|
Children's
Online Privacy Protection
Act of 1998 (COPPA)
TITLE XIII-CHILDREN'S ONLINE PRIVACY
PROTECTION
SEC. 1301. SHORT TITLE.
This title may be cited as
the "Children's Online Privacy Protection Act of 1998".
SEC. 1302. DEFINITIONS.
In this title:
(1) CHILD.—The term
"child" means an individual under the age of 13.
(2) OPERATOR.—The term
"operator"—
(A) means any person who
operates a website located on the Internet or an online service and
who collects or maintains personal information from or about the users
of or visitors to such website or online service, or on whose behalf
such information is collected or maintained, where such website or
online service is operated for commercial purposes, including any
person offering products or services for sale through that website or
online service, involving commerce—
(i) among the several
States or with 1 or more foreign nations;
(ii) in any territory of
the United States or in the District of Columbia, or between any
such territory and—
(I) another such
territory; or
(II) any State or
foreign nation; or
(iii) between the
District of Columbia and any State, territory, or foreign nation;
but
(B) does not include any
nonprofit entity that would otherwise be exempt from coverage under
section 5 of the Federal Trade Commission Act (15 U.S.C. 45).
(3) COMMISSION.—The term
"Commission" means the Federal Trade Commission.
(4) DISCLOSURE.—The term
"disclosure" means, with respect to personal information—
(A) the release of
personal information collected from a child in identifiable form by an
operator for any purpose, except where such information is provided to
a person other than the operator who provides support for the internal
operations of the website and does not disclose or use that
information for any other purpose; and
(B) making personal
information collected from a child by a website or online service
directed to children or with actual knowledge that such information
was collected from a child, publicly available in identifiable form,
by any means including by a public posting, through the Internet, or
through—
(i) a home page of a
website;
(ii) a pen pal service;
(iii) an electronic mail
service;
(iv) a message board; or
(v) a chat room.
(5) FEDERAL AGENCY.—The
term "Federal agency" means an agency, as that term is defined
in section 551(1) of title 5, United States Code.
(6) INTERNET.—The term
"Internet" means collectively the myriad of computer and
telecommunications facilities, including equipment and operating
software, which comprise the interconnected world-wide network of
networks that employ the Transmission Control Protocol/ Internet
Protocol, or any predecessor or successor protocols to such protocol, to
communicate information of all kinds by wire or radio.
(7) PARENT.—The term
"parent" includes a legal guardian.
(8) PERSONAL
INFORMATION.—The term "personal information" means
individually identifiable information about an individual collected
online, including—
(A) a first and last name;
(B) a home or other
physical address including street name and name of a city or town;
(C) an e-mail address;
(D) a telephone number;
(E) a Social Security
number;
(F) any other identifier
that the Commission determines permits the physical or online
contacting of a specific individual; or
(G) information concerning
the child or the parents of that child that the website collects
online from the child and combines with an identifier described in
this paragraph.
(9) VERIFIABLE PARENTAL
CONSENT.—The term "verifiable parental consent" means any
reasonable effort (taking into consideration available technology),
including a request for authorization for future collection, use, and
disclosure described in the notice, to ensure that a parent of a child
receives notice of the operator's personal information collection, use,
and disclosure practices, and authorizes the collection, use, and
disclosure, as applicable, of personal information and the subsequent
use of that information before that information is collected from that
child.
(10) WEBSITE OR ONLINE
SERVICE DIRECTED TO CHILDREN.—
(A) IN GENERAL.—The term
"website or online service directed to children" means—
(i) a commercial website
or online service that is targeted to children; or
(ii) that portion of a
commercial website or online service that is targeted to children.
(B) LIMITATION.—A
commercial website or online service, or a portion of a commercial
website or online service, shall not be deemed directed to children
solely for referring or linking to a commercial website or online
service directed to children by using information location tools,
including a directory, index, reference, pointer, or hypertext link.
(11) PERSON.—The term
"person" means any individual, partnership, corporation,
trust, estate, cooperative, association, or other entity.
