[Federal Register Volume 70, Number 10 (Friday, January 14, 2005)]
[Proposed Rules]
[Pages 2580-2582]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 05-877]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION

16 CFR Part 312

RIN 3084-AB00


Children's Online Privacy Protection Rule

AGENCY: Federal Trade Commission (FTC).

ACTION: Notice of proposed rulemaking, request for comment.

-----------------------------------------------------------------------

SUMMARY: The Federal Trade Commission proposes amending the Children's 
Online Privacy Protection Rule (``the Rule'') to permanently allow 
website operators and online services to obtain verifiable parental 
consent for the collection of personal information from children for 
internal use by the website operator through sending an e-mail message 
to parents coupled with additional steps.

DATES: Comments must be received by February 14, 2005.

ADDRESSES: Interested parties are invited to submit written comments. 
Comments should refer to ``Sliding Scale 2005, Project No. P054503'' to 
facilitate the organization of comments. A comment filed in paper form 
should include this reference both in the text and on the envelope, and 
should be mailed or delivered to the following address: Federal Trade 
Commission/Office of the Secretary, Room 159-H (Annex Y), 600 
Pennsylvania Avenue, NW., Washington, DC 20580. Comments containing 
confidential material must be filed in paper form, must be clearly 
labeled ``Confidential,'' and must comply with Commission Rule 4.9(c). 
16 CFR 4.9(c) (2004).\1\
---------------------------------------------------------------------------

    \1\ The comment must be accompanied by an explicit request for 
confidential treatment, including the factual and legal basis for 
the request, and must identify the specific portions of the comment 
to be withheld from the public record. The request will be granted 
or denied by the Commission's General Counsel, consistent with 
applicable law and the public interest. See Commission Rule 4.9(c), 
16 CFR 4.9(c).
---------------------------------------------------------------------------

    Comments filed in electronic form should be submitted by clicking 
on the following Web link: https://secure.commentworks.com/ftcslidingscale/ and following the instructions on the Web-based form. 
To ensure that the Commission considers an electronic comment, you must 
file it on the Web-based form at the https://secure.commentworks.com/ftcslidingscale/ Web link. You may also visit http://www.regulations.gov to read this notice of proposed rulemaking, and may 
file an electronic comment through that Web site. The Commission will 
consider all comments that regulations.gov forwards to it.
    The FTC Act and other laws the Commission administers permit the 
collection of public comments to consider and use in this proceeding as 
appropriate. All timely and responsive public comments, whether filed 
in paper or electronic form, will be considered by the Commission, and 
will be available to the public on the FTC Web site, to the extent 
practicable, at http://www.ftc.gov/privacy/privacyinitiatives/childrens_lr.html. As a matter of discretion, the FTC makes every 
effort to remove home contact information for individuals from the 
public comments it receives before placing those comments on the FTC 
Web site. More information, including routine uses permitted by the 
Privacy Act, may be found in the FTC's privacy policy, at http://www.ftc.gov/ftc/privacy.htm.

FOR FURTHER INFORMATION CONTACT: Rona Kelner, (202) 326-2752, or Karen 
Muoio, (202) 326-2491, Division of Advertising Practices, Bureau of 
Consumer Protection, Federal Trade Commission, 601 New Jersey Avenue 
NW., Washington, DC 20580.

SUPPLEMENTARY INFORMATION:

I. Background

    On October 20, 1999, the Commission issued its final Rule \2\ 
pursuant to the Children's Online Privacy Protection Act (``COPPA''), 
15 U.S.C. 6501, et seq. The Rule imposes certain requirements on 
operators of websites or online services directed to children under 13 
years of age, or other websites or online services that have actual 
knowledge that they have collected personal information from a child 
under 13 years of age. Among other things, the Rule requires that 
website operators or online services obtain verifiable parental consent 
prior to collecting, using, or disclosing personal information from 
children under 13 years of age.
---------------------------------------------------------------------------

