Statement of Robert Pitofsky on Online Privacy.
Title: Protection of Children's Privacy on the World Wide Web.
Event: Senate Communications Subcommittee Hearing on S 2326.
Date: September 23, 1998.
Source: FTC.

Prepared Statement
of
The Federal Trade Commission

Presented by
Robert Pitofsky, Chairman

Before the
Subcommittee on Communications
of the
Senate Committee on Commerce, Science & Transportation
United States Senate
on

"Protection of Children's Privacy on the World Wide Web"

Washington, D.C.
September 23, 1998

Mr. Chairman, I am Robert Pitofsky, Chairman of the Federal Trade Commission; and I am pleased to appear before you today to offer the Commission's views in support of S. 2326, the "Children's Online Privacy Protection Act of 1998" introduced by Senators Bryan and McCain to protect children's online privacy.⁽¹⁾ I would like to discuss with you the Commission's role in addressing online privacy issues generally, our findings and concerns with respect to children's online privacy, the industry's self-regulatory efforts to address these concerns, and why we believe that the legislation this Committee is considering is both appropriate and necessary.

I. Introduction

The Commission believes that legislation such as S. 2326 is important and necessary to protect the privacy of our youngest consumers when they go online. The Commission initially made this recommendation to Congress last June in Privacy Online: A Report to Congress (the "Report").⁽²⁾ Much of the Report is devoted to describing and analyzing the results of a comprehensive survey of commercial sites on the World Wide Web, including 212 children's sites. The survey revealed that a significant amount of identifying information is collected from children without any apparent parental involvement. The Report concluded that although some industry groups have taken steps to promote greater privacy protection for children online, self-regulatory efforts have not produced an adequate level of protection. The FTC therefore recommended that legislation be enacted to bolster ongoing self-regulatory initiatives to protect children online, to encourage others to undertake such initiatives, and to provide statutory standards that would govern businesses that do not participate in self-regulatory programs.

II. The Role of the FTC in Online Privacy Issues

FTC Law Enforcement Authority

The Commission's mission is to promote the efficient functioning of the marketplace by seeking to protect consumers from unfair or deceptive acts or practices and by promoting vigorous competition. The Commission's responsibilities are far-reaching. Its primary legislative mandate is to enforce the Federal Trade Commission Act, which prohibits unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce.⁽³⁾ With the exception of certain industries, this statute provides the FTC with broad law enforcement authority over virtually every sector of our economy.⁽⁴⁾ Commerce on the Internet falls within the scope of this statutory mandate.

The protection of children has long been an important part of the Commission's consumer protection mission. Over the years the Commission has brought numerous cases challenging unfair or deceptive marketing practices involving children,⁽⁵⁾ and has encouraged industry self-regulatory bodies to address these concerns. The FTC has also worked closely with Congress to fashion appropriate responses to new problems when they occur.⁽⁶⁾

Activities Relating to Online Privacy

The Commission has been involved in addressing online privacy issues affecting both adults and children for almost as long as there has been an online marketplace. Through a series of workshops and hearings, it sought to understand this new marketplace and its information practices, to assess the impact of these practices on consumers, and to encourage and facilitate effective self-regulation. The Commission's efforts included bringing industry and consumer and privacy advocates together to address online privacy issues, including children's privacy, and challenging industry leaders to develop and implement meaningful self-regulatory programs. The Commission's activities in this area were based on the understanding that personal information can be collected and widely disseminated on the Web at low cost and with unprecedented ease. The Commission also recognized that greater protection of personal privacy on the Web will not only protect consumers, but also increase consumer confidence and ultimately consumer participation in the online marketplace.

III. The Collection of Information from Children Online

The Commission has paid especially close attention to the growing area of marketing to children on the Internet. The advent of this new medium --- with its new methods of providing information and communicating through Web sites, electronic mail, news groups, chat rooms, electronic bulletin boards, and commercial online services --- is an historical development much like the introduction of television or, a few generations earlier, the telephone. The Internet presents children with an extraordinary new means to tap into rich sources of information that previously were difficult to access, and to communicate with their peers and others in ways never before imaginable. In addition, the Internet's technology enables marketers to establish direct and ongoing one-to-one relationships with individual children in ways previously unavailable to traditional media.

