|Thomas A. Marino
United States Attorney
Assistant United States Attorney/Lead
IN THE UNITED STATES DISTRICT COURT
Plaintiff, the United States of America, acting upon notification and authorization to the Attorney General by the Federal Trade Commission ("FTC" or "Commission"), for its Complaint alleges that:
1. Plaintiff brings this action under Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 ("COPPA"), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act ("FTC Act"), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a), to obtain monetary civil penalties, a permanent injunction, and other equitable relief for defendant's violations of the Commission's Children's Online Privacy Protection Rule (the "Rule"), 16 C.F.R. Part 312.
JURISDICTION AND VENUE
2. This Court has jurisdiction over this matter under 28 U.S.C. §§ 1331, 1337(a), 1345, and 1355, and under 15 U.S.C. §§ 45(m)(1)(A), 53(b) and 56(a). This action arises under 15 U.S.C. §§ 45(a)(1) and 6502(c).
3. Venue in this District is proper under 15 U.S.C. § 53(b) and 28 U.S.C. §§ 1391(b)-(c) and 1395(a).
4. For purposes of this Complaint, the terms "child," "collects," "collection," "Commission," "delete," "disclosure," "Internet," "online contact information," "operator," "parent," "person," "personal information," "third party," "verifiable consent," and "website or online service directed to children," are defined as those terms are defined in Section 312.2 of the Rule, 16 C.F.R. § 312.2.
THE CHILDREN'S ONLINE PRIVACY PROTECTION RULE
5. Congress enacted the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501-6506, in 1998 to protect the safety and privacy of children online by prohibiting the unauthorized or unnecessary collection of children's personal information online by Internet websites and online services. The Act directed the Federal Trade Commission to promulgate a rule implementing COPPA. The Commission promulgated the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312, on November 3, 1999 under Section 1303(b) of COPPA, 15 U.S.C. § 6502(b), and Section 553 of the Administrative Procedures Act, 5 U.S.C. § 553. The Rule went into effect on April 21, 2000.
6. The Rule applies to any operator of a commercial website or online service directed to children that collects, uses, and/or discloses personal information from children, or to any operator that has actual knowledge that it is collecting or maintaining a child's personal information.
7. The Rule requires a subject website operator to meet specific requirements prior to collecting online, using, or disclosing personal information from children, including but not limited to:
8. Pursuant to Section 18(d)(3) of the FTC Act, 15 U.S.C. § 57a(d)(3), a violation of the Rule constitutes an unfair or deceptive act or practice, in violation of Section 5(a)(1) of the FTC Act, 15 U.S.C. § 45(a)(1). See also COPPA, 15 U.S.C. § 6502(c).
9. Defendant Hershey Foods Corporation is a Delaware corporation with its principal office or place of business located at 100 Crystal A Drive, Hershey, Pennsylvania, 17033.
10. Defendant markets its chocolate and non-chocolate confectionery, and chocolate-related grocery products throughout the Unites States, including through the Internet. Since at least April 21, 2000, defendant has been the operator of www.hersheys.com, a website on the Internet, portions of which are directed to children. Defendant also has operated numerous other websites featuring its individual name-brand candies or other candy-related themes. Some of these websites knowingly collect personal information from children.
11. The acts and practices of defendant alleged in this Complaint have been in or affecting commerce, as "commerce" is defined in Section 4 of the FTC Act, 15 U.S.C. § 44.
DEFENDANT'S COURSE OF CONDUCT
12. Defendant operates the www.hersheys.com website and over thirty other websites dedicated to particular brand name candies or to other marketing opportunities for its candies. The www.hersheys.com website includes a "Kidztown" area directed to children. The subject matter, visual content, and language of Kidztown are targeted to children under the age of 13. For example, Kidztown features cartoon characters in the shape of candies introducing the various children's activities. Kidztown's "Fun & Games" section includes mazes, hidden words, simple crossword puzzles and coloring activities. Kidztown also includes a section titled "Candy of the Month." (See Exhibit A.)
13. Defendant collects or has collected personal information from children through the operation of the Kidztown portion of its website. In addition, defendant operates other websites, such as www.paydaybar.com and www.reesefastbreak.com, through which it has collected personal information from its visitors. Many of these websites are targeted to children under the age of 13; others are general audience websites where the defendant had actual knowledge that the visitors giving their personal information were under the age of 13. Defendant is, therefore, an "operator" as defined in the Rule.
