimated lawyer's 
national average hourly rates to be $75, which staff will also apply 
here. The $25 estimate for computer programmers is merely a rough 
rounding based on the above-noted data.
---------------------------------------------------------------------------

    Non-labor costs: Since websites will already be equipped with the 
computer equipment and software necessary to comply with the Rule's 
notice requirements, the sole costs incurred by the websites are the 
aforementioned estimated labor costs. Similarly, retention of the 
records the Rule's safe harbor recordkeeping provisions specify should 
entail de minimis costs beyond what operators incur independent of the 
Rule in the ordinary course of business.

William E. Kovacic,
General Counsel.
[FR Doc. 02-12264 Filed 5-15-02; 8:45 am]
BILLING CODE 6750-01-M