June 11, 1999

Legislative Activity

Children's Online Privacy Protection Act

June 11, 1999

Federal Trade Commission
Room H-159
600 Pennsylvania Avenue, NW
Washington, DC 20580

Re: Children's Online Privacy Protection Rule -- Comment, P994504

Dear Mr. Secretary:

The American Advertising Federation (AAF) is pleased to offer comments to the Federal Trade Commission (FTC) on the proposed rule implementing the Children's Online Privacy Protection Act of 1998 (COPPA). This is an important and difficult issue that has substantial ramifications for both consumers and Web-site operators.

The American Advertising Federation is the unifying voice for advertising. We are the only national association representing all aspects of the advertising industry. Our corporate membership includes advertisers, advertising agencies and the media, many of whom are, or have clients who are, global companies. In addition, the AAF represents 50,000 advertising professionals in over 200 local advertising federations and students on nearly 250 college campuses.

The AAF would like to thank the commission for its thorough analysis of the issues raised by the COPPA, and we realize there are tremendous issues to be addressed in regard to children's online privacy. However, we do have concerns regarding the extent to which the proposed rule imposes overly broad and burdensome requirements on Web-site operators.

Before we examine some of the issues more closely, the AAF would like to encourage the FTC to continue to foster communication between the private sector and consumers, and to allow self-regulatory efforts, along with consumer education and technological solutions, to guide the continued growth of electronic commerce. The AAF believes that industry has a responsibility to respect consumer privacy, and also believes that consumers have responsibility to become more aware of issues created by sharing personal information as well. There clearly is a need to balance the interests of the individual with the goals of commerce and business, which often provide boundless benefits for the consumer. The AAF realizes that advertisers and Web-site operators must balance the individuals right to privacy with the responsibility of information holders and transmitters.

The AAF would like to reiterate its support of the "Fairness Principle of Privacy" first outlined by the Privacy Working Group of the National Information Infrastructure (NII) in the NII Privacy Paper published in 1995. As we stated in our comments to the FTC on general consumer privacy issues in 1997, the "Fairness Principle" states that "(I)nformation users should not use personal information in ways that are incompatible with the individual's understanding of how it will be used." The goal of this principle is that personal information should not be used in a way that goes beyond an individual's understanding and consent. If the manner of use of the information is not foreseen, then the consumer has not provided implicit consent. We believe this principle also applies to children, along with their parents or guardians, in the online environment.

The Proposed Rule's Requirements for Notice
AAF agrees in general with the principles and intent of notice, yet we are concerned that the commission's proposed rules would require extremely detailed applications of notice, including the required content of notice, far beyond what was intended by the COPPA. The legislative intent of the act required that notice be "clear, prominent and understandable." The proposed requirements go far beyond that original scope as set forth in the COPPA.

The proposed placement of the notice is also troublesome. Per the proposed rule, "The link on the home page must be placed such that a typical visitor does not need to scroll down from the initial viewing screen. A small link at the foot of the page, for example, is not sufficient (...)." A requirement that the notice be located on the initial viewing screen rather than some other easy to locate position such as the bottom of the home page is unrealistic. The size of screens vary, and graphical interface is not constant. It does not make digital sense to impose a placement requirement in this now digital media.

Many Web operators locate their privacy policy at the lower portion of the home page. Typical Web visitors realize that the scroll bar at the right of their screens indicates whether there is more information below. Web users realize they need to scroll down to reach the "bottom" of a page. These same users are familiar with privacy policy "hyperlinks," and are accustomed to the industry practice of often locating privacy policies at the bottom of the screen.

The requirement that a link be placed at each locale on a Web site where children directly provide, or are asked to provide, personal information so "that a typical visitor to those places can see the link without having to scroll down" is overly burdensome and unnecessary. Such a requirement would be stifling and contrary to the creative philosophy of interactive Web sites. Web site users know that if they wish to learn the Web site operator's information collection practices they simply need to "click" on the privacy policy hyperlink often located on the home page. As long as the privacy policy is easy to find, easy to read and easy to understand, it should not be necessary to repeatedly provide that link at various places on a Web site.