(12) ONLINE CONTACT
INFORMATION.—The term "online contact information" means an
e-mail address or an-other substantially similar identifier that permits
direct contact with a person online.
SEC. 1303. REGULATION OF
UNFAIR AND DECEPTIVE ACTS AND PRACTICES IN CONNECTION WITH THE
COLLECTION AND USE OF PERSONAL INFORMATION FROM AND ABOUT CHILDREN ON
THE INTERNET.
(a) ACTS PROHIBITED.—
(1) IN GENERAL.—It is
unlawful for an operator of a website or online service directed to
children, or any operator that has actual knowledge that it is
collecting personal information from a child, to collect personal
information from a child in a manner that violates the regulations
prescribed under subsection (b).
(2) DISCLOSURE TO PARENT
PROTECTED.—Notwithstanding paragraph (1), neither an operator of
such a website or online service nor the operator's agent shall be
held to be liable under any Federal or State law for any disclosure
made in good faith and following reasonable procedures in responding
to a request for disclosure of per-sonal information under
subsection (b)(1)(B)(iii) to the parent of a child.
(b) REGULATIONS.—
(1) IN GENERAL.—Not
later than 1 year after the date of the enactment of this Act, the
Commission shall promulgate under section 553 of title 5, United
States Code, regulations that—
(A) require the
operator of any website or online service directed to children
that collects personal information from children or the operator
of a website or online service that has actual knowledge that it
is collecting personal information from a child—
(i) to provide
notice on the website of what information is collected from
children by the operator, how the operator uses such
information, and the operator's disclosure practices for such
information; and
(ii) to obtain
verifiable parental consent for the collection, use, or
disclosure of personal information from children;
(B) require the
operator to provide, upon request of a parent under this
subparagraph whose child has provided personal information to that
website or online service, upon proper identification of that
parent, to such par-ent—
(i) a description of
the specific types of personal information collected from the
child by that operator;
(ii) the opportunity
at any time to refuse to permit the operator's further use or
maintenance in retrievable form, or future online collection, of
personal information from that child; and
(iii)
notwithstanding any other provision of law, a means that is
reasonable under the circumstances for the parent to obtain any
personal information collected from that child;
(C) prohibit
conditioning a child's participation in a game, the offering of a
prize, or another activity on the child disclosing more personal
information than is reasonably necessary to participate in such
activity; and
(D) require the
operator of such a website or online service to establish and
maintain reasonable procedures to protect the confidentiality,
security, and integrity of personal information collected from
children.
(2) WHEN CONSENT NOT
REQUIRED.—The regulations shall provide that verifiable parental
consent under paragraph (1)(A)(ii) is not required in the case of—
(A) online contact
information collected from a child that is used only to respond
directly on a one-time basis to a specific request from the child
and is not used to recontact the child and is not maintained in
retrievable form by the operator;
(B) a request for the
name or online contact information of a parent or child that is
used for the sole purpose of obtaining parental consent or
providing notice under this section and where such information is
not maintained in retrievable form by the operator if parental
consent is not obtained after a reasonable time;
(C) online contact
information collected from a child that is used only to respond
more than once directly to a specific request from the child and
is not used to recontact the child beyond the scope of that
request—
(i) if, before any
additional response after the initial response to the child, the
operator uses reasonable efforts to provide a parent notice of
the online contact information collected from the child, the
purposes for which it is to be used, and an opportunity for the
parent to request that the operator make no further use of the
information and that it not be maintained in retrievable form;
or
(ii) without notice
to the parent in such circumstances as the Commission may
determine are appropriate, taking into consideration the
benefits to the child of access to information and services, and
risks to the security and privacy of the child, in regulations
promulgated under this subsection;
(D) the name of the
child and online contact information (to the extent reasonably
necessary to protect the safety of a child participant on the
site)—
(i) used only for
the purpose of protecting such safety;
(ii) not used to
recontact the child or for any other purpose; and
(iii) not disclosed
on the site, if the operator uses reasonable efforts to provide
a parent notice of the name and online contact information
collected from the child, the purposes for which it is to be
used, and an opportunity for the parent to request that the
operator make no further use of the information and that it not
be maintained in retrievable form; or
(E) the collection,
use, or dissemination of such information by the operator of such
a website or online service necessary—
(i) to protect the
security or integrity of its website;
(ii) to take
precautions against liability;
(iii) to respond to
judicial process; or
(iv) to the extent
permitted under other provisions of law, to provide information
to law enforcement agencies or for an investigation on a matter
related to public safety. 1815
(3) TERMINATION OF
SERVICE.—The regulations shall permit the operator of a website or
an online service to terminate service provided to a child whose
parent has refused, under the regulations prescribed under paragraph
(1)(B)(ii), to permit the operator's further use or maintenance in
retrievable form, or future online collection, of personal
information from that child.
