The Texas attorney general has announced that it has filed enforcement actions against two web sites that appeal to children. This is the first reported action by a state to enforce the federal Children’s Online Privacy Protection Act which prohibits the collection of personal information from children under 13 without parental consent and requires web sites to provide notice of their information collection practices.

The Attorney General filed complaints against TheDollPalace.com and GamesRadar.com. GamesRadar.com provides information, contests and demonstrations relating to popular video games, including games that might appeal to children under 13 such as Disney’s Chicken Little, Ice Age 2, and Cars (these are video games based on the animated movies of the same name). The site also provides chat rooms and information about video games targeted to older children and adults, including games that are violent or have sexual content. In order to access the site, a user must register and provide his or her name, postal address, email address, gender and date of birth. To enter the year of birth, a user clicks on a drop down menu, but the menu only provides years that correspond to someone aged 13 or older. This means that if a child tries to register and clicks on the date of birth drop down menu, he or she cannot select a year of birth that would make the user younger than 13. The Attorney General argued that this feature encourages children to lie about their age so they can register for the site. The Attorney General also claimed that the site fails to obtain verifiable parental consent, fails to provide parents with notice of its information collection practices, and fails to adequately disclose its information collection practices in its privacy policy.

TheDollPalace.com allows users to create and play with animated dolls on the web site. The site also offers chat rooms and a "friends" feature that lets users contact friends that like the same dolls. To register for the site, a user must provide his or her name, age, gender, email address, city, and zip code. To register for the "friends" feature, a user must also complete a profile that asks for personal information such as height, weight, eye color, and whether the user accesses the Internet on his or her own computer or uses a public computer. If a child under 13 registers, the web site asks "Is a parent with you right now?" If the child answers "Yes," he or she is directed to a "permission" page that requires him or her to click "OK" to complete the registration. If a child answers "No," the child must provide an email address for a parent, and is then allowed to complete the registration. The email address can be the same address the child entered as his or her own address. The Attorney General claimed that the site violates COPPA because its parental consent mechanism is not adequate to provide verifiable consent and because the site does not disclose its information collection practices or provide parents with an opportunity to review or revoke their consent.

While the Federal Trade Commission has brought numerous enforcement actions for COPPA violations, these two enforcement actions are a reminder that state Attorneys General can and do also enforce COPPA. Thus, web site operators that operate web sites directed to, or likely to attract, children under 13 should ensure that their sites are COPPA compliant. For information regarding COPPA, you can find the FTC's guidelines here. In addition, web site operators should review the guidelines promulgated by the Children’s Advertising Review Unit (CARU) of the Better Business Bureau (located here) as CARU actively monitors children’s web sites to ensure COPPA compliance.