Association of American Publishers, Inc.
November 30, 2001
To the Secretary:
Pursuant to the Notice of Proposed Rulemaking ("NPRM") published in the Federal Register on October 31, 2001 (66 Fed.Reg. 54963) (to be codified at 16 CFR Part 312), I submit these comments on behalf of the Association of American Publishers ("AAP") regarding the Federal Trade Commission's proposal to amend its Children's Online Privacy Protection Rule ("the Rule") to extend the time period during which website operators may use an e-mail message from the parent, coupled with additional steps, to obtain verifiable parental consent for the collection of personal information from children for internal use by the website operator.
As the principal national trade association of the U.S. book publishing industry, AAP represents more than 300 member companies and organizations that include most of the major commercial book publishers in the United States, as well as many small and non-profit publishers, university presses and scholarly societies. AAP members publish hardcover and paperback books in every field, including general fiction and non-fiction, poetry, religion, children's books, and general and specialized reference works. In addition, AAP members publish scientific, medical, technical, professional and scholarly books and journals, as well as textbooks and other instructional and testing materials covering the entire range of elementary, secondary, postsecondary and professional educational needs. Apart from print publications, many AAP members publish computer programs, databases, and other electronic software for use in online, CD-ROM and other digital formats.
AAP's interest in the above-referenced rulemaking is based on the fact that many of its members are operators of websites or online services that may be considered "operated for commercial purposes" and "directed to children," as these phrases are used in the definitional provisions of the Rule. These members -- including several of our nation's leading publishers of children's books and educational materials produced primarily for the elementary school level -- may consequently come within the coverage of the Rule, depending upon the nature of their information collection practices. AAP filed comments in the original rulemaking proceeding that produced the Rule.
Extending the "Sliding Scale" Mechanism for Verifiable Parental Consent
Like many other parties concerned about the practical difficulties of compliance with the "verifiable parental consent" requirements of the Children's Online Privacy Protection Act ("COPPA"), AAP welcomed the "sliding scale" mechanism which the Commission built into its implementing Rule as a reasonable compromise that balanced the implicated privacy considerations with the need of various kinds of website operators for reasonable compliance mechanisms.
To our knowledge, digital verification systems and so-called "infomediary" services are still not yet sufficiently extant in the marketplace to justify allowing this useful accommodation to expire, and thereby require website operators to rely on such services to deal with the burdens of compliance. As others will undoubtedly point out, the continuing reluctance of businesses and consumers to utilize digital signatures in a variety of commercial and non-commercial transactions, despite enactment of federal and state statutory regimes authorizing and legitimizing their use, attests to the soundness of the Commission's original decision to forego risky assumptions regarding the rapid evolutionary progress of these alternative mechanisms in the marketplace. Absent clear indication that these alternatives actually are becoming more widely available and affordable in the marketplace, the Commission's proposal to continue to employ the "sliding scale" mechanism for an additional two years is necessary and appropriate.
Online Educational Programs
However, even the availability of the "sliding scale" mechanism for obtaining verifiable parental consent cannot mitigate the serious adverse impact that the "verifiable parental consent" requirement itself has on the implementation of online educational programs. AAP brought this problem to the Commission's attention during the original rulemaking proceeding that produced the Rule, but our proposed solution to the problem - set forth below -- was not adopted at that time. Instead, as further discussed below, the Commission responded in its "Statement of Basis and Purpose" for the final version of the Rule with a "schools-as-intermediaries/agents" suggestion which, in the absence of promised further "guidance to the educational community," remains unclear as to its application to students' use of online education programs, including both in-school and out-of-school uses. In light of the Commission's present focus on the "verifiable parental consent" requirement in the pending NPRM, AAP respectfully takes this opportunity to reiterate its concerns and seek Commission assistance regarding the Rule's application to online educational programs.