    \2\ 64 FR 59888 (1999).
---------------------------------------------------------------------------

II. The Sliding Scale

    The Rule provides that, ``[a]ny method to obtain verifiable 
parental consent must be reasonably calculated, in light of available 
technology, to ensure that the person providing consent is the child's 
parent.'' \3\ The Rule sets forth a sliding scale approach to obtaining 
verifiable parental consent. If the website operator is collecting 
personal information for its internal use only, the Rule allows 
verifiable parental consent to be obtained through the use of an e-mail 
message to the parent, coupled with additional steps to provide 
assurances that the parent is providing the consent. Such additional 
steps include: sending a confirmatory e-mail to the parent after 
receiving consent or obtaining a postal address or telephone number 
from the parent and confirming the parent's consent by letter or 
telephone call.\4\
---------------------------------------------------------------------------

    \3\ 16 CFR 312.5(b)(1).
    \4\ Id.
---------------------------------------------------------------------------

    In contrast, for uses of personal information that will involve 
disclosing the information to the public or third parties, the Rule 
requires that website operators use more reliable methods of obtaining 
verifiable parental consent. These methods include: using a print-and-
send form that can be faxed or mailed back to the website operator; 
requiring a parent to use a credit card in connection with a 
transaction; having a parent call a toll-free telephone number staffed 
by trained personnel; using a digital certificate that uses public key 
technology; and using e-mail accompanied by a PIN or password obtained 
through one of the above methods.\5\
---------------------------------------------------------------------------

    \5\ 16 CFR 312.5(b)(2).
---------------------------------------------------------------------------

    An effect of the sliding scale is that the relatively lower cost of 
seeking permission for internal use of children's information may 
encourage website operators to collect personal information for their 
internal use only, rather than for disclosure to third parties and the 
public. As noted in the Rule's Statement of Basis and Purpose, ``the 
record shows that disclosures to third parties are among the most 
sensitive and potentially risky uses of children's personal 
information.'' \6\
---------------------------------------------------------------------------

    \6\ 64 FR 59899 (1999).
---------------------------------------------------------------------------

    The sliding scale was originally set to expire on April 21, 2002, 
but was extended, following a notice and public comment period, for an 
additional three years.\7\ It is now scheduled to expire on April 21, 
2005, at which time website operators would have to obtain verifiable 
parental consent using the more reliable (and costly) methods for all 
uses of personal information.\8\ At the time it issued the final Rule, 
the Commission anticipated that the sliding scale was necessary only in 
the short term because more reliable methods of obtaining verifiable 
parental consent would soon be widely available at a

[[Page 2581]]

reasonable cost. At the present time, however, as in 2002, it appears 
that the expected progress in available technology has not occurred. 
The Commission therefore proposes to amend the Rule to make the sliding 
scale mechanism permanent.\9\ The Commission requests public comment on 
this proposed amendment.
---------------------------------------------------------------------------

    \7\ See http://www.ftc.gov/privacy/privacyinitiatives/childrens_lr.html for notice and public comments.
    \8\ 67 FR 18818 (2002).
    \9\ The Commission would continue to monitor developments in the 
technology available to obtain verifiable parental consent at a 
reasonable cost.
---------------------------------------------------------------------------

III. Request for Comments

    The Commission proposes to amend the Children's Online Privacy 
Protection Rule to make permanent the sliding scale mechanism for 
obtaining verifiable parental consent. Members of the public are 
invited to comment on any issues or concerns they believe are relevant 
or appropriate to the Commission's consideration of this proposed 
amendment, including written data, views, facts, and arguments 
addressing the proposed amendment to the Rule. All comments should be 
filed as prescribed in the ADDRESSES section above, and must be 
received by February 14, 2005. The Commission is particularly 
interested in comments addressing the following questions:
    (1) Are secure electronic mechanisms now widely available to 
facilitate verifiable parental consent at a reasonable cost? Please 
include comments on the following:
    (a) Digital signature technology;
    (b) Digital certificate technology;
    (c) Other digital credentialing technology;
    (d) P3P technology; and
    (e) Other secure electronic technologies.
    (2) Are infomediary services now widely available to facilitate 
verifiable parental consent at a reasonable cost?
    (3) When are secure electronic mechanisms and/or infomediary 
services for obtaining verifiable parental consent anticipated to 
become available at a reasonable cost? To what extent would the 
Commission's decision to eliminate, make permanent, or extend the 
sliding scale mechanism affect the incentive to develop and deploy 
these means of obtaining verifiable parental consent?
    (4) What effect would eliminating the sliding scale have on the 
information collection and use practices of website operators? For 
example, would the elimination of the sliding scale mechanism encourage 
website operators to collect children's personal information for uses 
other than the operators' own internal use because the cost of 
obtaining parental consent would be the same for internal as well as 
external uses?
    (5) Is there any evidence that the sliding scale mechanism is being 
misused, or is not working effectively?
    (6) Should the sliding scale mechanism be extended? If so, why and 
for how long?
    (7) Should the sliding scale mechanism be eliminated? If so, why?
    (8) Should the sliding scale mechanism be made permanent? If so, 
why?

IV. Communications by Outside Parties to Commissioners or Their 
Advisors

    Written communications and summaries of transcripts of oral 
communications respecting the merits of this proceeding from any 
outside party to any Commissioner or Commissioner's advisor will be 
placed on the public record. See 16 CFR 1.26(b)(5).

V. Paperwork Reduction Act

    The proposed amendment to the Rule does not change any information 
collection requirements that have previously been reviewed and approved 
by the Office of Management and Budget pursuant to the Paperwork 
Reduction Act, 44 U.S.C. 3501 et seq.

VI. Regulatory Flexibility Act

    The Regulatory Flexibility Act (``RFA''), 5 U.S.C. 601-612, 
requires that the Commission provide an Initial Regulatory Flexibility 
Analysis (``IRFA'') with a proposed rule and a Final Regulatory 
Flexibility Analysis (``FRFA''), if any, with the final rule, unless 
the Commission certifies that the rule will not have a significant 
economic impact on a substantial number of small entities. 5 U.S.C. 
603-605.
    The Commission does not anticipate that the proposed amendment to 
the Rule will have a significant economic impact on a substantial 
number of small entities. The proposed amendment is merely extending a 
sliding scale mechanism that is already in place. The proposed 
amendment does not alter the status quo, and would postpone the 
potential economic impact, if any, of the expiration of the sliding 
scale mechanism. Thus, the economic impact of the amendment to the Rule 
is expected to be comparatively minimal.
    Accordingly, this document serves as notice to the Small Business 
Administration of the agency's certification of no effect. To ensure 
the accuracy of this certification, however, the Commission requests 
comment on whether the proposed amendment to the Rule will have a 
significant impact on a substantial number of small entities, including 
specific information on the effect of the proposed amendment on the 
costs, profitability, and competitiveness of, and employment in, small 
entities. Although the Commission certifies under the RFA that the 
amendment proposed in this notice would not, if promulgated, have a 
significant impact on a substantial number of small entities, the 
Commission has determined, nonetheless, that it is appropriate to 
publish an IRFA in order to inquire into the impact of the proposed 
Rule on small entities. Therefore, the Commission has prepared the 
following analysis:

A. Description of the Reasons That Action by the Agency Is Being 
Considered

    The Rule's sliding scale mechanism for obtaining parental consent 
is scheduled to expire on April 21, 2005. At the time it issued the 
final Rule, the Commission anticipated that the sliding scale was 
necessary only in the short term because more reliable methods of 
obtaining verifiable parental consent would soon be widely available at 
a reasonable cost. At the present time, however, it appears that the 
expected progress in available technology has not occurred. Therefore, 
in this action, the Commission is proposing, and seeking comment on, a 
proposed amendment to the Rule that would make the sliding scale 
permanent.