Nor should Internet users, be they children or parents, be required to repeatedly refer to a "privacy" hyperlink. Such a requirement even has the potential of confusing consumers who may think there are new and different privacy disclosures for each hyperlink.

Children are often more savvy than their parents in terms of navigating the Web. They are quite familiar with scrolling down screens and investigating hyperlinks. Additionally, they often question what they see. In this new media, it's children who may be the more savvy users. However, despite such awareness, AAF has endorsed, and has encouraged its members to follow the voluntary CARU Privacy Guidelines for all children's Web sites. AAF recognizes that such self-regulatory guides are very consistent with the proposed regulation, yet as self-regulation, the guides do not overly burden the rights of Web-site operators. The number of children's products that have failed in the marketplace despite heavy investment in advertising demonstrates that children can be both discriminating and full of questions even while very young.

Third-Party References: The Proposed Requirement to Provide Notice Regarding Privacy Practices of Others
The commission's proposed requirement that Web-site operators (who disclose personal information to third parties) provide notice to consumers regarding the privacy/ information collection practices of third parties is overly regulatory. It is also burdensome for Web-site operators to provide a "brief statement of the types of business in which the third party (is) engaged." Consumers should be empowered and able to independently check the privacy practices of the third party. The goal should be to empower the consumer rather than impose unnecessary burdens on Web-site operators. A Web-site operators should be solely responsible for their own information collection and privacy practices and not those of others. Perhaps even a link to third party Web sites, if available, or other creative solutions, would be a better solution for Web-site operators wishing to clear their sites of superfluous copy.

The AAF also is concerned that Web-site operators will be held responsible for not only the privacy practices of third parties to which they legitimately disclose personal information but also for other organizations that the third party may in turn disclose the same information. Web-site operators cannot be held responsible for the sharing of information by third parties but only for disclosing that the information will be shared.

The AAF is also concerned that Web-site operators may be held responsible for the information disclosure practices of organizations beyond disclosing the fact that information may be shared with a third party with which they interact. For example, if a Web site operator discloses personal information to a third party with the understanding that the third party provides similar privacy protections to consumers, yet the third party discloses that information to another third party that does not have reputable privacy practices, the original Web site operator should not be held responsible.

Retroactive Application of the Rule
The AAF also is concerned that the proposed rule protects personal information collected from children prior to the effective date of the final rule if an operator wishes to use that information in the future. The proposed rule would also require Web-site operators who maintain a database of children's personal information to provide notice to the parent and obtain parental consent prior to using such information once the rule is effective. It is unreasonable, unfair and overly burdensome to expect Web-site operators to provide notice to parents of information they may have in their databases from prior interaction with children, when there was no law to do so at the time.

Such a requirement would be difficult to execute, and an overly burdensome expense on most Web-site operators. Web-site operators mostly will be unable to provide such notice due to insufficient contact information for the child or parent. For example, if children provide their name and age on a particular Web site but no postal or e-mail address, it may be impossible to properly identify and contact the parents of the children in order to provide notice. The proposed rule cannot apply retroactively to use of information collected prior to the effective date of the final rule, particularly if Web-site operators were unaware at the time that such notice procedures would be required. It is simply unfair to require Web-site operators to do so.

Once again, the AAF would like to stress that the advertising industry does have a responsibility to respect consumer privacy, and children's privacy in particular. However, consumers may also have a responsibility to become more savvy about sharing personal information. Efforts to educate consumers on privacy issues should be pursued by industry, consumers and the FTC, along with technological solutions to address privacy concerns. Technology and software exists that allow consumers to limit access to certain Internet sites or categories of sites, and that prohibit children from providing Web-site operators with personal information.

To resolve consumer privacy concerns, both industry and the government must work together to continually improve technology that protects consumer privacy, and seek avenues to educate the public on accessing and using these important technologies. The AAF supports the CARU self-regulatory efforts and other effective self-regulation models.

The American Advertising Federation would like to thank the Federal Trade Commission for their thorough analysis of the issues presented by the Children's Online Privacy Protection Act, and for the opportunity to provide comments on its proposed rule.