AAP understands and supports the basic function of COPPA and its implementing Rule to protect children against commercial exploitation on the Internet in connection with their disclosure of personal information. Both, however, limit the collection, use, and disclosure of personal information for both commercial and non-commercial activities, including non-exploitive online educational programs. We continue to believe that the "verifiable parent consent" requirement, as implemented in the Rule, has the practical effect of unduly restricting children's access to, and schools' use of, valuable online educational resources, even in circumstances where none of the hazards targeted by COPPA are present. This is unnecessary and unacceptable, given the growing importance of the Internet as an educational medium and the huge investments to promote technology in education that are currently being made both by government and by a variety of non-profit and commercial enterprises. Application of the Rule to a wide range of "distance education" programs needlessly imposes restrictions that could stifle the growth of these and other online educational opportunities to the detriment of individual students and society as a whole.
Computers and the Internet already play a significant role in education, and their influence is growing exponentially. Educational websites and online services, operated by nonprofit or commercial entities, as well as through collaborations between such entities, offer a wealth of quality resources and activities that support or enhance classroom instruction. With use of the Internet as an educational medium continuing to grow, AAP anticipates extensive continued expansion of online educational program offerings that will not only allow children to read or download information but will also allow them to engage in a range of interactive tasks, such as review exercises, learning games, homework activities and tests. These programs may relate directly to a child's work in school, or they may be supplemental, for independent study and enrichment.
The inherent interactivity of these online educational programs will often require that participants identify themselves and give responses, such as providing solutions to problems or answers to academic questions. Some online educational programs may involve recording and reporting grades and test results to teachers and school officials, as in instances where assessments and evaluations -- that in the past were administered using paper and pencil in a classroom -- are now or in the future administered online. All of these responses and data appear to fall within the Rule's definition of "personal information" and thus would be governed by the Rule, even if that personal information is not used for advertising, selling or otherwise marketing to children, and even when the information is being collected for state or school-mandated education programs or purposes.
COPPA and its implementing Rule contain an exemption for certain nonprofit organizations, but that exemption does not solve the problem of COPPA's requirements otherwise restricting access to online educational programs. The leading providers of instructional content to schools in the United States, however, are not nonprofit organizations -- rather, they are the commercial enterprises that create and publish textbooks, educational software, and other instructional materials. These commercial operators of websites and online services are making enormous investments in developing online learning resources, and they will undoubtedly remain among the leading providers of instructional content as the Internet's role in education continues to grow.
Requiring verifiable parental consent as a prerequisite to participation in online educational activities discourages children's spontaneous participation in such programs, whether at school (during or after normal classroom hours) or in a library or at home. Clearly, such a requirement greatly complicates even the planned use of online educational programs in schools, where the failure of even a single child to obtain parental consent may compromise or even preclude the use of an online program as a classroom or school-wide activity.
As a practical matter, the "verifiable parental consent" requirement can entirely prevent many children from accessing online educational programs. This is particularly unfortunate because the financial and technological resources that are needed to access such online programs are not universally available; indeed, for large portions of our nation's population, a child's only feasible access and introduction to computers and the Internet is in a classroom, library or other institutional environment. Unless these proliferating online educational resources are otherwise made available to children who do not have a computer and Internet access at home and/or whose parents (for whatever reason) cannot or will not respond to a verifiable consent request, a large portion of our nation's children will be cut off from developing essential computer skills and accessing the same educational resources and opportunities that are available to their more advantaged peers. (For example, not all parents have a driver's license, credit card or bank account, much less a home computer and e-mail capability.)
In order to meet COPPA's basic objective, while avoiding the unintended consequence of denying children access to valuable educational resources that are available via the Internet, AAP believes the Rule should expressly exempt online educational programs from its verifiable parental consent and other regulatory requirements, provided that the exemption facilitates implementation of COPPA's basic goal of protecting children from exploitation in connection with their personal information that is collected online.
