October 30, 1999
Web Companies and Parents Take In New Rules on Children's Sites
By PAMELA MENDELS 
martGirl is a Web site where girls are encouraged to share their views on everything from music to school to how to navigate adolescence.
It also is a commercial venture.
And that means that Luis Castro, director of online development for the New York City-based company, is spending his time these days poring through a 90-page federal document that outlines and explains new rules designed to protect the privacy of children online.
"I'm reading through it, seeing what the requirements are and trying to see it through the lens of what we provide," Castro said.
The rules, issued Oct. 20 by the Federal Trade Commission, are the result of the Children's Online Privacy Protection Act, passed by Congress in 1998. The rules go into effect April 21, 2000. They could have a major effect on the data-collection practices of Web sites aimed at children, especially those that offer children online entertainment in exchange for revealing personal information useful to marketers.
The rules apply to commercial Web sites or portions of Web sites meant for children under 13. Among other things, Web site operators will now be required to post prominent notice of their privacy policies, including information on the type of personal information collected from children, how it is used and whether it is given to others.
Parents are also given the right to gain access to the information collected and to have it deleted if they wish.
Perhaps most important, with a few exceptions, the rules also require the sites to get "verifiable" consent from parents before children may give out personal information. How the parents convey the consent depends on the way the child's information will be used.
| |
|
For operators of start-up Web sites, especially ones not affiliated with large media
companies, the new rules could well prove expensive | |
| |
Some parents are welcoming the new rules as a tool to help safeguard children's experience online.
"I think it's appropriate for parents to have to give permission," said Kenneth A. Averack, a McAllen, Tex., doctor and father of four children, including an 11-year-old who uses the Internet. "We are talking about personal information from my children."
Lisa C. Zaucha, of Alexandria, Va., the mother of an 11-year-old boy who likes to use the Internet, said that she would continue her current practice of forbidding her son to give out any information online. Nonetheless, she thinks the rules are a good step because they seek to put parents in charge of the dissemination of information about their children. "The Internet is just another area where kids are bombarded with stuff they don't need to be bombarded with," she said. "The first line of defense should be the folks."
That's the idea, according to Toby M. Levin, team leader for Internet advertising at the Federal Trade Commission. "The goal of the rules and the Children's Online Privacy Protection Act was to put parents in control of what information is collected from their children on Web sites," she said.
In deliberations before the rules were issued, children's advocates had argued against allowing parents to be able to give their consent by e-mail, saying e-mail was too easily forged by tech-savvy children. Industry representatives, meanwhile, urged e-mail permission, saying it would undermine the interactive and immediate nature of the Internet to require that parents use regular mail or other more traditional, but slower, methods.
In the end, the Federal Trade Commission worked out a compromise. In cases where the information is to be used only by the Web site, the parent can give his or her approval by e-mail, as long as the Web site operator then takes another step to try to confirm that the sender is, indeed, Mom or Dad. One acceptable second step in the FTC rules would be the sending of a confirmation e-mail message to the parent.
In cases in which the child is to participate in activities that pose greater risk to privacy or safety, however, e-mail alone will not suffice. Instead, the commission requires what it calls "more reliable methods of consent, " like a mailed-in approval or a "yes" response to an "800" telephone number staffed by someone trained to verify that an adult is the caller. Examples of these riskier activities include the site's selling personal information to marketers or the child's participation in chat-rooms.
This "sliding scale" approach is to expire after two years, because by 2002, commission officials expect that reliable electronic methods of confirming a parent's identity will be widely available. Violators of the law are subject to fines of $11,000 penalty per violation.
Kathryn C. Montgomery, president of the Center for Media Education, an electronic media public interest group based in Washington, D.C., said that although she was disappointed that the FTC did not require off-line parental consent in all cases, she thinks the new rule is a reasonable compromise, because it will force commercial sites to decide if they want to go through the trouble of doing things like setting up "800" systems in exchange for getting more expansive information from children. "It will cause them to pause and weigh their options. If so, that's a good thing," she said. "They are poised to make a lot of money off children. If they are going to do that, I think there need to be rules."
For operators of start-up Web sites, especially ones not affiliated with large media companies, the new rules could well prove expensive, said Parry Aftab, a lawyer based in Paramus, N.J., who represents a number of small commercial Web sites aimed at children. She said clients have estimated that in many cases it costs them between $50,000 and $75,000 to set up the non-e-mail-based parental consent mechanisms envisioned by the new rule. At the same time, she said, although small Web site operators are not thrilled about having new regulations to comply with, they are not devastated by the new rules either. "I've heard: 'We don't like this, but we don't have a choice and it's not as bad as it could have been,'" she said.
Indeed, Aftab said, many sites are now trying to figure out how to bring down the costs of compliance. One plan she is involved with is to establish a central children's Web site registry to which parents can turn, find out about a number of children's sites, decide which ones they want to let their children join and give them permission through a one-time off-line registration.
Some site operators say the new rule will probably mean little for them because of procedures they had already put in place. Headbone Interactive Inc., a Seattle-based company that runs a site for children called Headbone Zone, already requires parental consent for its users under 13 through an "800" telephone number or faxed note.
"It would probably be more efficient if we didn't have those requirements," said Joseph M. Taritero, president of the company. "But that's where responsibility comes in."
Eric S. Aledort, vice president of business and legal affairs for Buena Vista Internet Group, Disney's Internet division, said the new rules will mean one change at the company's Go.com Web site, which it runs with the Infoseek search service and which contains some features meant for adults, others for children. The company will now send confirmation e-mail messages to parents when necessary. "That's something we don't do today that we will do," he said. The procedure is already in place at the company's Disney.com site.
Time Warner Inc., which runs several sites aimed at children, will be looking at its sites as well. "It's additional effort, additional people, additional expense," said Arthur B. Sackler, vice president for law and public policy at Time Warner. Nonetheless, Sackler said, he considers the rules "a pretty reasonable approach by the FTC."
Castro, at SmartGirl, said that in reviewing the rules he is paying especially close attention to what they mean for message boards in which visitors can post their ideas. That is because SmartGirl, which targets a 12- to 19 year-old-crowd but also has some 11-year-old visitors, operates nine message boards on issues ranging from sports to harassment.
Castro said that in examining allowable options, like use of an "800" number, he will also have to consider what steps are affordable for a small company.
But first, he needs to absorb the rules. "We want to make sure make sure we understand the law," Castro said. "Then we'll move forward from there."
Related Sites
These sites are not part of The New York Times on the Web, and The Times has no control over their content or availability.
Pamela Mendels at mendels@nytimes.com welcomes your comments
and suggestions.
