Untitled Document
Download PDF
Children's
Online Privacy Protection Act of 1998
TITLE XIII-CHILDREN'S ONLINE PRIVACY PROTECTION
SEC. 1301. SHORT TITLE.
This title may be cited as the "Children's
Online Privacy Protection Act of 1998".
SEC. 1302. DEFINITIONS.
In this title:
(1) CHILD.—The term "child"
means an individual under the age of 13.
(2) OPERATOR.—The term "operator"—
(A) means any person who operates
a website located on the Internet or an online service and who collects or maintains
personal information from or about the users of or visitors to such website
or online service, or on whose behalf such information is collected or maintained,
where such website or online service is operated for commercial purposes, including
any person offering products or services for sale through that website or online
service, involving commerce—
(i) among the several States or with
1 or more foreign nations;
(ii) in any territory of the United
States or in the District of Columbia, or between any such territory and—
(I) another such territory; or
(II) any State or foreign nation;
or
(iii) between the District of Columbia
and any State, territory, or foreign nation; but
(B) does not include any nonprofit
entity that would otherwise be exempt from coverage under section 5 of the Federal
Trade Commission Act (15 U.S.C. 45).
(3) COMMISSION.—The term "Commission"
means the Federal Trade Commission.
(4) DISCLOSURE.—The term "disclosure"
means, with respect to personal information—
(A) the release of personal information
collected from a child in identifiable form by an operator for any purpose,
except where such information is provided to a person other than the operator
who provides support for the internal operations of the website and does not
disclose or use that information for any other purpose; and
(B) making personal information collected
from a child by a website or online service directed to children or with actual
knowledge that such information was collected from a child, publicly available
in identifiable form, by any means including by a public posting, through the
Internet, or through—
(i) a home page of a website;
(ii) a pen pal service;
(iii) an electronic mail service;
(iv) a message board; or
(v) a chat room.
(5) FEDERAL AGENCY.—The term
"Federal agency" means an agency, as that term is defined in section
551(1) of title 5, United States Code.
(6) INTERNET.—The term "Internet"
means collectively the myriad of computer and telecommunications facilities,
including equipment and operating software, which comprise the interconnected
world-wide network of networks that employ the Transmission Control Protocol/
Internet Protocol, or any predecessor or successor protocols to such protocol,
to communicate information of all kinds by wire or radio.
(7) PARENT.—The term "parent"
includes a legal guardian.
(8) PERSONAL INFORMATION.—The
term "personal information" means individually identifiable information
about an individual collected online, including—
(A) a first and last name;
(B) a home or other physical address
including street name and name of a city or town;
(C) an e-mail address;
(D) a telephone number;
(E) a Social Security number;
(F) any other identifier that the
Commission determines permits the physical or online contacting of a specific
individual; or
(G) information concerning the child
or the parents of that child that the website collects online from the child
and combines with an identifier described in this paragraph.
(9) VERIFIABLE PARENTAL CONSENT.—The
term "verifiable parental consent" means any reasonable effort (taking
into consideration available technology), including a request for authorization
for future collection, use, and disclosure described in the notice, to ensure
that a parent of a child receives notice of the operator's personal information
collection, use, and disclosure practices, and authorizes the collection, use,
and disclosure, as applicable, of personal information and the subsequent use
of that information before that information is collected from that child.
(10) WEBSITE OR ONLINE SERVICE DIRECTED
TO CHILDREN.—
(A) IN GENERAL.—The term "website
or online service directed to children" means—
(i) a commercial website or online
service that is targeted to children; or
(ii) that portion of a commercial
website or online service that is targeted to children.
(B) LIMITATION.—A commercial
website or online service, or a portion of a commercial website or online service,
shall not be deemed directed to children solely for referring or linking to
a commercial website or online service directed to children by using information
location tools, including a directory, index, reference, pointer, or hypertext
link.
(11) PERSON.—The term "person"
means any individual, partnership, corporation, trust, estate, cooperative,
association, or other entity.
(12) ONLINE CONTACT INFORMATION.—The
term "online contact information" means an e-mail address or an-other
substantially similar identifier that permits direct contact with a person online.