(c) ENFORCEMENT.—Subject
to sections 1304 and 1306, a violation of a regulation prescribed
under subsection (a) shall be treated as a violation of a rule
defining an unfair or deceptive act or practice prescribed under
section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C.
57a(a)(1)(B)).
(d) INCONSISTENT STATE
LAW.—No State or local government may impose any liability for
commercial activities or actions by operators in interstate or foreign
commerce in connection with an activity or action described in this
title that is inconsistent with the treatment of those activities or
actions under this section.
SEC. 1304. SAFE HARBORS.
(a) GUIDELINES.—An
operator may satisfy the requirements of regulations issued under
section 1303(b) by following a set of self-regulatory guidelines,
issued by representatives of the marketing or online industries, or by
other persons, approved under subsection (b).
(b) INCENTIVES.—
(1) SELF-REGULATORY
INCENTIVES.—In prescribing regulations under section 1303, the
Commission shall provide incentives for self-regulation by operators
to implement the protections afforded children under the regulatory
requirements described in subsection (b) of that section.
(2) DEEMED
COMPLIANCE.—Such incentives shall include provisions for ensuring
that a person will be deemed to be in compliance with the
requirements of the regulations under section 1303 if that person
complies with guidelines that, after notice and comment, are
approved by the Commission upon making a determination that the
guidelines meet the requirements of the regulations issued under
section 1303.
(3) EXPEDITED RESPONSE
TO REQUESTS.—The Commission shall act upon requests for safe
harbor treatment within 180 days of the filing of the request, and
shall set forth in writing its conclusions with regard to such
requests.
(c) APPEALS.—Final
action by the Commission on a request for approval of guidelines, or
the failure to act within 180 days on a request for approval of
guidelines, submitted under subsection (b) may be appealed to a
district court of the United States of appropriate jurisdiction as
provided for in section 706 of title 5, United States Code.
SEC. 1305. ACTIONS BY
STATES.
(a) IN GENERAL.—
(1) CIVIL ACTIONS.—In
any case in which the attorney general of a State has reason to
believe that an interest of the residents of that State has been or
is threatened or adversely affected by the engagement of any person
in a practice that violates any regulation of the Commission
prescribed under section 1303(b), the State, as parens patriae, may
bring a civil action on behalf of the residents of the State in a
district court of the United States of appropriate jurisdiction
to—
(A) enjoin that
practice;
(B) enforce compliance
with the regulation;
(C) obtain damage,
restitution, or other compensation on behalf of residents of the
State; or
(D) obtain such other
relief as the court may consider to be appropriate.
(2) NOTICE.—
(A) IN
GENERAL.—Before filing an action under paragraph (1), the
attorney general of the State involved shall provide to the
Commission—
(i) written notice
of that action; and
(ii) a copy of the
complaint for that action.
(B) EXEMPTION.—
(i) IN
GENERAL.—Subparagraph (A) shall not apply with respect to the
filing of an action by an attorney general of a State under this
subsection, if the attorney general determines that it is not
feasible to provide the notice described in that subparagraph
before the filing of the action.
(ii)
NOTIFICATION.—In an action described in clause (i), the
attorney general of a State shall provide notice and a copy of
the complaint to the Commission at the same time as the attorney
general files the action.