Growth in the Number of Children Using the Internet

Children are using the Internet in growing numbers.⁽⁷⁾ In 1998, almost 16 million of America's 69.6 million children under age 18 are reported to be online, almost doubling the number of children (9.8 million) reported to be online only one year ago.⁽⁸⁾ Over 6 million of these children are age 12 and under, up from the 3.5 million reported to be online in 1997.⁽⁹⁾ These figures show a dramatic increase in the presence of children on the Internet. Children are also avid consumers and represent a large and powerful segment of the marketplace.⁽¹⁰⁾ The increasing number of children online coupled with their growing economic impact create enormous opportunities for marketers to promote their products and services to an eager, targeted, and vulnerable audience.⁽¹¹⁾

The Collection of Information from Children Online

Online marketers have responded to this opportunity. Last March, Commission staff conducted an extensive survey of the information practices of commercial Web sites on the World Wide Web (the "Web"), including 212 children's commercial Web sites.⁽¹²⁾ Our survey found that almost 90% of the children's Web sites are collecting personal information from and about children.⁽¹³⁾ Children's sites collect personal information from children through a variety of means, including registration pages, user surveys, online contests, electronic pen pal programs, guest books, and application forms.⁽¹⁵⁾ In addition to collecting personal information directly from a child, a child may reveal his or her personal information in the course of participating in chat rooms or posting messages on electronic bulletin boards -- areas that are publicly accessible to anyone surfing the Web.

In contrast to the real world, where such information ordinarily would be solicited from young children only with the involvement of a parent, in cyberspace the vast majority of children's sites collect personal information without notice to, or even an opportunity for control by, parents. Fifty-four percent of the children's sites surveyed provide some form of a statement about the site's information practices, but only 23% of sites even tell children to seek parental permission before providing personal information.⁽¹⁶⁾ Fewer still (7%) say they will notify parents of their information practices, and only 1% obtain parental permission prior to collecting such information.⁽¹⁷⁾

The widespread collection of information from young children described in the Report contrasts sharply with the strongly expressed preferences of parents. Indeed, a Louis Harris and Associates survey conducted by Dr. Alan Westin found that 97% of parents whose children use the Internet believe Web sites should not sell or rent personal information relating to children, and 72% object to a Web site's requesting a child's name and address when the child registers at the site, even if such information is used only internally.⁽¹⁸⁾

These new cyberspace information collection practices have real world consequences for family privacy and security. The following two examples of the kinds of children's information collection practices Commission staff found in the survey are instructive:

One child-directed site collected personal information, such as a child's full name, postal address, e-mail address, gender, and age. The site also asked a child extensive personal questions about financial information, such as whether a child previously had received gifts in the form of stocks, cash, savings bonds, mutual funds, or certificates of deposit; who had given a child these gifts; and whether a child had put monetary gifts into mutual funds, stocks or bonds. The site also asked for family financial information including whether a child's parents owned mutual funds. Apparently in exchange for providing this information, a child was entered into a contest. Elsewhere on the Web site, contest winners' full names, age, city, state, and zip code were posted.

Another child-directed site collected personal information to register a child for a chat room. The information included a child's full name, e-mail address, city, state, gender, age, and hobbies. The Web site had a lotto contest that asked for a child's full name and e-mail address. Lotto contest winners' full names were posted on the site. For children who wished to find an electronic pen pal, the site offered a bulletin board service that posted messages, including children's e-mail addresses. While the Web site said it asked children to post messages if they were looking for a pen pal, in fact anyone of any age could visit this bulletin board and use the Web site information directly to contact a child.⁽¹⁹⁾

Because of their failure to post a privacy policy or to involve the child's parents, these Web sites illustrate the types of concerns raised by the collection and posting of children's personal information on the Web. The Commission believes that most young children do not possess the level of knowledge or judgment to determine whether to divulge personal information over the Internet.

