A Private Sector Proposal to the FTC to Protect the Online Privacy of Children

The Federal Trade Commission has initiated a rulemaking proceeding to determine whether FTC should grant its seal of approval to a private company's "self-regulatory guidelines" to ensure compliance with the Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.).

The Act is designed to ensure that parents are afforded the opportunity to control the way websites collect and use information pertaining to website users who are children. PrivacyBot.com, a private company, is now seeking FTC approval of a service it has created to streamline website compliance with the new statutory requirements. PrivacyBot.com would, for websites which buy their service, provide the required notices and assist in dispute resolution. Detailed information about the FTC rulemaking may be obtained at www.ftc.gov/privacy.

CRE believes, as a general policy matter, that federal agencies such as the FTC should subject any self-regulatory mechanisms to the "good government" laws including Executive Order 12866 -- Regulatory Planning and Review, and the Regulatory Flexibility Act.

There are a number of aspects of the PrivacyBot.com proposal which should be reviewed from the consumer's viewpoint. Because consumers using subscribing websites would rely on PrivacyBot.com's service to obtain the privacy protections mandated by Congress, CRE believes that the FTC should address the following issues before approving this or any similar proposal:

• The "mediation" that would be offered by the service would not involve a human mediator, which raises the question of whether it is  "mediation" as the term is commonly understood. PrivacyBot.com would not actively mediate disputes between websites and users. Instead, the website and the user would communicate directly with each other through an electronic channel provided by PrivacyBot.com. Either party would have the absolute right to unilaterally "dismiss" the user's complaint. In practical terms, an aggrieved user would simply send an e-mail containing his or her complaint directly to the website and hope that the website would take action. A website would have the right, under the PrivacyBot.com service, to simply ignore the complaint.

• The self-regulatory service under consideration by the FTC, would "require" consumers to read through more than 30 pages of procedures, terms and conditions in order to fully understand their rights. Arguably this could place an undue burden on the average consumer (i.e., parent) who has a relatively straightforward complaint about a website's violation of a children's online privacy requirement.

• The service being considered by the FTC could lead consumers to believe that their rights are limited to the e-mail complaint procedure ("mediation") described above. There is a need for parents to easily understand that they have the right to take their complaints directly to the FTC.