Web Site Targeting Girls Settles FTC Privacy Charges

Lisa Frank, Inc., manufacturer of popular girls’ toys and school supplies, and operator of a Web site featuring those products, will pay $30,000 in civil penalties to settle Federal Trade Commission charges that it violated the Children’s Online Privacy Protection Rule (COPPA Rule) and the FTC Act. The settlement also bars the company from certain future violations of the law. This is the fourth law enforcement action the FTC has taken to enforce the COPPA Rule since it became effective in April, 2000.

The COPPA Rule applies to operators of commercial Web sites and online services directed to children under the age of 13, and to general audience Web sites and online services that knowingly collect personal information from children. Among other things, the Rule requires that Web sites get verifiable consent from a parent or guardian before they collect personal information from children.

This case was brought to the FTC’s attention by the Children’s Advertising Review Unit (CARU) of the Council of Better Business Bureaus. CARU evaluated the Lisa Frank Web site in late 2000, after the COPPA Rule became effective. According to CARU’s press release announcing referral of the matter to the FTC, Lisa Frank, Inc. committed serious violations of the COPPA Rule and, despite CARU’s urging, failed to make the changes needed to bring the Lisa Frank Web site into compliance with the Rule.

In its complaint, the FTC alleges that the Lisa Frank Web site, www.lisafrank.com, is directed to children, as that term is defined by the Rule. It further alleges that between April 21 and January 2001, lisafrank.com asked girls to register before they accessed many areas of the site, including the "club" and "shop" areas. The registration form asked girls for their first and last names, street addresses, phone numbers, e-mail addresses and birth dates, as well as their favorite color and season. Although directed to children, the site did not obtain consent from parents before collecting this information as required by the Rule, according to the complaint. The complaint further alleges that, in violation of the Rule, Lisa Frank did not provide direct notice to parents about the company’s privacy practices and did not inform parents that the company wanted to collect information from their children and that prior parental consent was required. Additionally, according to the complaint, the company failed to include in its Web site privacy policy required notices that an operator is prohibited from conditioning a child’s participation in an activity on the child’s disclosing more personal information than is reasonably necessary to participate in such activity and that parents have the right to review and have deleted their child’s personal information. Finally, the complaint alleges that the company violated the FTC Act’s prohibition on deceptive practices because lisafrank.com’s privacy policy falsely claimed that the site required parental consent for children 13 and younger and that parents would be required to fill in a registration form agreeing to the collection practices.

Settlement of the FTC charges permanently bars Lisa Frank, Inc. from future violations of the COPPA Rule; enjoins it, in connection with the operation of any Web site or other online service, from failing to comply with certain representations about children’s privacy; and requires that if the company operates a child-directed site in the future, it place a hyperlink to the FTC ’s website pages about the COPPA Rule within that site’s privacy policy and on notices to parents about collection of information from children. Finally, the company will pay a civil penalty of $30,000.

The Commission vote to approve the complaint and consent settlement was 5-0.

The proposed consent decree was filed on October 1, 2001 by the Department of Justice at the request of the FTC. It is subject to court approval.

NOTE: This consent decree is for settlement purposes only and does not constitute an admission by the defendant of a law violation. Consent decrees have the force of law when signed by the judge.

Copies of the complaint and consent settlement are available from the FTC’s web site at http://www.ftc.gov and also from the FTC’s Consumer Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580. For further information about the COPPA Rule, see http://www.ftc.gov/kidzprivacy . The FTC works for the consumer to prevent fraudulent, deceptive and unfair business practices in the marketplace and to provide information to help consumers spot, stop and avoid them. To file a complaint, or to get free information on any of 150 consumer topics, call toll-free, 1-877-FTC-HELP (1-877-382-4357), or use the complaint form at http://www.ftc.gov . The FTC enters Internet, telemarketing, identity theft and other fraud-related complaints into Consumer Sentinel, a secure, online database available to hundreds of civil and criminal law enforcement agencies in the U.S. and abroad.

(FTC File No. 012-3050)
(Civil Action No. 01-1516-A)