Moreover, interactive activities available on Web sites, such as chat rooms, message boards, personal home pages, pen pal programs, and free e-mail services, make it easy for children to disclose their personal information to the general public without their parents' awareness or consent. Such public disclosures raise safety concerns. Anecdotal evidence provided at our June 1997 Public Workshop on Consumer Information Privacy indicates that many children surfing the Internet claim to have experienced problems, such as attempted password theft and inappropriate advances by adults in children's chat rooms.⁽²⁰⁾ Further, the FBI and Justice Department's "Innocent Images" investigation into the use of the Internet by pedophiles and other sexual predators reveals that online services and bulletin boards are rapidly becoming the most prevalent sources used by such predators to identify and contact children.⁽²¹⁾ Although there is little evidence directly linking commercial data collection to these problems, the practice of collecting personal identifying information directly from children without parental consent is clearly troubling, since its teaches children to reveal their personal information to strangers and circumvents parental control over their family's information.⁽²²⁾

IV. FTC Law Enforcement Efforts

The Commission has taken several steps to stop deceptive or unfair information practices aimed at children on the Web. On July 15, 1997, the Commission responded in a staff opinion letter to a petition by the Center for Media Education regarding the information practices of KidsCom, a children's Web site. The letter provides guidance to Web site operators as to what information practices involving children are likely to be deceptive or unfair under Section 5 of the Federal Trade Commission Act.⁽²³⁾

Building on the guidance set forth in the staff opinion letter, the Commission recently announced its first Internet privacy case, a settlement reached with GeoCities, one of the most popular sites on the Web.⁽²⁴⁾ The Commission's complaint alleges that GeoCities had made deceptive statements about the use of personal identifying information it collected from children as well as adults. Specifically, the complaint alleges that GeoCities had disclosed identifying information collected via its member registration application to third parties who used it to target members, including thousands of children, for solicitations beyond those that members had agreed to receive. In addition, the complaint charges that GeoCities promoted children's activities that solicited personal identifying information from children in a manner that suggested that GeoCities was collecting the information, when in reality the information was going directly to third parties. In settling this matter, GeoCities has agreed to undertake important privacy protections including posting a clear and prominent Privacy Notice and obtaining parental consent before collecting personal identifying information from children age 12 and under.⁽²⁵⁾

V. Industry Self-Regulation to Protect Children's Privacy

As an integral part of its efforts over the last three years to protect the privacy of children on the Web, the Commission has encouraged industry to address concerns about children's privacy online through self-regulation. The Commission was pleased to see that as early as April 1997, the Children's Advertising Review Unit (CARU) of the Better Business Bureaus, Inc. had developed guidelines addressing the online collection of personal information from children. More recently, the Direct Marketing Association and the Online Privacy Alliance proposed guidelines that urge Web sites to provide notice to parents and obtain parental consent before the collection and use of children's personal information. These efforts are valuable in developing an industry consensus on the appropriate level of protection to accord children's privacy on commercial Internet sites. However, despite these industry efforts, our March survey shows that the vast majority of child-oriented commercial sites have not implemented these protections. The Commission believes that a key objective of any legislation should be to encourage development and implementation of meaningful, effective self-regulatory activities and to provide a basis for their widespread adoption.

VI. Legislation

The GeoCities case demonstrates that Section 5 of the FTC Act provides a basis for Commission action to protect children's online privacy under certain circumstances. It is not clear, however, that Section 5 authorizes the Commission to take action in all circumstances necessary to protect children's online privacy. This is the primary reason why we continue to recommend a legislative response to these issues.

The proposed Children's Online Privacy Act contains many provisions that we believe are necessary and appropriate for effective protection of children online. The Commission supports the enactment of legislation such as S. 2326, because it places parents in control of the online collection and use of personal information from their children. Children are not fully capable of understanding the consequences of divulging personal information online. Moreover, given the nature of this new medium, parents do not always have the knowledge, or the opportunity, to intervene in their children's choices about giving personal information to Web sites. The proposed legislation would allow parents to know about and control the online collection of information from their children by requiring Web sites to provide actual notice and to obtain prior parental consent.