Accordingly, during the Commission's original COPPA rulemaking proceeding, AAP proposed the addition of the following provisions to the Rule:
Unfortunately, the Commission did not adopt AAP's proposal, explaining in its "Statement of Basis and Purpose" accompanying the promulgation of the final Rule that it "does not have discretion under the statute to waive the requirement of verifiable parental consent." See "Children's Online Privacy Protection Rule," 64 Fed.Reg. 59888, 59909 (daily ed. Nov. 3, 1999). At the same time, however, the Commission responded to the request for an exception for information collection in the educational setting by stating the following:
Id. at 59903.
Although the Commission's response concluded with a statement of its intention to provide further "guidance to the educational community" regarding the Rule's privacy protections, AAP (despite multiple meetings and contacts with Commission staff regarding such guidance) is not aware of any further specific guidance addressing the "schools-as-intermediaries/agents" role having subsequently been issued by the Commission. Thus, exactly how schools are expected to perform the function of "intermediary" or "agent" remains unclear, as does the precise scope and nature of the authorization that the performance of that function bestows on covered website operators.
In particular, it remains unclear whether the "school-as-intermediary/agent" addresses the "verifiable parental consent" problem with respect to children's participation in online educational programs both during class time and outside of school - including situations where, in the absence of online access or a computer at home, such participation will occur at public libraries or community centers that make such services and equipment available to children. The same is true when - regardless of where the children are when they access such online educational programs - they prefer that their parents not know about or be involved in the activity. This may occur, for example, when children seeking remedial assistance with particular school subjects do not want their parents to know about their academic difficulties; it can also occur where children pursue knowledge about subjects which, for personal reasons, they prefer not to discuss with their parents.
Moreover, although many of the activities available to children through today's online educational programs may not require the online collection of personal information in connection with their participation, the rapid development of more sophisticated online educational programs - with, for example, diagnostic capabilities to facilitate the customization of remedial and other learning opportunities, or the interactivity required to administer and score a variety of standardized tests - is quickly changing this situation. Contracts between educational publishers and state education agencies, whether for textbooks and other curriculum materials or for the administration and evaluation of tests and other assessments, continue to provide evidence of this trend as they increasingly involve online requirements.
In our discussions with Commission staff regarding the provision of further "guidance" following promulgation of the Rule, AAP worked with others in the educational field to identify specific scenarios involving a student's participation in online educational programs or activities where our concerns might be addressed by recognizing the need to ensure that application of the Rule does not conflict with the long-standing mandate against federal interference with local curricular decisions that is codified in the Department of Education Organization Act. See 20 U.S.C. Sec. 3403(b).
Any guidance addressing these scenarios, as listed below, would emphasize their limitation to programs or activities that are part of an approved system of curricular instruction or assessment, as defined by the laws, regulations or policies governing the related school. It would also emphasize the condition that any personal information collected from students by the operator of the related website could only be used in connection with the operation of the online education program or activity, and could not be used for advertising or selling products or services. In addition, it would make clear that the operator must comply with the Rule's Section 312.8 and 312.4(b) requirements regarding, respectively, (1) the establishment and maintenance of reasonable procedures to protect the confidentiality, security and integrity of personal information collected from children, and (2) posting and linking to website notices regarding the operator's policies for collecting, using and/or disclosing such information.
The scenarios under discussion included the following:
AAP recognizes that the Rule's application to online educational programs was not specifically raised by the Commission within the relatively narrow scope of the pending NPRM. However, insofar as the pending NPRM focuses on an element of the Rule which was designed to creatively mitigate certain practical problems in implementing COPPA's rigorous "verifiable parental consent" requirement, we considered it appropriate to use this opportunity to ask for the Commission's help to creatively mitigate the practical problems that this requirement poses for implementation of online educational programs.
AAP looks forward to assisting the Commission in whatever way it can to satisfactorily maintain satisfactory continued implementation of COPPA without jeopardizing the opportunities for children to fully benefit from participation in online educational programs.