SEC. 1303. REGULATION OF UNFAIR
AND DECEPTIVE ACTS AND PRACTICES IN CONNECTION WITH THE COLLECTION AND USE OF
PERSONAL INFORMATION FROM AND ABOUT CHILDREN ON THE INTERNET.
(a) ACTS PROHIBITED.—
(1) IN GENERAL.—It is unlawful
for an operator of a website or online service directed to children, or any
operator that has actual knowledge that it is collecting personal information
from a child, to collect personal information from a child in a manner that
violates the regulations prescribed under subsection (b).
(2) DISCLOSURE TO PARENT PROTECTED.—Notwithstanding
paragraph (1), neither an operator of such a website or online service nor the
operator's agent shall be held to be liable under any Federal or State law for
any disclosure made in good faith and following reasonable procedures in responding
to a request for disclosure of per-sonal information under subsection (b)(1)(B)(iii)
to the parent of a child.
(b) REGULATIONS.—
(1) IN GENERAL.—Not later than
1 year after the date of the enactment of this Act, the Commission shall promulgate
under section 553 of title 5, United States Code, regulations that—
(A) require the operator of any website
or online service directed to children that collects personal information from
children or the operator of a website or online service that has actual knowledge
that it is collecting personal information from a child—
(i) to provide notice on the website
of what information is collected from children by the operator, how the operator
uses such information, and the operator's disclosure practices for such information;
and
(ii) to obtain verifiable parental
consent for the collection, use, or disclosure of personal information from
children;
(B) require the operator to provide,
upon request of a parent under this subparagraph whose child has provided personal
information to that website or online service, upon proper identification of
that parent, to such par-ent—
(i) a description of the specific
types of personal information collected from the child by that operator;
(ii) the opportunity at any time
to refuse to permit the operator's further use or maintenance in retrievable
form, or future online collection, of personal information from that child;
and
(iii) notwithstanding any other provision
of law, a means that is reasonable under the circumstances for the parent to
obtain any personal information collected from that child;
(C) prohibit conditioning a child's
participation in a game, the offering of a prize, or another activity on the
child disclosing more personal information than is reasonably necessary to participate
in such activity; and
(D) require the operator of such
a website or online service to establish and maintain reasonable procedures
to protect the confidentiality, security, and integrity of personal information
collected from children.
(2) WHEN CONSENT NOT REQUIRED.—The
regulations shall provide that verifiable parental consent under paragraph (1)(A)(ii)
is not required in the case of—
(A) online contact information collected
from a child that is used only to respond directly on a one-time basis to a
specific request from the child and is not used to recontact the child and is
not maintained in retrievable form by the operator;
(B) a request for the name or online
contact information of a parent or child that is used for the sole purpose of
obtaining parental consent or providing notice under this section and where
such information is not maintained in retrievable form by the operator if parental
consent is not obtained after a reasonable time;
(C) online contact information collected
from a child that is used only to respond more than once directly to a specific
request from the child and is not used to recontact the child beyond the scope
of that request—
(i) if, before any additional response
after the initial response to the child, the operator uses reasonable efforts
to provide a parent notice of the online contact information collected from
the child, the purposes for which it is to be used, and an opportunity for the
parent to request that the operator make no further use of the information and
that it not be maintained in retrievable form; or
(ii) without notice to the parent
in such circumstances as the Commission may determine are appropriate, taking
into consideration the benefits to the child of access to information and services,
and risks to the security and privacy of the child, in regulations promulgated
under this subsection;
(D) the name of the child and online
contact information (to the extent reasonably necessary to protect the safety
of a child participant on the site)—
(i) used only for the purpose of
protecting such safety;
(ii) not used to recontact the child
or for any other purpose; and
(iii) not disclosed on the site,
if the operator uses reasonable efforts to provide a parent notice of the name
and online contact information collected from the child, the purposes for which
it is to be used, and an opportunity for the parent to request that the operator
make no further use of the information and that it not be maintained in retrievable
form; or
(E) the collection, use, or dissemination
of such information by the operator of such a website or online service necessary—
(i) to protect the security or integrity
of its website;
(ii) to take precautions against
liability;
(iii) to respond to judicial process;
or
(iv) to the extent permitted under
other provisions of law, to provide information to law enforcement agencies
or for an investigation on a matter related to public safety. 1815
(3) TERMINATION OF SERVICE.—The
regulations shall permit the operator of a website or an online service to terminate
service provided to a child whose parent has refused, under the regulations
prescribed under paragraph (1)(B)(ii), to permit the operator's further use
or maintenance in retrievable form, or future online collection, of personal
information from that child.