This legislation would permit parents to make choices about when and how their children's personal information is collected and used on the Web, and enable parents to monitor their children's interactions and to help protect their children from the risks of inappropriate online interactions. First, this bill sets forth a basic level of privacy protection for children visiting U.S. consumer-oriented commercial Web sites. By establishing these ground rules, the bill would create a level playing field for all such sites. Second, the bill's safe harbor provision would allow industry groups and others to establish sector-specific guidelines, subject to governmental approval, while providing a strong incentive both for ongoing self-regulatory efforts and for the development of new more effective industry efforts. Third, the bill would give the Federal Trade Commission rule-making authority under the Administrative Procedure Act⁽²⁶⁾ to promulgate both procedural mechanisms for approval of industry guidelines and to implement the legislation's substantive provisions governing the online collection of personal information from children.

As a result of our activities over the past three years, the Commission has developed significant expertise regarding children's privacy. We believe the bill, as currently structured, will enable the Commission to work cooperatively with industry and consumer organizations to develop flexible, practical, and effective approaches to protect children's privacy on commercial Web sites. The Commission strongly supports the approach adopted in this legislation.

VII. Conclusion

The enactment of legislation such as S. 2326 would provide uniform privacy protections that should protect children online and provide parents and their children with greater confidence in using the Internet. While the Commission will continue to monitor this area actively and bring law enforcement actions where appropriate, we believe that legislation is needed to provide a basic level of children's online privacy across the board. We believe that under this bill the Commission can play an important role in developing flexible industry-specific standards. In addition, the approach proposed in S. 2326 would encourage the continued growth of industry self-regulatory efforts.

The Commission is committed to the goal of assuring children's online privacy and looks forward to working with the Committee as it considers the Children's Online Privacy Act.

1. My oral testimony and responses to questions you may have reflect my own views and are not necessarily the views of the Commission or any other Commissioner.

2. A copy of the Report is attached as Appendix A. The Report is also available on the Commission's Web site at www.ftc.gov/reports/privacy3/index.htm.

3. 15 U.S.C. § 45(a). The Commission also has responsibilities under approximately 40 additional statutes, e.g., the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq., which establishes important privacy protections for consumers' sensitive financial information; the Truth in Lending Act, 15 U.S.C. §§ 1601 et seq., which mandates disclosures of credit terms; and the Fair Credit Billing Act, 15 U.S.C. §§ 1666 et. seq., which provides for the correction of billing errors on credit accounts. The Commission also enforces over 30 rules governing specific industries and practices, e.g., the Used Car Rule, 16 C.F.R. Part 455, which requires used car dealers to disclose warranty terms via a window sticker; the Franchise Rule, 16 C.F.R. Part 436, which requires the provision of information to prospective franchisees; and the Telemarketing Sales Rule, 16 C.F.R. Part 310, which defines and prohibits deceptive telemarketing practices and other abusive telemarketing practices.

4. Certain entities, such as banks, savings and loan associations, and common carriers, as well as the business of insurance are wholly or partially exempt from Commission jurisdiction. See Section 5(a)(2) of the FTC Act, 15 U.S.C. § 45(a)(2), and the McCarran-Ferguson Act, 15 U.S.C. § 1012(b).

5. Generally, these deception cases addressed false demonstrations and misrepresentations about performance of toys in advertising directed to children. See Azrak-Hamway International, Inc., C-3653 (May 2, 1996) (consent); United States v. Hasbro, Inc., No. 96-451P (D.R.I. Aug. 6, 1996)(stipulated permanent injunction and $280,000 civil penalty); Lewis Galoob Toys, Inc., 114 F.T.C. 187 (1991)(consent).

6. Most recently, the Commission's actions regarding the marketing of pay-per-call 900 services to children recognized children as a vulnerable group in the marketplace. These cases challenged the marketing of 900 number services to children as an unfair practice. See Audio Communications, Inc., 114 F.T.C. 414 (1991)(consent order); Teleline, Inc., 114 F.T.C. 399 (1991) (consent order); Phone Programs, Inc., 115 F.T.C. 977 (1992)(consent order); Fone Telecommunications, Inc., Docket No. C-3432 (June 14, 1993) (consent order).

