| July 30, 1999 Secretary Re: Workshop on Proposed Regulations Implementing the Children's Online Privacy Protection Act, July 20, 1999 Dear Mr. Secretary, In addition to our live testimony for the record, the Children's Advertising Review Unit (CARU) of the Council of Better Business Bureaus submits the following statement for the record in the above referenced proceeding. We are submitting this comment via electronic mail. Statement of the Children's Advertising Review Unit The Children's Advertising Review Unit (CARU) of the Council of Better Business Bureaus is a self-regulatory program which for more than two decades has reviewed advertising and promotional material directed at children. CARU is one of two self-regulatory programs administered by the CBBB that deal with online privacy issues and children, the other is the BBBOnline Privacy for Kids Seal Program, which was launched earlier this year. CARU submits this additional statement for the record after reading and hearing the concerns expressed by some members of the industry over the costs of obtaining verifiable parental consent before children can participate in activities where they can divulge personal information about themselves to third parties. Some have made the argument that e-mail notice to parents and opt out should be sufficient. While CARU has great respect for both the companies and the concerns they have expressed, we would like to clarify our position requiring verifiable parental consent for these activities. We also urge the Commission to require the use of offline mechanisms to obtain consent until truly verifiable online mechanisms become available. Verifiable parental consent is necessitated under both CARU's Guidelines for Interactive Electronic Media (the Guidelines) and COPPA where the sites:
COPPA defines verifiable parental consent as "any reasonable effort (taking into consideration available technology)…to ensure that a parent of a child receives notice of the operator's personal information collection, use, and disclosure practices, and authorizes the collection, use and disclosure, as applicable, of personal information and the subsequent use of that information before that information is collected from that child." Both our Guidelines and COPPA emphasize the evolving nature of technology and we anticipate that new methods of securing truly verifiable online consent will emerge. However, until they do, CARU will continue to require offline consent where sites permit children under age 13 to post personally identifiable information about themselves or gather offline contact information directly from children. At this time, CARU is also prepared to work with sites that use an e-mail mechanism coupled with either an offline confirmation that the e-mail consent is from the parent (such as a confirmation telephone call) or with an enhanced technology, such as a digital signature. However, these methods do not appear easy to implement as of yet. CARU is aware that there are increased costs for current offline methods, because they require site operators to input offline registration forms individually. We are also aware that creating downloadable forms is not yet a science and we will work in the coming months with operators to make such forms more user friendly to avoid user frustration. However, we remain steadfast in our belief that verifiable parental consent must be obtained offline and that the added costs of inputting information must be treated as a cost of doing business with children. We appreciate that taking these additional measures to protect children do create an additional cost, but believe that the issues involved in doing business with children make it an appropriate one.CARU adheres to this position because we are not yet satisfied that there is any way to verify that e-mail consent forms are actually from a parent. We believe that by requiring offline consent, there is less likelihood that a child will submit a falsified consent when they must download a form, sign it and return it by postal mail. In addition, where sites employ a toll-free registration number, operators may be trained to screen out some child callers, thereby improving the rate of actual parental consent. RU believes that these precautions are necessary at this time where sites provide chat rooms, bulletin boards, and home pages for children, because the potential risks to children who disclose personal information to strangers is in fact far greater than that posed by providing information to commercial Websites, and clearly warrants the same level of parental notice, choice and control. Despite the increase in cost required to protect children, we understand that a number of the smaller sites with which we've worked have found them quite manageable. Thus, we have worked with sites to develop call-in registrations through toll-free numbers, downloadable forms that can be returned via postal mail or facsimile. For example, such methods are employed by CARU compliant sites including Headbone Zone, Curiocity's FreeZone, Able Mind's Cyberkids, and the Health Tex Girls Club. Generally the sites have been small scale sites - that despite small budgets - and despite the added costs of setting up offline consent mechanisms, including added personnel to input forms, the cost of setting up a toll free call-in registration line or inputting mailed in registrations -- have stayed the course. These site operators have told us that the most difficult aspect of the process was setting up the initial forms or software. As a result of Curiocity's Freezone's success in implementing monitoring and registration methods for their chat and bulletin boards, FreeZone has begun offering their services to other child directed sites that offer community type features like personalized pages, chat and bulletin boards for kids. Both Cyberkids and Freezone have also stated that they believe that by requiring offline consent, they may be deterring child predators from participating in their sites because they require offline forms to be signed or require contact information. And while both site operators said that some parents or children may be turned away from their sites because the registration process is not instantaneous, they also stated that their experience shows that other parents may take a greater interest and surf with their children after being involved in the registration process. In addition to working with sites that need to obtain verifiable parental consent, both under our Guidelines and COPPA, CARU has worked with nearly 100 sites in creating children's content and activities online that do not require children to divulge offline contact information or that provide direct parental notification and opt out information to parents by e-mail where a child has signed up for an e-mail newsletter or contest as permitted by section 312.5 (c) of COPPA. These sites include some of the most popular online sites for kids and range from the Children's Television Workshop, MamaMedia, General Mill's "You Rule Your School," Mattel's Barbie and Hot Wheels sites, to Crayola's Coloring Book site. The privacy policies at each of these sites state What's more, many of the sites CARU works with include easy to
understand information for children explaining why it is important to never give away
personally identifiable information online without mom and dad's consent. They also comply
with CARU's advertising guidelines, that ads be age appropriate and labeled as ads. For
example, many of our compliant sites include warnings about privacy before a child links
to another site or alerts the child that she is about to leave the site to view an
advertisement. One site that CARU worked with is the Chevronc The efforts of these sites, that provide direct parental notification and opt out, and that have minimized information collection from children, are truly outstanding. Not only do they help put parents in control by sharing info on where their kids are visiting, they have helped shape the way sites treat children online and foster activities and content that permit kids to have rewarding experiences online without divulging information about themselves. By limiting children's abilities to post personally identifiable information about themselves to situations where parents have given consent, they have also reduced the potential risks associated with children divulging information to strangers online. CARU therefore strongly urges the Commission to adhere to the position that verifiable parental consent must be obtained using offline methods until truly verifiable e-mail based mechanisms become available. Given the successes of the numerous children's Web site operators in working with CARU to adhere to our Guidelines and provide enhanced privacy protection for children online, CARU looks forward to reaching out to other sites and working with the Commission in ensuring continued compliance both with our Guidelines and COPPA. Respectfully submitted, Elizabeth Lascoutx A. Cassidy Sehgal-Kolbet |