Rimon Law Blog

Originally posted on: The Internet Law Advisor Blog

Background: The Children’s Online Privacy Protection Act of 1998 (COPPA) with its implementing regulations, the Children’s Online Privacy Protection Rule (COPPA Rule) (in effect since April 21, 2000), have served as the primary law in the U.S. for protecting personal information about children online. It’s a gross understatement to state that the Internet is a different world than what it was when COPPA and the COPPA Rule were implemented. Suffice it to say that the world of social networks combined with mobile computing has, for better or for worse, become the fabric of our children’s world – and in 1998 social networks were not even in Congress’s imagination. The Federal Trade Commission (FTC), charged with enforcement of COPPA has scheduled a COPPA Rule Review Roundtable on June 2, 2010 and is collecting comments through June with the objective of seeing whether changes to the COPPA Rule should be considered. On April 29th, Senate Commerce Chairman John (Jay) Rockefeller, D-W.Va., said that Congress may also need to consider making changes to COPPA itself. So, it’s a good time to review what COPPA requires and what might be changed.

First – A Word of Caution: COPPA enforcement is alive and well. Late last year Iconix Brand Group, Inc. agreed to pay a $250,000 civil penalty to settle FTC charges that Iconix violated COPPA by knowingly collecting, using, or disclosing personal information from children online without first obtaining their parents’ permission. The FTC order also contains standard compliance, reporting, and record-keeping provisions to help ensure that Iconix abides by its terms. Often the internal costs of complying with FTC ordered monitoring and reporting obligations can exceed the amount of the fine. Nobody wants to be caught in the FTC’s cross hairs.

Summary of COPPA:

The COPPA Rule has broader coverage than commonly thought. It applies to: (1) websites directed to children under 13 that collect personal information from children; (2) general audience websites that knowingly collect personal information from children under 13; and (3) general audience websites that have a separate children’s area and that collect personal information from children. It is important to emphasize that COPPA only applies to children under 13. No protection is extended to children 13 and above. Whether this age cut off leaves many vulnerable children still vulnerable can be debated, but does not seem to be seriously on the table for reconsideration.

Covered websites are required to: (1) post a privacy policy on the homepage of the website and link to the privacy policy everywhere personal information is collected; (2) provide notice to parents about the website’s information collection practices and, with some exceptions, get verifiable parental consent before collecting personal information from children; (3) give parents the choice to consent to the collection and use of a child’s personal information for internal use by the website, and give them the chance to choose not to have that personal information disclosed to third parties; (4) provide parents with access to their child’s information, and the opportunity to delete the information and opt out of the future collection or use of the information; (5) not condition a child’s participation in an activity on the disclosure of more personal information than is reasonably necessary for the activity; and (6) maintain the confidentiality, security and integrity of the personal information collected from children.

The most challenging parts of the COPPA Rule to comply with are the requirement to get parental consent before collecting a children’s information and the procedures for allowing a parent to review the child’s personal information, have it deleted, and refuse to allow the further collection or use of the child’s information. Privacy policies and the entire operation of covered websites must be carefully reviewed for compliance with the COPPA Rule.

For instance, how is parental consent verified? Under a 2005 Amendment to the COPPA Rule, a sliding scale mechanism was confirmed so that lower risk usage of information is subject to a lower level verification process and higher risk usage is subject to a higher level of verification. If a website collects information for its own internal use (i.e., lower risk level), then an email message to the parent, combined with additional verification steps (such as sending a delayed confirmatory email message to the parent after the original consent is received, or confirming consent via the telephone or standard mail) will be sufficient. However, where information will be disclosed to the public or to a third party (i.e., higher risk level), then higher levels of initial verification are required, such as confirmation via a signed consent form returned to the website operator, requiring the parent to use a credit card during the confirmation process, requiring the parent to call a toll-free number, among other methods listed in the Amendment.

The COPPA Rule also provides that a website’s compliance with FTC-approved self-regulatory guidelines serves as a safe harbor in any enforcement action for violations of the COPPA Rule. Several organizations have been approved by the FTC for verifying compliance to qualify for the safe harbor.

