FTC: Consumer Privacy Comments Concerning The Childrens Advertising Review Unit--P954807 Supplement to Comment #008, Submitted by the Children's Advertising
Review Unit July 14, 1997 At the June 1997 Workshop on Privacy Commissioner Starek requested that the Children's Advertising Review Unit (CARU) visit the Websites cited in the survey submitted to the Commission by the Center for Media Education (CME) and Consumer Federation of America (CFA) and report back as to whether they are in compliance with the privacy provisions of our Guidelines. I. Current Definition of Reasonable Efforts CARU has said from the start that the "reasonable efforts" standard enunciated in its Guidelines is an evolving one; that standard has begun to define itself, based on the industry's implementation of the Guidelines, and our increasing knowledge regarding what is feasible and available. CARU's Guidelines require that "reasonable efforts" be made to provide notice and choice to parents when information is collected from children online. CARU currently interprets these reasonable efforts as follows, depending on the type and sensitivity of the information collected: In all cases, the information collection or tracking practices must be clearly disclosed, along with the means of correcting or removing the information. The disclosure notice should be prominent and readily accessible before any information is collected. For instance, in the case of passive tracking, the notice should be on the page where the child enters the site. For real world, personally identifiable information, which would enable the recipient to directly contact the child offline, the company must obtain prior parental consent, regardless of the intended use. When personally identifiable information will be publicly posted so as to enable others to communicate directly with the child online, or shared with third parties, the company must obtain prior parental consent. For other identifiable information, such as email addresses, first names, hometowns, the company must directly notify the parent of the nature and intended uses and offer the opportunity to remove or correct the information. For all other anonymous or aggregate information, whether gathered directly or through passive means, the company must clearly disclose the nature and intended uses of the information. Certain practices, such as the use of an email address for a single communication, in response to a visitor-initiated request, with no retention of the address by the Website, seem to fall outside of the definition of data collection. Examples of this practice would include the visitor sending an "e-card" to a friend (as on the M&M site), or a single non-promotional letter to the visitor (as on the Colgate site). In neither of these instances does the site retain the information, and it seems unreasonable to require the site to actually collect data in order to notify parents when the activity is non-promotional and allows no future communication with the visitor. CARU continues to work with the industry to design appropriate safeguards for certain other practices, such as sending periodic updates or newsletters at the visitor's request, when the email address is not used for any other purpose. One approach is to incorporate a parent notification letter and privacy policy disclosure, along with instructions for discontinuing the mailings, with the initial confirmation or update. II. Review of Children's Websites' Information Collection Practices Of the thirty-eight Websites CARU has successfully contacted nineteen, all of which were highly receptive to making changes where necessary; we have been working with these to ensure compliance with our Guidelines. Of the remaining sites, eight(1) are generally targeted to an older audience, although they do attract youngsters as well. We put a priority on working with the child-directed sites but are currently formulating an approach to these general audience sites; we will keep the Commission apprised. One additional site, Kidstar, is no longer publishing. We have attempted to contact the remaining ten sites(2) ; we have either been unable to contact them in the time since the Workshop, or have just begun a dialogue, but will continue to work with these and other sites to bring them into compliance. What follows is our review of the nineteen Websites. Unless otherwise stated, the practices reported in the CME/CFA survey are the same as those CARU found on our initial visit after the Workshop. Bonus.com: The site will add an e-mail letter to parents detailing its information collection and privacy policy; it will also update its on-screen privacy policy to include an explanation of its use of cookies, and to improve accessibility. [See appendix] Colgate.com/Kids-world: Colgate will craft revisions to its "Tooth Fairy" page to incorporate CARU's Guideline suggestions for parent notification; it will also add an on-screen privacy policy. Crayola.com: The site will add an on-screen privacy policy. On the Crayola Canada site the format for contests or bulletin boards will be revised by removing identifiable information, requiring prior parental permission, or some combination. [See appendix] Fritolay.com: All of the identifiable information requested on the site had been removed prior to the Workshop, after CARU notified the company that this was a violation of the Guidelines. Currently, there is no information collected on the site. Fritolay will be adding an on-screen privacy policy and will directly notify parents if e-mail addresses are requested in the future. [See appendix] Youruleschool.com: There is no information requested on this site; General Mills has added an on-screen privacy policy. Actionman.com: The registration area has been removed from the site; Hasbro will add an on-screen privacy policy to all of its sites. Hasbro.com/battleship: The players on this interactive game site are predominately 18-35 years old. Hasbro will add an on-screen privacy policy to all of its sites. Monopoly.com: This site has never used cookies technology, and a questionnaire on the site requests no identifiable information. Hasbro will add an on-screen privacy policy to all of its sites. Jazzygirls.com: Binney & Smith will revise the registration with a parent letter and/or removing identifiable information; the site will also add an on-screen privacy policy. [See appendix] Jellybelly.com: The responses to the free offer on this site are overwhelmingly from adults and older teens; approximately 8% of respondents are under 12 years old. The site will add an on-screen privacy policy. Kelloggs.com: Visitors to this site are of all ages; the only information requested is an e-mail address if the visitor wants updates, and a message reminds kids to get their parent's permission. Visitors can also send e-cards. The site will add an on-screen privacy policy, and is working on a way to enable adults to receive update information, while ensuring that children have parental permission. Kidscom.com: CARU has been working with this site since the 1996 FTC Workshop and it is currently in full compliance with our Guidelines. M-ms.com: M&M Mars, Inc. has revised this site to bring it into compliance with the Guidelines. The site has discontinued its Wanted Poster e-mail section, and now includes an on-screen privacy policy and a "Special Note to Parents". The site currently sends an e-mail newsletter to visitors who request it; it is adding a letter to parents and privacy policy to the confirmation letter it sends in response to this request. Microsoft.com/kids: This site, although called Microsoft Kids, is a technical and product oriented site with no activities or content which is particularly targeted to young children. In its "Guestbook" area Microsoft added a message reminding kids to get their parent's permission on June 12, and is currently working on a method of separating out children under 12 so that they will not be asked identifiable information. A complete re-design incorporating these changes will be in place in August 1997. Chipsahoy.com: This Nabisco contest site is primarily entered by classroom groups with teacher oversight. The site has a prominent notice on the home page that children should never provide any information without a parent or guardian's permission. It will add a notice to the entry form that children should have an adult's permission. It has added an onscreen privacy policy to the site. Nabiscokids.com: The site currently collects only an e-mil address to enter a contest, in order to inform winners; these addresses will not be used for any other communication. Collection of identifiable information in order to award prizes will require prior parental permission. Nick.com: Nickelodeon has re-designed its site. There is currently no information actively collected online. Sweepstakes will require offline entry (through a postcard with parent's signature) until parental permission can be ascertained online. The site has added an onscreen privacy policy to the site. [See appendix] Nick-at-Nite.com: This site is targeted to older teens. Disney.com: If a child under 16 registers on this site, Disney Online sends an e-mail letter to the parent telling the parent that the child has registered, and providing instructions for canceling the registration. The site has added an on-screen privacy policy, which is currently being revised to include disclosure of its use of cookies. The link to the free catalog is in the store site, which is not targeted to children, and Disney Online will be addressing how to change the way the catalog is ordered so that children will not be providing identifiable information online. I. Analysis of Comparison of CME/CFA Proposed Guidelines and CARU Guidelines Also at the June 1997 Workshop, the Center for Media Education and the Consumer Federation of America submitted a comparison of their proposed guidelines for information collection practices online, and those issued by the Children's Advertising Review Unit. Since CARU itself interprets its Principles and Guidelines, we offer the following point by point analysis of that comparison in order to further clarify the scope and intent of our Guidelines. 1. Coca-Cola, Glossy, Konami, NBA, Nintendo, Pepsi, Sega, Sony 2. Freezone, Gatorade, Ingenius Kidstation, McDonald's, Oscar Mayer, Time Warner, Toys'R'Us, Ty's Beanie Babies, Virtual Comics, Warner Brothers. |