(c) ENFORCEMENT.—Subject to
sections 1304 and 1306, a violation of a regulation prescribed under subsection
(a) shall be treated as a violation of a rule defining an unfair or deceptive
act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission
Act (15 U.S.C. 57a(a)(1)(B)).
(d) INCONSISTENT STATE LAW.—No
State or local government may impose any liability for commercial activities
or actions by operators in interstate or foreign commerce in connection with
an activity or action described in this title that is inconsistent with the
treatment of those activities or actions under this section.
SEC. 1304. SAFE HARBORS.
(a) GUIDELINES.—An operator
may satisfy the requirements of regulations issued under section 1303(b) by
following a set of self-regulatory guidelines, issued by representatives of
the marketing or online industries, or by other persons, approved under subsection
(b).
(b) INCENTIVES.—
(1) SELF-REGULATORY INCENTIVES.—In
prescribing regulations under section 1303, the Commission shall provide incentives
for self-regulation by operators to implement the protections afforded children
under the regulatory requirements described in subsection (b) of that section.
(2) DEEMED COMPLIANCE.—Such
incentives shall include provisions for ensuring that a person will be deemed
to be in compliance with the requirements of the regulations under section 1303
if that person complies with guidelines that, after notice and comment, are
approved by the Commission upon making a determination that the guidelines meet
the requirements of the regulations issued under section 1303.
(3) EXPEDITED RESPONSE TO REQUESTS.—The
Commission shall act upon requests for safe harbor treatment within 180 days
of the filing of the request, and shall set forth in writing its conclusions
with regard to such requests.
(c) APPEALS.—Final action by
the Commission on a request for approval of guidelines, or the failure to act
within 180 days on a request for approval of guidelines, submitted under subsection
(b) may be appealed to a district court of the United States of appropriate
jurisdiction as provided for in section 706 of title 5, United States Code.
SEC. 1305. ACTIONS BY STATES.
(a) IN GENERAL.—
(1) CIVIL ACTIONS.—In any case
in which the attorney general of a State has reason to believe that an interest
of the residents of that State has been or is threatened or adversely affected
by the engagement of any person in a practice that violates any regulation of
the Commission prescribed under section 1303(b), the State, as parens patriae,
may bring a civil action on behalf of the residents of the State in a district
court of the United States of appropriate jurisdiction to—
(A) enjoin that practice;
(B) enforce compliance with the regulation;
(C) obtain damage, restitution, or
other compensation on behalf of residents of the State; or
(D) obtain such other relief as the
court may consider to be appropriate.
(2) NOTICE.—
(A) IN GENERAL.—Before filing
an action under paragraph (1), the attorney general of the State involved shall
provide to the Commission—
(i) written notice of that action;
and
(ii) a copy of the complaint for
that action.
(B) EXEMPTION.—
(i) IN GENERAL.—Subparagraph
(A) shall not apply with respect to the filing of an action by an attorney general
of a State under this subsection, if the attorney general determines that it
is not feasible to provide the notice described in that subparagraph before
the filing of the action.
(ii) NOTIFICATION.—In an action
described in clause (i), the attorney general of a State shall provide notice
and a copy of the complaint to the Commission at the same time as the attorney
general files the action.
(b) INTERVENTION.—
(1) IN GENERAL.—On receiving
notice under subsection (a)(2), the Commission shall have the right to intervene
in the action that is the subject of the notice.
