On December 5, 2007, Texas Attorney General Greg Abbott filed two enforcement actions under the Children’s Online Privacy Protection Act of 1998 (“COPPA”) against two websites that target children, but failed to adequately protect their safety and privacy. The defendants, one based in New York and the other based in California, became the first targets of such an action as Texas became the first state to enforce COPPA, a federal law designed to regulate strictly the collection, use and protection of personal information from children under the age of 13, and to assure parental consent to any such collection. Until now, the Federal Trade Commission (“FTC”) has been the enforcer of COPPA, bringing many actions against such household names as Hershey’s, Mrs. Field’s and the Ohio Art Company (Etch- A-Sketch). Social networking sites are among the current FTC targets.
One Texas Defendant, California-based Gamesradar.com, has registered Texas residents as users and operates a website targeting those who have an interest in video games on nearly any platform or game system. It includes information about games that are clearly targeted to children (namely, Disney’s Chicken Little, Ice Age and Cars). To access this site, users complete a free registration that requires the disclosure of the following personal information: first and last name, email address, physical address, gender and date of birth. The site states that it does not “request or knowingly collect personally identifiable online or offline contact information from users under 13 years of age.” Furthermore, the Texas Attorney General alleges that the site encourages users under age 13 to lie about their age by providing a dropdown menu for birth year that only includes the years 1994 and before. The website also permitted a 12-year old with a birth date of December 31, 1994 to register prior to his or her 13th birthday. The complaint against Gamesradar.com alleges that the defendant is aware that the content attracts children under the age of 13 and knowingly collects personal information from such children, but instead stuck “its head in the sand in order to avoid complying with COPPA.”
The other, New York-based defendant, TheDollPalace.com, operates a website dedicated to the “art of making cartoon dolls” and permits users to create and play with web-based dolls. A number of its registered users are residents of Texas. To access the basic features of the site and chat with other users, users register with the site by providing personal information such as first and last name, email address and date of birth. To use the “friends” section, which permits users to search for other users, the site asks users, including children under the age of 13, to complete a 10-page questionnaire. The questionnaire asks children for detailed personal information (height, weight, body type, etc.), information about personal habits and what type of person they would be interested in meeting with an option that included the following: “I would like to meet someone older than myself.” TheDollPalace.com questionnaire also asks users about “sexual issues” and where they are located.
Although TheDollPalace.com recognized it must obtain parental consent before collecting personal information from children under 13, the Texas Attorney General asserts that the website’s mechanism for obtaining such consent was deficient and easily circumvented. During the registration process, if a user indicates that he or she is under the age of 13, the website presents the user with the following message: “You need a parent’s permission to continue. Is a parent with you right now?” If the user chooses “Yes,” he or she is then directed to a page that seeks the parent’s permission by merely requiring the click of “OK” to complete the registration. The “permission” page fails to disclose the information to be collected from the child and contact information for TheDollPalace.com. Furthermore, the site does not permit a parent to later review or revoke his or her consent. A similar process is used if the child selects “No” except that the permission page was emailed to the parent’s email address, which is provided by the user.
In both cases, the Texas Attorney General is seeking an injunction against the defendants along with damage, restitution or other compensation on behalf of the residents of Texas pursuant to 15 U.S.C. § 6504.
COPPA requires children’s sites or general audience sites that knowingly collect personal information from children under the age of 13 to disclose their information practices in a privacy statement and to obtain verifiable parental consent before collecting information from children. To comply with COPPA, operators of such websites must (1) give parents or legal guardians of children under age 13 notice of their information practices; (2) with certain limited exceptions, obtain prior “verifiable parental consent” for the collection, use and/or disclosure of personal information; (3) upon request, provide a parent with an opportunity to review the personal information collected from his or her child; (4) give the parent the option to prevent the further use of personal information that has already been collected from such child; (5) limit the collection of personal information to a certain designated activity, such as a game or prize offer; and (6) establish and maintain reasonable procedures to protect the confidentiality, security and integrity of the personal information collected on the website.
The FTC has offered several methods for website operators to obtain verifiable parental consent. For example, the FTC has suggested that child-oriented websites maintain a toll-free telephone number staffed by trained personnel who answer calls from parents giving consent or provide a printable form for a parent to complete, sign and mail or fax back to the website operator.
As evidenced by the actions initiated by the Texas Attorney General, any website operator located in any state could be subject to such an action if the website targets children under age 13 and collects personal information from such users without verifiable parental consent. The defendants in the Texas action were obviously aware of COPPA and attempted to comply, but may be found liable for failure to fully comply with COPPA if the Texas Attorney General prevails.