B. Statement of the Objectives of, and Legal Basis for, the Proposed 
Amendment to the Rule

    The objective of the proposed amendment to the Rule is to allow 
operators of websites or online services who collect children's 
personal information for internal uses only to continue to have the 
option of using email-based parental consent, instead of having to use 
one of the more costly methods. The proposed amendment would continue 
the status quo instead of allowing the sliding scale to expire in April 
2005. The proposed amendment is authorized by and based upon section 
312.5 of the Children's Online Privacy Protection Rule, 16 CFR 
312.5(b)(2), which in turn is based upon section 1303(b) of COPPA.

C. Small Entities to Which the Proposed Amendment to the Rule Will 
Apply

    As described above, the proposed amendment to the Rule applies to 
any commercial operator of a website or online service, including 
operators who are small entities, who collects children's personal 
information for

[[Page 2582]]

internal uses only. The Commission does not currently have sufficient 
information to determine the number of small entities that may be 
affected. The Commission invites comment and information on this issue.

D. Projected Reporting, Recordkeeping, and Other Compliance 
Requirements

    The Rule does not directly impose any ``reporting'' or 
``recordkeeping'' requirements within the meaning of the Paperwork 
Reduction Act, but does require that operators make certain third-party 
disclosures to the public, i.e., provide parents with notice of their 
privacy policies. The proposed amendment to make permanent the sliding 
scale mechanism for obtaining parental consent would not impose any 
additional reporting, recordkeeping, or other compliance requirements. 
In addition, the amendment would not affect the costs of complying with 
the Rule because it is merely extending a sliding scale mechanism that 
is already in place and that enables qualified website operators to 
obtain parental consent through lower-cost email-based means.

E. Duplicative, Overlapping, or Conflicting Federal Rules

    The Commission has not identified any other federal statutes, 
rules, or policies that duplicate, overlap, or conflict with the 
proposed amendment to the Rule. The Commission invites comment and 
information on this issue.

F. Significant Alternatives to the Proposed Amendment to the Rule

    Under the proposed amendment to the Rule, subject operators will 
continue to be able to choose email-based methods of obtaining parental 
consent instead of having to rely solely on the more costly methods. 
Therefore, the proposed amendment actually permits greater flexibility 
for small entities than would allowing the sliding scale to expire in 
April 2005. A delayed effective date was not considered here, because 
the regulatory uncertainty resulting from such a delay would not 
benefit small entities.
    The Commission invites comment and information on the economic 
impact of the proposed amendment on small entities, including 
significant alternatives, if any, to the proposed amendment that would 
result in greater flexibility for small businesses, while meeting the 
objectives and requirements of COPPA and the Rule. After considering 
such comments, if any, the Commission will determine whether 
preparation of a final regulatory flexibility analysis (pursuant to 5 
U.S.C. 605) is required.

List of Subjects in 16 CFR Part 312

    Children, Communications, Consumer protection, Electronic mail, E-
mail, Internet, Online service, Privacy, Record retention, Safety, 
Science and technology, Trade practices, Website, Youth.

    Accordingly, for the reasons stated in the preamble, the Federal 
Trade Commission proposes to amend 16 CFR Part 312 as follows:

PART 312--CHILDREN'S ONLINE PRIVACY PROTECTION RULE

    1. The authority citation for Part 312 continues to read as 
follows:

    Authority: 15 U.S.C. 6501 et seq.

    2. Amend Sec.  312.5 by revising the second sentence of paragraph 
(b)(2) to read as follows:


Sec.  312.5  Parental consent.

* * * * *
    (b) * * *
    (2) * * * Provided that: Methods to obtain verifiable parental 
consent for uses of information other than the ``disclosures'' defined 
by Sec.  312.2 may also include use of e-mail coupled with additional 
steps to provide assurances that the person providing the consent is 
the parent. * * *
* * * * *

    By direction of the Commission.
Donald S. Clark,
Secretary.
[FR Doc. 05-877 Filed 1-13-05; 8:45 am]
BILLING CODE 6750-01-P