[Federal Register Volume 80, Number 186 (Friday, September 25, 2015)]
[Notices]
[Pages 57818-57820]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2015-24350]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION


Agency Information Collection Activities; Proposed Collection; 
Comment Request

AGENCY: Federal Trade Commission (``FTC'' or ``Commission'').

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: The FTC intends to ask the Office of Management and Budget 
(``OMB'') to extend for an additional three years the current Paperwork 
Reduction Act (``PRA'') clearance for information collection 
requirements contained in the Children's Online Privacy Protection Act 
Rule (``COPPA Rule'' or ``Rule''), which will expire on February 29, 
2016.

DATES: Comments must be filed by November 24, 2015.

ADDRESSES: Interested parties may file a comment online or on paper, by 
following the instructions in the Request for Comment part of the 
SUPPLEMENTARY INFORMATION section below. Write ``COPPA Rule: Paperwork 
Comment, FTC File No. P155408'' on your comment, and file your comment 
online at https://ftcpublic.commentworks.com/ftc/coppapra, by following 
the instructions on the web-based form. If you prefer to file your 
comment on paper, mail your comment to the following address: Federal 
Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW., 
Suite CC-5610 (Annex J), Washington, DC 20580, or deliver your comment 
to the following address: Federal Trade Commission, Office of the 
Secretary, Constitution Center, 400 7th Street SW., 5th Floor, Suite 
5610 (Annex J), Washington, DC 20024.

FOR FURTHER INFORMATION CONTACT: Requests for additional information 
should be addressed to Miry Kim, Attorney, (202) 326-3622, Division of 
Privacy and Identity Protection, Bureau of Consumer Protection, Federal 
Trade Commission, 600 Pennsylvania Avenue NW., Washington, DC 20580.

SUPPLEMENTARY INFORMATION: The COPPA Rule, 16 CFR part 312, requires 
commercial Web sites to provide notice and obtain parents' consent 
before collecting, using, and/or disclosing personal information from 
children under age 13, with limited exceptions. The COPPA Rule contains 
certain statutorily-required notice requirements that apply to 
operators of any Web site or online service directed to children, and 
operators of any Web site or online service with actual knowledge of 
collecting personal information from children. Covered operators must: 
provide online notice and direct notice to parents of how they collect, 
use, and disclose children's personal information; obtain the prior 
consent of the child's parent in order to engage in such collection, 
use, and disclosure, with limited exceptions; provide reasonable means 
for the parent to obtain access to the information and to direct its 
deletion; and, establish procedures that protect the confidentiality, 
security, and integrity of personal information collected from 
children.

Burden Statement

1. Estimated Annual Hours Burden: 17,500 Hours \1\
---------------------------------------------------------------------------

    \1\ This discussion and the associated burden estimates concern 
strictly recurring compliance obligations under the COPPA Rule. 
``One-time'' adjustments associated with entities' initial steps to 
comply with the January 17, 2013 final amendments to the COPPA Rule, 
78 FR 3972, already have been undertaken and accounted for in the 
FTC's previously published and cleared estimates associated with the 
final rulemaking.
---------------------------------------------------------------------------

(a) New Entrant Web Operators' Disclosure Burden
    Based on public comments on the Commission's 2013 final amendments 
to the COPPA Rule,\2\ FTC staff estimates that the Rule affects 
approximately 280 new operators per year.\3\ Staff maintains its 
longstanding estimate that new web operators will require, on average, 
approximately 60 hours crafting a privacy policy, designing mechanisms 
to provide the required online privacy notice and, where applicable, 
the direct notice to parents.\4\ Applied to the estimated number of new 
operators per year, this yields a cumulative yearly total of 16,800 
hours (280 new operators x 60 hours each).
---------------------------------------------------------------------------

    \2\ 78 FR at 4005.
    \3\ This consists of certain traditional Web site operators, 
mobile app developers, plug-in developers, and advertising networks.
    \4\ See, e.g., 78 FR at 4006; 76 FR 31334 (May 31, 2011); 73 FR 
35689 (June 24, 2008); 70 FR 21107 (April 22, 2005).
---------------------------------------------------------------------------

