Before the
FEDERAL TRADE COMMISSION
Washington, D.C. 20580

SUPPLEMENTAL

COMMENTS OF THE
DIRECT MARKETING ASSOCIATION, INC.

ON THE
CHILDREN'S ONLINE PRIVACY
PROTECTION RULE¾COMMENT, P994504

July 30, 1999

I. INTRODUCTION

The Direct Marketing Association, Inc. ("The DMA") is pleased to submit supplemental comments in response to the Federal Trade Commission's ("the Commission's") invitation at its July 20^th workshop on implementation of the Children's Online Privacy Protection Act of 1998 ("COPPA" or "the Act").

The DMA writes to emphasize three points: first, that it strongly supports the "sliding scale" approach to methods of consent endorsed by numerous participants in the workshop; second that the CME study presented on the eve of the workshop is not only devoid of supporting data, but proves very little; and finally, that proponents of inflexible approaches to implementing COPPA urge positions inconsistent with the statute.

i. THE COMMISSION SHOULD APPLY A SLIDING SCALE and allow e-mail consent without digital signatures where the information collected will not BE DISCLOSED TO THIRD PARTIES.

Many participants at the FTC workshop expressed support for a sliding scale in the context of methods for obtaining verifiable parental consent. The DMA strongly supports this idea, and believes that Cassidy Sehgal of CARU described it appropriately. When a website collects information from a person it knows to be a child or from a person on a website directed to children, parental consent can be obtained through an e-mail sent to the address of the parent provided by the child. However, if the website or an online service is going to facilitate a child's communication with third parties through the use of chat rooms, bulletin boards or free e-mail accounts, then safety concerns may require a higher standard in obtaining verifiable consent. This approach is fully consistent with the purposes of COPPA, whose legislative history recognizes that child safety is a distinct statutory interest from privacy. 144 Cong. Rcd. at S11657 (Oct. 7, 1998) (Statement of Sen. Bryan) [hereafter "Bryan Statement"].

We believe that this sliding scale based on third party disclosure makes a lot of sense. In both cases there should be parental consent. However, in the first instance, where the collection occurs only through a website and the information collected is not available to third parties, e-mail without digital signatures is a reasonable means of obtaining consent under currently available technology. In the second instance, a different method may be appropriate. To treat both situations the same would restrict unnecessarily "the interactivity of children's experience on the Internet and . . . children's access to information in this rich and valuable medium," in sharp contrast with the legislative purpose of COPPA. See Bryan Statement at S11657. We believe that this is consistent with the statutory mandate that consent be permitted through "any reasonable" means. 15 U.S.C. § 6501(9).

The statutory exceptions provide areas of flexibility where consent is not needed. See 15 U.S.C. § 6502(b)(2). Where consent is needed, the parental consent requirement "should be interpreted flexibly," Bryan Statement at S11657, and should include e-mail communications with parents where the personal information in question is not disclosed to third parties. Indeed, the State Attorneys General concede as much when they write that the "available technology" standard "is designed to provide operators with maximum flexibility" in choosing consent mechanisms. (Comments of Attorney General of NY, et al., at 6)

Of course, these solutions may change with available technology, and the Commission may want to reexamine these issues after a specific period of time or at a point when technology presents different alternatives. However, the workshop made clear beyond question that there is currently no digital signature or other technology besides traditional e-mail that allows electronically verifiable consent for consumers at websites. It was also clear that to the extent that technology will become available in the future, it will not be available until after the effective date of the statute in April of the year 2000.

The DMA supports the Commission's efforts to achieve a viable compromise in this area consistent with the statute, and believes that the sliding scale provides a solution for the current lack of available technological solutions.

II. THE COMMISSION SHOULD ATTACH LITTLE OR NO WEIGHT TO THE CME STUDY

The day before the workshop, the Center For Media Education ("CME") held a press conference to announce a study that purports to show the need for stronger regulation of children's sites. CME has thus far failed to make the underlying data supporting its conclusions public, preventing those with different views from responding to the data in during the supplemental comment period. Once the data is available, we look forward to analyzing it carefully, and will submit additional comments.

However, even the limited information CME made available when it released the study raises serious questions as to the survey's methodology in selecting "children's sites." Its list of sites included in the survey includes many general interest sites that are clearly not targeted to children. For example, the Sky & Telescope site (www.skypub.com), History Channel site (www.historychannel.com), Sporting News site (www.sportingnews.com), the Lucas film site (www.lucasarts.com), and the Sega games site (www.sega.com) are all included even though they obviously appeal to a general audience. The data obtained from these and other general audience sites say far more about CME's anomalous view of what constitutes a children's site, than the practices of operators who will be covered by the Commission's final rules.

Even assuming away the methodological problems with the CME study and the gulf between its conclusions and the experience of participants in the workshop, the study's results provide little or no guidance about the content of the Commission's rules. The survey was conducted nine months before COPPA's effective date and well before adoption of the Commission's final rules, when operators will know what the rules require.

III. the statute must BE INTERPEted flexibly to preserve children's access to information.

As our counsel demonstrated during session two of the workshop, opponents of e-mail consent completely ignore Congress' definition of the verifiable parental consent standard. Congress specifically defined the term "verifiable parental consent" as encompassing "any reasonable effort (taking into consideration available technology)" to ensure parental authorization. 15 U.S.C. § 6501(9) (emphases added). Moreover, e-mail consent is specifically contemplated by the statute's exception for collection of "online contact information" in order to secure parental consent. 15 U.S.C. § 6502 (b)(2)(B).

Furthermore, opponents' theory ignores the balance Congress intended between parental involvement, children's safety, and children's privacy on the one hand and protecting interactivity and access to information on the other. See, e.g., Comments of CME/CFA, et al., at 2-3. For example, CME/CFA argue that "children, parents and society bear an immeasurable cost every time an operator collects, uses, or discloses a child's information without parental involvement," id. at 28, a conclusion that cannot be squared with the statute's express provision for certain exceptions to consent that do not involve consent or opt-out. Embarking from this seriously incomplete and faulty theory of the purpose of COPPA, their entire argument repeatedly favors highly regulatory solutions (many of which have no basis in the statute) that would create serious barriers to maintaining free websites for children.

As the workshop demonstrated, free children's sites struggle to generate any sort of profit for businesses that operate them. Imposing costly consent requirements - or other requirements such as retroactive consent, extraordinarily detailed notices, or extensive monitoring of third party businesses to whom they disclose information - on these operators will reduce the availability of free children's sites on the Internet, and undermine the goals of the Act. While some proponents of extensive regulation refuse to consider this economically logical conclusion⁽¹⁾ and might even welcome this result, it would contravene the purposes of COPPA and disserve the interests of the children whom the Commission is working to protect.

1.  See Comments of CME/CFA at 28 n.35 (suggesting that making parental consent more difficult will be positive because it will encourage operators to offer free content for children without collecting any data).