(b) INTERVENTION.—
(1) IN GENERAL.—On
receiving notice under subsection (a)(2), the Commission shall have
the right to intervene in the action that is the subject of the
notice.
(2) EFFECT OF
INTERVENTION.—If the Commission intervenes in an action under
subsection (a), it shall have the right—
(A) to be heard with
respect to any matter that arises in that action; and
(B) to file a petition
for appeal.
(3) AMICUS
CURIAE.—Upon application to the court, a person whose
self-regulatory guidelines have been approved by the Commission and
are relied upon as a defense by any defendant to a proceeding under
this section may file amicus curiae in that proceeding.
(c) CONSTRUCTION.—For
purposes of bringing any civil action under subsection (a), nothing in
this title shall be construed to prevent an attorney general of a
State from exercising the powers conferred on the attorney general by
the laws of that State to—
(1) conduct
investigations;
(2) administer oaths or
affirmations; or
(3) compel the
attendance of witnesses or the production of documentary and other
evidence.
(d) ACTIONS BY THE
COMMISSION.—In any case in which an action is instituted by or on
behalf of the Commission for violation of any regulation prescribed
under section 1303, no State may, during the pendency of that action,
institute an action under subsection (a) against any defendant named
in the complaint in that action for violation of that regulation.
(e) VENUE; SERVICE OF
PROCESS.—
(1) VENUE.—Any action
brought under subsection (a) may be brought in the district court of
the United States that meets applicable requirements relating to
venue under section 1391 of title 28, United States Code.
(2) SERVICE OF
PROCESS.—In an action brought under subsection (a), process may be
served in any district in which the defendant—
(A) is an inhabitant;
or
(B) may be found.
SEC. 1306. ADMINISTRATION
AND APPLICABILITY OF ACT.
(a) IN GENERAL.—Except
as otherwise provided, this title shall be enforced by the Commission
under the Federal Trade Commission Act (15 U.S.C. 41 et seq.).
(b)
PROVISIONS.—Compliance with the requirements imposed under this
title shall be enforced under—(1) section 8 of the Federal Deposit
Insurance Act (12 U.S.C. 1818), in the case of—
(A) national banks, and
Federal branches and Federal agencies of foreign banks, by the
Office of the Comptroller of the Currency;
(B) member banks of the
Federal Reserve System (other than national banks), branches and
agencies of foreign banks (other than Federal branches, Federal
agencies, and insured State branches of foreign banks), commercial
lending companies owned or controlled by foreign banks, and
organizations operating under section 25 or 25(a) of the Federal
Reserve Act (12 U.S.C. 601 et seq. and 611 et seq.), by the Board;
and
(C) banks insured by the
Federal Deposit Insurance Corporation (other than members of the
Federal Reserve System) and insured State branches of foreign banks,
by the Board of Direc- tors of the Federal Deposit Insurance
Corporation;
(2) section 8 of the
Federal Deposit Insurance Act (12 U.S.C. 1818), by the Director of
the Office of Thrift Supervision, in the case of a savings
association the deposits of which are insured by the Federal
Deposit Insurance Corporation;
(3) the Federal Credit
Union Act (12 U.S.C. 1751 et seq.) by the National Credit Union
Administration Board with respect to any Federal credit union;
(4) part A of subtitle
VII of title 49, United States Code, by the Secretary of
Transportation with respect to any air carrier or foreign air
carrier subject to that part;
(5) the Packers and
Stockyards Act, 1921 (7 U.S.C. 181 et seq.) (except as provided in
section 406 of that Act (7 U.S.C. 226, 227)), by the Secretary of
Agriculture with respect to any activities subject to that Act;
and
(6) the Farm Credit
Act of 1971 (12 U.S.C. 2001 et seq.) by the Farm Credit
Administration with respect to any Federal land bank, Federal land
bank association, Federal intermediate credit bank, or production
credit association.