(b) Safe Harbor Applicant Reporting Requirements
    Operators can comply with the COPPA Rule by meeting the terms of 
industry self-regulatory guidelines that the Commission approves after 
notice and comment.\5\ While the submission of industry self-regulatory 
guidelines to the agency is voluntary, the COPPA Rule sets out the 
criteria for approval of guidelines and the materials that must be 
submitted as part of a safe harbor application. Staff estimates that it 
would require, on average, 265 hours per new safe harbor program 
applicant to prepare and submit its safe harbor proposal in accordance 
with section 312.11(c) of the Rule. In the past, industry sources have 
confirmed that this estimate is reasonable and advised that all of this 
time would be attributable to the efforts of lawyers. Given that 
several safe harbor programs are already available to Web site 
operators, FTC staff believes that it is unlikely that more than one 
additional safe harbor applicant will submit a request within the next 
three years of PRA clearance sought. Thus, annualized burden 
attributable to this requirement would be approximately 88 hours per 
year (265 hours /3 years) or, roughly, 100 hours, for the estimated one 
additional safe harbor applicant.
---------------------------------------------------------------------------

    \5\ See Section 312.11(c). Approved self-regulatory guidelines 
can be found on the FTC's Web site at http://www.ftc.gov/privacy/privacyinitiatives/childrens_shp.html.
---------------------------------------------------------------------------

    Staff believes that most of the records submitted with a safe 
harbor request would be those that these entities have kept in the 
ordinary course of business, and that any incremental effort associated 
with maintaining the results of independent assessments or other 
records under section 312.11(d)(3) also would be in the normal course 
of business. Under 5 CFR 1320.3(b)(2), OMB excludes from the definition 
of PRA burden the time and financial resources needed to comply with 
agency-imposed recordkeeping, disclosure, or reporting requirements 
that customarily would be undertaken independently in the normal course 
of business.
(c) Annual Audit and Report for Safe Harbor Programs
    The COPPA Rule requires safe harbor programs to audit their members 
at least annually and to submit annual reports to the Commission on the 
aggregate results of these member audits. The burden for conducting 
member audits and preparing these reports likely will vary for each 
safe harbor program depending on the number of members. Commission 
staff estimates that conducting audits and preparing reports will 
require approximately 100 hours per program per year. Aggregated for 
one new safe harbor (100 hours) and seven existing (700 hours) safe 
harbor programs, this amounts to an estimated cumulative reporting 
burden of 800 hours per year.

[[Page 57819]]

(d) Safe Harbor Program Recordkeeping Requirements
    FTC staff believes that most of the records listed in the COPPA 
Rule's safe harbor recordkeeping provisions consist of documentation 
that such parties have kept in the ordinary course of business 
irrespective of the COPPA Rule. As noted above, OMB excludes from the 
definition of PRA burden, among other things, recordkeeping 
requirements that customarily would be undertaken independently in the 
normal course of business. In staff's view, any incremental burden, 
such as that for maintaining the results of independent assessments 
under section 312.11(d), would be marginal.

2. Estimated Annual Labor Costs: $5,342,500

    Based on its experience with previously approved safe harbor 
programs, FTC staff anticipates that in-house counsel (primarily 
senior) will perform the legal tasks associated with safe harbor 
applications. Conversely, based on the 2013 rulemaking record, staff 
assumes that outside counsel will perform legal services tied to Rule 
compliance by new entrant web operators.
    For in-house legal costing, FTC staff applies to its analysis below 
an approximate mid-way between the mean hourly wage for lawyers 
($64.17),\6\ as appearing within the most recent annual compilation 
available online from the Bureau of Labor Statistics, and what 
Commission staff believes more generally reflects a rough approximation 
of hourly attorney costs ($300) associated with Commission information 
collection activities: $185, rounded upward.
---------------------------------------------------------------------------

    \6\ See Occupational Employment and Wages--May 2014, Table 1 
(National employment and wage data from the Occupational Employment 
Statistics survey by occupation, May 2014), available at http://www.bls.gov/news.release/ocwage.nr0.htm (hereinafter, ``BLS Table 
1'').
---------------------------------------------------------------------------

