FTC: Consumer Privacy Comments Concerning The Childrens Advertising Review Unit--P954807
Supplement to Comment #008,
Submitted by the Children's Advertising
July 14, 1997
At the June 1997 Workshop on Privacy Commissioner Starek requested that the Children's Advertising Review Unit (CARU) visit the Websites cited in the survey submitted to the Commission by the Center for Media Education (CME) and Consumer Federation of America (CFA) and report back as to whether they are in compliance with the privacy provisions of our Guidelines.
I. Current Definition of Reasonable Efforts
CARU has said from the start that the "reasonable efforts" standard enunciated in its Guidelines is an evolving one; that standard has begun to define itself, based on the industry's implementation of the Guidelines, and our increasing knowledge regarding what is feasible and available.
CARU's Guidelines require that "reasonable efforts" be made to provide notice and choice to parents when information is collected from children online. CARU currently interprets these reasonable efforts as follows, depending on the type and sensitivity of the information collected:
In all cases, the information collection or tracking practices must be clearly disclosed, along with the means of correcting or removing the information. The disclosure notice should be prominent and readily accessible before any information is collected. For instance, in the case of passive tracking, the notice should be on the page where the child enters the site.
For real world, personally identifiable information, which would enable the recipient to directly contact the child offline, the company must obtain prior parental consent, regardless of the intended use.
When personally identifiable information will be publicly posted so as to enable others to communicate directly with the child online, or shared with third parties, the company must obtain prior parental consent.
For other identifiable information, such as email addresses, first names, hometowns, the company must directly notify the parent of the nature and intended uses and offer the opportunity to remove or correct the information.
For all other anonymous or aggregate information, whether gathered directly or through passive means, the company must clearly disclose the nature and intended uses of the information.
Certain practices, such as the use of an email address for a single communication, in response to a visitor-initiated request, with no retention of the address by the Website, seem to fall outside of the definition of data collection. Examples of this practice would include the visitor sending an "e-card" to a friend (as on the M&M site), or a single non-promotional letter to the visitor (as on the Colgate site). In neither of these instances does the site retain the information, and it seems unreasonable to require the site to actually collect data in order to notify parents when the activity is non-promotional and allows no future communication with the visitor.
II. Review of Children's Websites' Information Collection Practices
Of the thirty-eight Websites CARU has successfully contacted nineteen, all of which were highly receptive to making changes where necessary; we have been working with these to ensure compliance with our Guidelines. Of the remaining sites, eight(1) are generally targeted to an older audience, although they do attract youngsters as well. We put a priority on working with the child-directed sites but are currently formulating an approach to these general audience sites; we will keep the Commission apprised. One additional site, Kidstar, is no longer publishing. We have attempted to contact the remaining ten sites(2) ; we have either been unable to contact them in the time since the Workshop, or have just begun a dialogue, but will continue to work with these and other sites to bring them into compliance.
What follows is our review of the nineteen Websites. Unless otherwise stated, the practices reported in the CME/CFA survey are the same as those CARU found on our initial visit after the Workshop.
CARU has been working with this site since the 1996 FTC Workshop and it is currently in full compliance with our Guidelines.
This site, although called Microsoft Kids, is a technical and product oriented site with no activities or content which is particularly targeted to young children. In its "Guestbook" area Microsoft added a message reminding kids to get their parent's permission on June 12, and is currently working on a method of separating out children under 12 so that they will not be asked identifiable information. A complete re-design incorporating these changes will be in place in August 1997.
The site currently collects only an e-mil address to enter a contest, in order to inform winners; these addresses will not be used for any other communication. Collection of identifiable information in order to award prizes will require prior parental permission.
This site is targeted to older teens.
I. Analysis of Comparison of CME/CFA Proposed Guidelines and CARU Guidelines
Also at the June 1997 Workshop, the Center for Media Education and the Consumer Federation of America submitted a comparison of their proposed guidelines for information collection practices online, and those issued by the Children's Advertising Review Unit. Since CARU itself interprets its Principles and Guidelines, we offer the following point by point analysis of that comparison in order to further clarify the scope and intent of our Guidelines.
1. Coca-Cola, Glossy, Konami, NBA, Nintendo, Pepsi, Sega, Sony
2. Freezone, Gatorade, Ingenius Kidstation, McDonald's, Oscar Mayer, Time Warner, Toys'R'Us, Ty's Beanie Babies, Virtual Comics, Warner Brothers.