What Changes Will Likely Be Considered?: The primary issues that will be considered will involve the impact of social networks, mobile computing, interactive television and interactive gaming on the collection of personal information from children. Additionally, the “below 13” threshold might also be reconsidered in light of state law changes (like in Maine – which however subsequently repealed their new privacy law).

The whole process for verifying age is also one that might be considered. Today the primary method is by asking the user to put in a birth date. However, it does not take much sophistication for a child to realize the purpose of this data field and insert a date indicating that they are at least 13. For instance, Facebook does not allow members less than 13 years of age. However, don’t most kids know this and know how to get around it? Facebook’s Director of Public Policy, Tim Sparapani acknowledges that it is currently impossible to verify someone’s age online, but claims that Facebook has safeguards in place aimed to block children under 13 from joining. He also does not believe that Congress should get involved by amending COPPA – because this would “discourage innovative ideas aimed at enhancing teen and children safety” and might actually “undue many of our innovative privacy and safety tools.” Hmmm – probably not a disinterested perspective I would say!

Other items that might be considered:

* Use of automated systems that filter out personally identifiable information prior to posting for children’s website submissions.
* Whether the COPPA Rule’s definition of “personal information” should be expanded to include items such as persistent IP addresses, mobile geolocation data, or information collected in connection with behavioral advertising.
* Whether the COPPA Rule’s process for FTC approval of self-regulatory guidelines – known as safe harbor programs – has enhanced compliance, and whether the criteria for FTC approval and oversight of the guidelines should be modified in any way.

Bottomline: Websites that are subject to COPPA should be thoroughly reviewed prior to launch. Additionally, since changes to these websites may occur frequently, periodic reviews should be performed as well to verify ongoing compliance.

Summary: The Federal Trade Commission (FTC) has issued revised Guides Concerning the Use of Endorsements and Testimonials in Advertising(Guides) which will take effect on December 1, 2009. The main purposes of the revisions are (1) to update the application of the Guides to new media and (2) to rescind a safe harbor that previously allowed ads stating positive results experienced by consumers, even though such results could not necessarily be expected by the average consumer, provided the statement “Results not typical” was included in the ad. Now the actual typical results need to be stated in the ad.

While the Guides only represent the FTC’s interpretation of the law and are not binding, the Guides are not difficult to comply with – and I guaranty that you don’t want to be on the receiving end of an FTC action.

Purpose: The primary purpose of the Guides is to require disclosure when an person giving an endorsement for a product or service is in some manner being compensated by the advertiser for the endorsement. In other words, it is deceptive for a paid endorsement to appear as if it is an independent and objective opinion. For example, if a mother-consumer is paid $1,000 for saying that she prefers a certain diaper, the viewing public needs to know this fact.

New Media Changes the Game: Since 1980, when the FTC first issued the Guides, communication broadcasting has, of course, dramatically changed with the advent of the Internet. Now, everyone can broadcast their opinion to the world through personal websites, blogs, discussion forums, social networks, and by means not yet contemplated (until announced in the next month or so). These various Internet communication forms shall be referred to in this article as “New Media Forms.” The Guides have been revised to address New Media Forms, because the there are now many types of communications that are really ads, but don’t necessarily appear to be ads.

Endorsements: Since the Guides deal with endorsements, the first step is to determine whether an opinion or review is an endorsement. According to the Guides, “an endorsement isany advertising message (including verbal statements, demonstrations, or depictions of the name, signature, likeness or other identifying personal characteristics of an individual or the name or seal of an organization) that consumers are likely to believe reflects the opinions, beliefs, findings, or experiences of a party other than the sponsoring advertiser.” Following are some examples in the Guides which will clarify this issue. (I have modified these examples somewhat and added my own commentary for clarification):

Example: A tennis star writes on her Facebook page about laser surgery she received from XYZ clinic. She states that the surgery helped her game, and she is compensated by XYZ clinic for making such statements. This needs to be disclosed, because in the context of a Facebook page, the public will not assume that this is a paid endorsement.

Example: A college student has a popular blog where he reviews video games. A video game manufacturer provides him with a free game system to review. He needs to disclose that the game system was provided to him for free, because this is the type of compensation that could influence his review. On the other hand, David Pogue who reviews technology gadgets for The New York Times would not have to reveal that he receives products for free (if in fact this is the case), because the public would assume that this is the case in the context of being an employee of the newspaper.