7. Children use the Web for a wide variety of activities, including homework, informal learning, browsing, playing games, corresponding with electronic pen pals by e-mail, placing messages on electronic bulletin boards, and participating in chat rooms. See Interactive Consumers Research Report, Vol. 4, No. 5 at 1, 4, May 1997 (discussing results of FIND/SVP's 1997 American Internet User Survey).

8. cyberdialogue/findsvp, "1998 American Internet User Survey." These figures include children online from any location including home, school, libraries, homes of friends, and relatives. At mid-year, 8.7 million children under age 18 reportedly went online from home, up from 5.7 million a year ago, and 9.3 million from school, up from 4.1 million in 1997.

9. Id.

10. Children are estimated to spend billions of dollars a year, and to influence the expenditure of billions more. For example, one source has estimated that, in 1997, children aged 4 through 12 spent $24.4 billion themselves; and children aged 2 through 14 may have directly influenced spending by their parents in an amount as much as $188 billion. James U. McNeal, Tapping the Three Kids' Markets, American Demographics, Apr. 1998, at 38, 40.

11. According to one source, most children's Web sites are targeting children ages 8 to 11. Teens tend to visit the same sites that adults visit. Robin Raskin, What do Kids Want?, Family PC Magazine, May 1998, at 17.

12. See Report, Appendix A, at 3, describing the methodology used to select the sites in the children's sample.

13. Typically the sites that collect personal identifying information also collect several other types of information, enabling them to form a detailed profile of a child. Of the sites surveyed that collect a child's name and/or e-mail address, 21% collect 5 or more additional types of personal information; 48% collect three or more additional types of information; and 77% collect one or more additional types of information.⁽¹⁴⁾

14. Report at 32.

15. The March survey did not identify the specific activities through which Web sites collected information, however, a previous Commission review of children's sites did identify the wide range of information collection methods cited above. See FTC Staff Report: Public Workshop on Consumer Privacy on the Global Information Infrastructure, December 1996, Appendix E, available at http://www/ftc.gov/reports/privacy/privacy1.htm. In addition, the March survey identified Web sites' disclosures about their information practices, but did not determine their actual practices.

16. Report at 37.

17. Id.

18. Commerce, Communication, and Privacy Online, A National Survey of Computer Users, by Louis Harris & Associates and Dr. Alan F. Westin (1997) at 74.

19. Report at 39-40.

20. See Transcript of FTC Public Workshop on Consumer Information Privacy, June 12, 1997, at 192-93.

21. Id. at 192-93. Since its beginnings in 1995, the FBI's "Innocent Images" program has generated 421 search warrants, 175 indictments, 175 arrests and 201 convictions (as of June 2, 1998).

22. Complaints filed with the National Center for Missing & Exploited Children's Cyber Tipline (1-800-843-5678/ www.missingkids.com/cybertip) include reports of the use of commercial Web sites' free e-mail services, chat rooms, message boards, and pen pal programs by inappropriate adults seeking to communicate with children.

23. In brief, the letter states that it is a deceptive practice to expressly or impliedly misrepresent the purpose for which personal identifying information is being collected from children (e.g., to represent that the information is collected for a game or contest when it is actually collected for the purpose of compiling a mailing list). The letter also states that it is likely to be an unfair practice to collect personal identifying information from children and sell or otherwise disclose that information to third parties without providing parents with adequate notice and a prior opportunity to control the collection and use of the information.

24. GeoCities, FTC File No. 982 3015, August 13, 1998 (provisional acceptance of the consent agreement).

25. The settlement agreement was published at 63 Fed Reg 44624 (August 20, 1998). The 60 day comment period closes on October 19, 1998. After reviewing all comments filed, the Commission will decide whether to make the consent agreement final.

26. 5 U.S.C. § 553.