(c) EXERCISE OF CERTAIN
POWERS.—For the purpose of the exercise by any agency referred to in
subsection (a) of its powers under any Act referred to in that
subsection, a violation of any requirement imposed under this title
shall be deemed to be a violation of a requirement imposed under that
Act. In addition to its powers under any provision of law specifically
referred to in subsection (a), each of the agencies referred to in
that subsection may exercise, for the purpose of enforcing compliance
with any requirement imposed under this title, any other authority
conferred on it by law.
(d) ACTIONS BY THE
COMMISSION.—The Commission shall prevent any person from violating a
rule of the Commission under section 1303 in the same manner, by the
same means, and with the same jurisdiction, powers, and duties as
though all applicable terms and provisions of the Federal Trade
Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made
a part of this title. Any entity that violates such rule shall be
subject to the penalties and entitled to the privileges and immunities
provided in the Federal Trade Commission Act in the same manner, by
the same means, and with the same jurisdiction, power, and duties as
though all applicable terms and provisions of the Federal Trade
Commission Act were incorporated into and made a part of this title.
(e) EFFECT ON OTHER
LAWS.—Nothing contained in the Act shall be construed to limit the
authority of the Commission under any other provisions of law.
SEC. 1307. REVIEW.
Not later than 5 years after
the effective date of the regulations initially issued under section
1303, the Commission shall—
(1) review the
implementation of this title, including the effect of the
implementation of this title on practices relating to the collection
and disclosure of information relating to children, children's ability
to obtain access to information of their choice online, and on the
availability of websites directed to children; and
(2) prepare and submit to
Congress a report on the results of the review under paragraph (1).
SEC. 1308. EFFECTIVE
DATE. Sections 1303(a), 1305, and 1306 of this title take effect on
the later of—
(1) the date that is 18
months after the date of enactment of this Act; or
(2) the date on which the
Commission rules on the first application filed for safe harbor
treatment under section 1304 if the Commission does not rule on the
first such application within one year after the date of enactment of
this Act, but in no case later than the date that is 30 months after
the date of enactment of this Act.
Parents
Should:
Look
for a privacy policy on any website directed to children.
The policy must be available through a link on the
website's homepage and at each area where personal information is
collected from kids. Websites for general audiences that have a
children's section must post the notice on the homepages of the section
for kids.
Read
the policy closely to learn the kinds of personal information being
collected, how it will be used, and whether it will be passed on to
third parties. If you find a website that doesn't post basic protections
for children's personal information, ask for details about their
information collection practices.
Decide
whether to give consent.
Giving consent authorizes the website to collect personal information
from your child. You can give consent and still say no to having
your child's information passed along to a third party.
Your
consent isn't necessary if the website is collecting your child's email
address simply to respond to a one-time request for information.
Decide
whether to approve information collection from your kids based on new
uses for the information.
Website operators will let you know about the need for new consent by
sending you a new notice and request. They will do this when they are
changing the terms-of-use of the information in a "material"
or significant way.
Ask
to see the information your child has submitted.
The site will ask you to verify your identity to ensure that your
child's information isn't given out improperly.
Understand
that you may revoke your consent at any time and have your child's
information deleted.
To stop a website from collecting additional information from your
child, you can revoke your consent. You also may ask a site to delete
any personal information it has already collected from your child.
Full
text of How to Protect Kid's Privacy Online [PDF]
Copyright © 1997-2009 All rights reserved. The information in this document
is proprietary and confidential and is protected under United States and
International Copyright and Trademark laws. No part of this document may
be reproduced or transmitted, in any form by any means whatsoever. Law
prohibits any such use of this document in any form, without the express
prior written consent of the author.
It is prohibited for anyone else to disclose, copy, distribute or use
the contents of this Website. All contents are not to be
attributed to castingyou.com/.net/.org/.tv/.cc/.la/.ws c/o F.W. &
Management, and may not be copied or distributed without this
disclaimer. If you received this message in error, please notify
us immediately at
Securities
Website design by CY
Contact Us
Care Team Private Policy
Child's Privacy Policy Disclaimers
|