    Regarding outside counsel costs, the National Law Journal noted in 
connection with its 2014 Billing Survey (``survey'') of law firms that 
the average rate for partner billing was ``about'' $500, and that the 
average associate billing rate was $306.\7\ Commission staff believes 
it reasonable to assume that the workload among law firm partners and 
associates for COPPA compliance questions could be competently 
addressed and efficiently distributed among attorneys at varying levels 
of seniority, but would be weighted most heavily to more junior 
attorneys. Thus, assuming an apportionment of two-thirds of such work 
is done by associates, and one-third by partners, a weighted average 
tied to the average firm-wide associate and average firm-wide partner 
rates, respectively, in the National Law Journal 2014 survey would be 
about $370 per hour.
---------------------------------------------------------------------------

    \7\ Cf. Civil Division of the United States Attorney's Office 
for the District of Columbia, United States Attorney's Office, 
District of Columbia, Laffey Matrix B 2014-2015, available at http://www.justice.gov/sites/default/files/usao-dc/legacy/2014/07/14/Laffey%20Matrix_2014-2015.pdf (updated ``Laffey Matrix'' for 
calculating ``reasonable'' attorney fees in suits in which fee 
shifting as statutorily authorized can be evidence of prevailing 
market rates for litigation counsel in the Washington, DC area; 
rates in table range from $255 per hour for most junior associates 
to $520 per hour for most senior partners).
---------------------------------------------------------------------------

    Labor costing for other assumed relevant categories (technical 
assistance, compliance officers) is detailed within the discussion 
below.
(a) New Entrant Web Operators' Disclosure Burden
    Consistent with its past estimates, FTC staff assumes that the time 
spent on compliance for new operators and existing operators covered by 
the COPPA Rule would be apportioned five to one between legal (lawyers 
or similar professionals) and technical (e.g., computer programmers, 
software developers, and information security analysts) personnel. 
Staff therefore estimates that lawyers or similar professionals who 
craft privacy policies will account for 14,000 of the estimated 16,800 
hours required. Computer programmers responsible for posting privacy 
policies and implementing direct notices and parental consent 
mechanisms will account for the remaining 2,800 hours. FTC staff 
estimates an hourly wage of $42 for technical assistance, based on BLS 
data.\8\ Accordingly, paired with the above-noted estimated rate for 
outside counsel assistance, associated labor costs would be $5,297,600 
[(14,000 hours x $370/hour) + (2,800 hours x $42/hour)].
---------------------------------------------------------------------------

    \8\ The estimated mean hourly wages for technical labor support 
($42) is based on an average of the salaries for computer 
programmers, software developers, information security analysts, and 
web developers as reported by the BLS. See BLS Table 1.
---------------------------------------------------------------------------

(b) Safe Harbor Applicant Reporting Requirements
    Previously, industry sources have advised that all of the labor to 
comply with these requirements would be attributable to the efforts of 
lawyers. Accordingly, applying the estimated time stated above for 
these tasks (100 hours, annualized and rounded up) to the above-noted 
assumed hourly wage for in-house counsel ($185) yields $18,500 in labor 
cost per year.
(c) Annual Audit and Report for Safe Harbor Programs
    Commission staff assumes that annual reports will be prepared by 
compliance officers, at a labor rate of $33.\9\ Accordingly, applied to 
the above-stated estimates per year of 100 hours for a new safe harbor 
program and 700 hours, cumulatively, per year, for seven existing safe 
harbor programs, this amounts to $26,400 in aggregate yearly labor 
cost.
---------------------------------------------------------------------------

    \9\ See BLS Table 1 (compliance officers, $32.69).
---------------------------------------------------------------------------

(d) Safe Harbor Program Recordkeeping Requirements
    For the reasons stated in 1.(d) above, associated labor costs, for 
PRA purposes, would be nil or marginal.

3. Estimated Annual Non-Labor Costs: $0

    Because Web sites will already be equipped with the computer 
equipment and software necessary to comply with the Rule's notice 
requirements, the predominant costs incurred by the Web sites are the 
aforementioned estimated labor costs. Similarly, industry members 
should already have in place the means to retain and store the records 
that must be kept under the Rule's safe harbor recordkeeping 
provisions, because they are likely to have been keeping these records 
independent of the Rule. Capital and start-up costs associated with the 
Rule are minimal.