Defendant's Information Collection, Use and Disclosure Practices
14. Children who visited the "Candy of the Month" section of the Kidztown area were invited to register for a sweepstakes to win a free box of candy. (See Exhibit B.) The registration page included a hyperlink inviting individuals over the age of 13 to register. The registration page informed children 13 years of age or under that they must get the consent of a parent or guardian before entering the sweepstakes, and included a "Parental Consent" form. (See Exhibit C.) The parental consent form asked for the parent's name, the child's name and their full home address. At the bottom of the form, there was a box labeled "Click here to consent." Clicking on this box automatically brought up the registration form for the sweepstakes. (See Exhibit D.) This registration form asked for additional personal information, including name, home address, email address, gender and age range. This method of obtaining parental consent was not reasonably calculated to ensure that the person providing consent was the child's parent. Moreover, even if no information was submitted in the parental consent form, and a child filled in the registration form indicating that he/she was under the age of 13, the entry form was accepted by defendant.
15. At the bottom of the online parental consent form described above, defendant allowed parents to withdraw their consent at any time by clicking on a hyperlink. Because the use of this form was not reasonably calculated to ensure that the person providing consent was the child's parent, however, defendant did not provide a reasonable means for parents to review or delete the information collected from their children.
16. In addition to the sweepstakes on the Kidztown area of www.hersheys.com, defendant offered similar sweepstakes on some of its other websites. For visitors under the age of 13, defendant's methods for obtaining parental consent were substantially similar to those described above. Some of the parental consent forms asked for additional personal information, such as the parent's email address and the child's email address and telephone number. Because defendant asked whether visitors wishing to enter the sweepstakes were under the age of 13 during the registration process, it had actual knowledge that some of the personal information it was collecting was from children. Defendant's method for obtaining prior parental consent for the collection of this information was not reasonably calculated to ensure that the person providing consent was the child's parent. Moreover, even if no information was submitted in the parental consent form, and a child filled in the registration form indicating that he/she was under the age of 13, the entry form was accepted by defendant.
17. In this manner, defendant collected personal information from thousands of children, including the child's first and last name, street address, email address, gender, approximate age, and, in some cases, the telephone number. According to defendant's website, this information was to be used to send winners of the sweepstakes a box of candy.
18. At times, defendant disclosed the personal information it collected from children by posting the first and last names and home states of the sweepstakes' winners on the Internet. This personal information was disclosed without obtaining verifiable parental consent.
VIOLATIONS OF THE
20. Since at least April 21, 2000, defendant has been an operator of a website directed to children and/or has had actual knowledge that it has collected or maintained personal information from children.
21. In numerous instances, including the acts and practices described above, defendant has collected personal information from children in violation of the Rule, including:
OR DECEPTIVE ACTS OR PRACTICES
22. Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), provides that "unfair or deceptive acts or practices in or affecting commerce are hereby declared unlawful."
23. Pursuant to Section 18(d)(3) of the FTC Act, 15 U.S.C. § 57a(d)(3), a violation of the Rule constitutes an unfair or deceptive act or practice in violation of Section 5(a)(1) of the FTC Act, 15 U.S.C. § 45(a)(1). See COPPA, 15 U.S.C. § 6502(c).
24. By and through the acts and practices described in Paragraph 21 above, defendant has violated Section 5(a)(1) of the FTC Act, 15 U.S.C. § 45(a)(1).
CIVIL PENALTIES, INJUNCTION AND OTHER RELIEF
25. Defendant has violated the Rule as described above with knowledge as set forth in Section 5(m)(1)(A) of the FTC Act, 15 U.S.C. § 45(m)(1)(A).
26. Each collection, use, or disclosure of a child's personal information from April 21, 2000 through the filing of this Complaint, in which defendant has violated the Rule in one or more of the ways described above, constitutes a separate violation for which plaintiff seeks monetary civil penalties.
27. Section 5(m)(1)(A) of the FTC Act, 15 U.S.C. § 45(m)(1)(A), as modified by Section 4 of the Federal Civil Penalties Inflation Adjustment Act of 1990, 28 U.S.C. § 2461, and Section 1.98(d) of the FTC's Rules of Practice, 16 C.F.R. § 1.98(d), authorizes this Court to award monetary civil penalties of not more than $11,000 for each such violation of the Rule.
28. Under Section 13(b) of the FTC Act, 15 U.S.C. § 53(b), this Court is authorized to issue a permanent injunction against defendant's violation of the FTC Act, as well as such ancillary relief as may be just and proper.
WHEREFORE, plaintiff requests this Court, pursuant to 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b) and 57b, and the Court's own equitable powers to: