[Federal Register Volume 73, Number 122 (Tuesday, June 24, 2008)]
[Notices]
[Pages 35689-35690]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: E8-14148]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION


Agency Information Collection Activities; Submission for OMB 
Review; Comment Request; Extension

AGENCY: Federal Trade Commission (``Commission'' or ``FTC'').

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: The FTC is seeking public comments on its proposal to extend 
through July 31, 2011, the current Paperwork Reduction Act (``PRA'') 
clearance for information collection requirements contained in the 
Children's Online Privacy Protection Act Rule (``COPPA Rule''), which 
will expire on July 31, 2008. The information collection requirements 
described below will be submitted to the Office of Management and 
Budget (``OMB'') for review, as required by the PRA.

DATES: Comments must be submitted on or before July 24, 2008.

ADDRESSES: Interested parties are invited to submit written comments. 
Comments should refer to ``FTC COPPA PRA Comment: FTC File No. 
P084511'' to facilitate the organization of comments. A comment filed 
in paper form should include this reference both in the text and on the 
envelope and should be mailed or delivered to the following address: 
Federal Trade Commission, Room H-135 (Annex J), 600 Pennsylvania Ave., 
N.W., Washington, D.C. 20580. Because paper mail in the Washington area 
and at the Commission is subject to delay, please consider submitting 
your comments in electronic form, as prescribed below. If, however, the 
comment contains any material for which confidential treatment is 
requested, it must be filed in paper form, and the first page of the 
document must be clearly labeled ``Confidential.''\1\
---------------------------------------------------------------------------

    \1\ Commission Rule 4.2(d), 16 CFR 4.2(d). The comment must be 
accompanied by an explicit request for confidential treatment, 
including the factual and legal basis for the request, and must 
identify the specific portions of the comment to be withheld from 
the public record. The request will be granted or denied by the 
Commission's General Counsel, consistent with applicable law and the 
public interest. See Commission Rule 4.9(c), 16 CFR 4.9(c).
---------------------------------------------------------------------------

    Comments filed in electronic form should be submitted by following 
the instructions on the web-based form at (https://secure.commentworks.com/ftc-COPPARule). To ensure that the Commission 
considers an electronic comment, you must file it on the web-based form 
at the (https://secure.commentworks.com/ftc-COPPARule) weblink. If this 
notice appears at (www.regulations.gov), you may also file an 
electronic comment through that website. The Commission will consider 
all comments that www.regulations.gov forwards to it.
    All comments should additionally be submitted to: Office of 
Management and Budget, Attention: Desk Officer for the Federal Trade 
Commission. Comments should be submitted via facsimile to (202) 395-
6974 because U.S. Postal Mail is subject to lengthy delays due to 
heightened security precautions.
    The FTC Act and other laws the Commission administers permit the 
collection of public comments to consider and use in this proceeding as 
appropriate. All timely and responsive public comments will be 
considered by the Commission and will be available to the public on the 
FTC website, to the extent practicable, at www.ftc.gov. As a matter of 
discretion, the FTC makes every effort to remove home contact 
information for individuals from the public comments it receives before 
placing those comments on the FTC website. More information, including 
routine uses permitted by the Privacy Act, may be found in the FTC's 
privacy policy at (http://www.ftc.gov/ftc/privacy.htm).

FOR FURTHER INFORMATION CONTACT: Requests for additional information 
regarding this proceeding should be addressed to Mamie Kresses, (202) 
326-2070, Federal Trade Commission, Bureau of Consumer Protection, 
Division of Advertising Practices, 600 Pennsylvania Ave., N.W., Mail 
Drop NJ-3212, Washington, D.C. 20580.

SUPPLEMENTARY INFORMATION: On March 26, 2008, the FTC sought comment on 
the information collection requirements associated with the COPPA Rule, 
16 CFR Part 312 (OMB Control Number 3084-0117). 73 FR 16015. No 
comments were received. Pursuant to the OMB regulations, 5 CFR Part 
1320, that implement the PRA, 44 U.S.C. 3501-3521, the FTC is providing 
this second opportunity for public comment while seeking OMB approval 
to extend the existing paperwork clearance for the Rule. All comments 
should be filed as prescribed in the ADDRESSES section above, and must 
be received on or before July 24, 2008.
    Estimated annual hours burden: 1,900 hours
    (a) Disclosure Requirements: 1,800 hours
    The COPPA Rule contains certain statutorily-required notice 
requirements, which constitute a ``collection of information'' under 
the PRA:
    (1) the Rule requires each website and online service directed to 
children,\2\ and any website or online service with actual knowledge 
that it is collecting personal information from children, to provide 
notice of how it collects, uses, and discloses such information and, 
with exceptions, to obtain the prior consent of the child's parent in 
order to engage in such collection, use, and disclosure;
---------------------------------------------------------------------------

    \2\ ``Child'' is defined under the statute and implementing Rule 
as an individual under thirteen years of age. 15 U.S.C. 6501(2); 16 
CFR 312.2.
---------------------------------------------------------------------------

    (2) the Rule requires the operator to provide the parent with 
notice of the specific types of personal information being collected 
from the child, to give the parent the opportunity to forbid the 
operator at any time from collecting, using, or maintaining such 
information, and to provide reasonable means for the parent to review 
the information;
    (3) the Rule requires operators to obtain ``verifiable parental 
consent'' prior to collecting, using, or disclosing children's personal 
information;
    (4) the Rule requires website and online service operators to 
establish

[[Page 35690]]

procedures that protect the confidentiality, security, and integrity of 
personal information collected from children; and
    (5) the Rule requires operators to provide reasonable means for the 
parent to review the information.
    The FTC staff retains its estimate that roughly 30 new web entrants 
each year will fall within the Rule's coverage and that, on average, 
new entrants will spend approximately 60 hours crafting a privacy 
policy, designing mechanisms to provide the required online privacy 
notice and, where applicable, the direct notice to parents.\3\ 
Accordingly, staff estimates that complying with the Rule's disclosure 
requirements will require approximately 1,800 hours (30 new web 
entrants x 60 hours per entrant). Consistent with prior estimates, FTC 
staff estimates that the time spent on compliance would be apportioned 
five to one between legal (lawyers or similar professionals) and 
technical (computer programmers) personnel. Staff therefore estimates 
that lawyers or similar professionals who craft privacy policies will 
account for 1,500 of the 1,800 hours required. Computer programmers 
responsible for posting privacy policies and implementing direct 
notices and parental consent mechanisms will account for the remaining 
300 hours.
---------------------------------------------------------------------------

    \3\ Although staff cannot determine with any degree of certainty 
the number of new entrants potentially subject to the Rule, it 
believes its estimate is reasonable. The Commission received no 
comments challenging staff's prior PRA analyses in its prior 
requests for renewed clearance for the Rule or when it most recently 
sought comment on the Rule itself (70 FR 21107, 21109, April 22, 
2005). Accordingly, staff retains those estimates for the instant 
PRA analysis. For the same reasons, staff retains its prior estimate 
of 60 hours per new entrant.
---------------------------------------------------------------------------

    Website operators that have previously created or adjusted their 
sites to comply with the Rule will incur no further burden associated 
with the Rule, unless they opt to change their policies and information 
collection in ways that will further invoke the Rule's provisions. 
Moreover, staff believes that existing COPPA-compliant operators who 
introduce additional sites beyond those they already have created will 
incur minimal, if any, incremental PRA burden. This is because such 
operators already have been through the start-up phase and can carry 
over the results of that to the new sites they create.
    (b) Reporting Requirements for Safe Harbor Applicants: 100 hours
    Operators can comply with the Rule by meeting the terms of industry 
self-regulatory guidelines that the Commission approves after notice 
and comment.\4\ While the submission of industry self-regulatory 
guidelines to the agency is voluntary, the Rule includes specific 
reporting requirements that all safe harbor applicants must provide to 
receive Commission approval. Staff retains its estimate that it would 
require, on average, 265 hours per new safe harbor program applicant to 
prepare and submit its safe harbor proposal in accordance with Section 
312.10(c) of the Rule. Industry sources have confirmed that this 
estimate is reasonable and advised that all of this time would be 
attributable to the efforts of lawyers. Given that several safe harbor 
programs are already available to website operators, FTC staff believes 
that it is unlikely that more than one additional safe harbor applicant 
will submit a request within the next three years of PRA clearance 
sought. Thus, annualized burden attributable to this requirement would 
be approximately 85 hours per year (265 hours / 3 years) or, roughly, 
100 hours. Staff believes that most of the records submitted with a 
safe harbor request would be those that these entities have kept in the 
ordinary course of business, and that any incremental effort associated 
with maintaining the results of independent assessments or other 
records under Section 312.10(d)(3) also would be in the normal course 
of business. In accordance with the regulations implementing the PRA, 
the burden estimate excludes effort expended for these activities. 5 
CFR 1320.3(b)(2).
---------------------------------------------------------------------------

    \4\ See Section 312.10(c). Approved self-regulatory guidelines 
can be found on the FTC's website at (http://www.ftc.gov/privacy/privacyinitiatives/childrens_shp.html.)
---------------------------------------------------------------------------

    Accordingly, FTC staff estimates that total burden per year for 
disclosure requirements affecting new web entrants and reporting 
requirements for safe harbor applications would be approximately 2,000 
hours, rounded to the nearest thousand.
    Labor costs: Labor costs are derived by applying appropriate hourly 
cost figures to the burden hours described above. Staff conservatively 
assumes hourly rates of $150 and $35, respectively, for lawyers or 
similar professionals and computer programmers.\5\ Based on these 
inputs, staff further estimates that associated annual labor costs for 
new entrants would be $235,000 [(1,500 hours x $150 per hour for legal) 
+ (300 hours x $35 per hour for computer programmers)] and $15,000 for 
safe harbor applicants (100 hours per year x $150 per hour), for a 
total labor cost of $250,000.
---------------------------------------------------------------------------

    \5\ FTC staff estimates average legal costs at $150 per hour, 
which is roughly midway between Bureau of Labor Statistics (BLS) 
mean hourly wages shown for attorneys (approximately $55) in the 
most recent whole-year data available online (2006) and what staff 
believes may more generally reflect hourly attorney costs ($250) 
associated with Commission information collection activities. The 
$35 estimate for computer programmers is also conservatively based 
on the most recent whole-year data available online from the BLS 
(2006 National Compensation Survey and 2006 Occupational Employment 
and Wage Statistics).
---------------------------------------------------------------------------

    Non-labor costs: Because websites will already be equipped with the 
computer equipment and software necessary to comply with the Rule's 
notice requirements, the sole costs incurred by the websites are the 
aforementioned estimated labor costs. Similarly, industry members 
should already have in place the means to retain and store the records 
that must be kept under the Rule's safe harbor recordkeeping 
provisions, because they are likely to have been keeping these records 
independent of the Rule.

David C. Shonka,
Acting General Counsel.
[FR Doc. E8-14148 Filed 6-23-08: 8:45 am]
BILLING CODE 6750-01-S