Example: A woman who has a personal blog receives a free sample of dog food in the mail because the local store recognizes that she regularly shops there. When she reviews this dog food on her blog she does not have to disclose that she received the food for free, because the store did not send it to her for this purpose and there is no expectation on her part to receive continued free samples.

Example: In a discussion forum on music download technology, one of the participants is an employee of a company that has such products and the employee has been promoting these products in the forum. The employee would need to disclose this fact, otherwise his posts would be deceptive, because they would appear to be independent objective opinions.

Veracity of Endorsements: Believe it or not – the opinion stated in an endorsement has to be true in all respects. Itmust reflect the honest opinions, findings, beliefs, or experience of the endorser. Furthermore, the endorsement of an expert or celebrity may be used only so long as the advertiser has good reason to believe that the endorser continues to maintain the view presented. Therefore, there must be some periodic effort by the advertiser to verify that the endorser’s views have not changed. When you hear on the radio or see an ad where a celebrity claims to use a particular product. Have you ever wondered whether she or he really does? Well, the Guides say that they must actually use the product at the time of the endorsement and the endorsement can continue to run only as long as the advertiser does not have any reason to question whether the product is still being used. In the online environment, when endorsements are being made in multiple venues, and are often being made independent of ongoing advertiser supervision, and may be transmitted and archived on sites for long periods, the advertiser must implement some system to verify that the endorsement is still valid.

Advertiser Responsibility. It’s important to note that advertisers are responsible (read: liable) for false or unsubstantiated statements made through endorsements – even if these statements were not advised or encouraged by the advertiser. For example, a skin care manufacturer, through its marketing agent, distributes free samples to bloggers known to review such products. A blogger makes a claim (e.g., the product cures eczema) that the advertiser does not make about the product. If this claim is not true, then the advertiser, as well as the blogger, would be responsible for this false claim.

Important: According to the Guides, the advertiser must actually ensure that its bloggers and other New Media Form hosts are notified and trained so as to be able to comply with the truthfulness, substantiation and disclosure requirements set forth in the Guides. If the advertiser identifies violations in the endorsements, the advertiser must take action to correct the violations. This is a fairly high standard of responsibility placed on advertisers.

Goodbye to “Typical Results” Safe Harbor: If the advertiser does not have substantiation that the endorser’s experience is representative of what consumers will generally achieve, the ad must now clearly and conspicuously disclose the generally expected performance in the depicted circumstances, and the advertiser must possess and rely on adequate substantiation for that representation. Stating that “Results are not typical” will no longer protect the advertiser from FTC claims of false or deceptive advertising.Nonetheless, the FTC has not ruled out the possibility that a strong disclaimer of typicality could be effective in the context of a particular ad. Although the FTC would have the burden of proof in a law enforcement action, the FTC notes that an advertiser possessing reliable empirical testing demonstrating that the net impression of its ad with such a disclaimer is non-deceptive will avoid the risk of the initiation of such an action in the first instance.

Bottomline:

1. Endorsements appearing in New Media Forms require disclosure of compensation or other benefits received or expected to be received from the advertiser. Compensation does not have to be money, and can be any benefit that would be reasonably expected to influence the opinion or product/service review.

1. Advertisers are required to notify New Media Form endorsers of their obligations regarding disclosures as to compensation and truthfulness in the endorsement content. Advertisers must also monitor the New Media Forms for compliance and take action if there is non-compliance. Therefore, advertisers should have written procedures in place that are followed when utilizing endorsements through New Media Forms. The existence of and compliance with these procedures will be important if ever defending against an FTC action.

1. The FTC claims that it did not issue the revised Guideswith the objective of suing bloggers. However, the FTC did not say that it would not sue bloggers. Therefore, compliance by bloggers with these Guides is the best advice.

1. Consumer claims of results from use of products or services must be those that can be expected by the average consumer of the product or service, otherwise the result that can be commonly expected must be disclosed. Saying “Results are not typical” will no longer protect an advertiser from claims of deceptive advertising.