Request for Comments

    Under the PRA, 44 U.S.C. 3501-3521, federal agencies must obtain 
approval from OMB for each collection of information they conduct or 
sponsor. ``Collection of information'' means agency requests or 
requirements that members of the public submit reports, keep records, 
or provide information to a third party. 44 U.S.C. 3502(3), 5 CFR 
1320.3(c). As required by section 3506(c)(2)(A) of the PRA, the FTC is 
providing this opportunity for public comment before requesting that 
OMB extend the existing paperwork clearance for the COPPA Rule. (OMB 
Control Number 3084-0117). Comments must be received on or before the 
deadline specified above in the DATES section in order to be considered 
by the Commission.
    The FTC invites comments on: (1) Whether participation in the study 
is necessary, including whether the information will be practically 
useful; (2) the accuracy of our burden estimates, including whether the 
methodology and assumptions used are valid; (3) ways to enhance the 
quality, utility, and clarity of the information to be collected; and

[[Page 57820]]

(4) ways to minimize the burden of the collection of information.
    You can file a comment online or on paper. For the Commission to 
consider your comment, we must receive it on or before November 24, 
2015. Write ``COPPA Rule: Paperwork Comment, FTC File No. 155408'' on 
your comment. Your comment--including your name and your state--will be 
placed on the public record of this proceeding, including to the extent 
practicable, on the public Commission Web site, at http://www.ftc.gov/os/publiccomments.shtm. As a matter of discretion, the Commission tries 
to remove individuals' home contact information from comments before 
placing them on the Commission Web site.
    Because your comment will be made public, you are solely 
responsible for making sure that your comment does not include any 
sensitive personal information, like anyone's Social Security number, 
date of birth, driver's license number or other state identification 
number or foreign country equivalent, passport number, financial 
account number, or credit or debit card number. You are also solely 
responsible for making sure that your comment doesn't include any 
sensitive health information, like medical records or other 
individually identifiable health information. In addition, don't 
include any ``[t]rade secret or any commercial or financial information 
. . . which is privileged or confidential'' as provided in section 6(f) 
of the FTC Act 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16CFR 
4.10(a)(2). In particular, don't include competitively sensitive 
information such as costs, sales statistics, inventories, formulas, 
patterns devices, manufacturing processes, or customer names.
    If you want the Commission to give your comment confidential 
treatment, you must file it in paper form, with a request for 
confidential treatment, and you have to follow the procedure explained 
in FTC Rule 4.9(c)).\10\ Your comment will be kept confidential only if 
the FTC General Counsel, in his or her sole discretion, grants your 
request in accordance with the law and the public interest.
---------------------------------------------------------------------------

    \10\ In particular, the written request for confidential 
treatment that accompanies the comment must include the factual and 
legal basis for the request, and must identify the specific portions 
of the comment to be withheld from the public record. See FTC Rule 
4.9(c), CFR 4.9(c), 16 CFR 4.9(c).
---------------------------------------------------------------------------

    Postal mail addressed to the Commission is subject to delay due to 
heightened security screening. As a result, we encourage you to submit 
your comments online. To make sure that the Commission considers your 
online comment, you must file it at https://ftcpublic.commentworks.com/ftc/coppapra, by following the instructions on the web-based form. When 
this Notice appears at http://www.regulations.gov/#!home, you also may 
file a comment through that Web site.
    If you file your comment on paper, write ``COPPA Rule: Paperwork 
Comment, FTC File No. 155408'' on your comment and on the envelope, and 
mail it to the following address: Federal Trade Commission, Office of 
the Secretary, 600 Pennsylvania Avenue NW., Suite CC-5610 (Annex J), 
Washington, DC 20580, or deliver your comment to the following address: 
Federal Trade Commission, Office of the Secretary, Constitution Center, 
400 7th Street SW., 5th Floor, Suite 5610 (Annex J), Washington, DC 
20024. If possible, submit your paper comment to the Commission by 
courier or overnight service.
    The FTC Act and other laws that the Commission administers permit 
the collection of public comments to consider and use in this 
proceeding as appropriate. The Commission will consider all timely and 
responsive public comments that it receives on or before November 24, 
2015. For information on the Commission's privacy policy, including 
routine uses permitted by the Privacy Act, see http://www.ftc.gov/ftc/privacy.htm.

David C. Shonka
Principal Deputy General Counsel.
[FR Doc. 2015-24350 Filed 9-24-15; 8:45 am]
BILLING CODE 6750-01-P