(2) EFFECT OF INTERVENTION.—If
the Commission intervenes in an action under subsection (a), it shall have the
right—
(A) to be heard with respect to any
matter that arises in that action; and
(B) to file a petition for appeal.
(3) AMICUS CURIAE.—Upon application
to the court, a person whose self-regulatory guidelines have been approved by
the Commission and are relied upon as a defense by any defendant to a proceeding
under this section may file amicus curiae in that proceeding.
(c) CONSTRUCTION.—For purposes
of bringing any civil action under subsection (a), nothing in this title shall
be construed to prevent an attorney general of a State from exercising the powers
conferred on the attorney general by the laws of that State to—
(1) conduct investigations;
(2) administer oaths or affirmations;
or
(3) compel the attendance of witnesses
or the production of documentary and other evidence.
(d) ACTIONS BY THE COMMISSION.—In
any case in which an action is instituted by or on behalf of the Commission
for violation of any regulation prescribed under section 1303, no State may,
during the pendency of that action, institute an action under subsection (a)
against any defendant named in the complaint in that action for violation of
that regulation.
(e) VENUE; SERVICE OF PROCESS.—
(1) VENUE.—Any action brought
under subsection (a) may be brought in the district court of the United States
that meets applicable requirements relating to venue under section 1391 of title
28, United States Code.
(2) SERVICE OF PROCESS.—In an
action brought under subsection (a), process may be served in any district in
which the defendant—
(A) is an inhabitant; or
(B) may be found.
SEC. 1306. ADMINISTRATION AND
APPLICABILITY OF ACT.
(a) IN GENERAL.—Except as otherwise
provided, this title shall be enforced by the Commission under the Federal Trade
Commission Act (15 U.S.C. 41 et seq.).
(b) PROVISIONS.—Compliance with
the requirements imposed under this title shall be enforced under—(1) section
8 of the Federal Deposit Insurance Act (12 U.S.C. 1818), in the case of—
(A) national banks, and Federal branches
and Federal agencies of foreign banks, by the Office of the Comptroller of the
Currency;
(B) member banks of the Federal Reserve
System (other than national banks), branches and agencies of foreign banks (other
than Federal branches, Federal agencies, and insured State branches of foreign
banks), commercial lending companies owned or controlled by foreign banks, and
organizations operating under section 25 or 25(a) of the Federal Reserve Act
(12 U.S.C. 601 et seq. and 611 et seq.), by the Board; and
(C) banks insured by the Federal
Deposit Insurance Corporation (other than members of the Federal Reserve System)
and insured State branches of foreign banks, by the Board of Direc- tors of
the Federal Deposit Insurance Corporation;
(2) section 8 of the Federal Deposit
Insurance Act (12 U.S.C. 1818), by the Director of the Office of Thrift Supervision,
in the case of a savings association the deposits of which are insured by the
Federal Deposit Insurance Corporation;
(3) the Federal Credit Union Act
(12 U.S.C. 1751 et seq.) by the National Credit Union Administration Board with
respect to any Federal credit union;
(4) part A of subtitle VII of title
49, United States Code, by the Secretary of Transportation with respect to any
air carrier or foreign air carrier subject to that part;
(5) the Packers and Stockyards Act,
1921 (7 U.S.C. 181 et seq.) (except as provided in section 406 of that Act (7
U.S.C. 226, 227)), by the Secretary of Agriculture with respect to any activities
subject to that Act; and
(6) the Farm Credit Act of 1971 (12
U.S.C. 2001 et seq.) by the Farm Credit Administration with respect to any Federal
land bank, Federal land bank association, Federal intermediate credit bank,
or production credit association.
(c) EXERCISE OF CERTAIN POWERS.—For
the purpose of the exercise by any agency referred to in subsection (a) of its
powers under any Act referred to in that subsection, a violation of any requirement
imposed under this title shall be deemed to be a violation of a requirement
imposed under that Act. In addition to its powers under any provision of law
specifically referred to in subsection (a), each of the agencies referred to
in that subsection may exercise, for the purpose of enforcing compliance with
any requirement imposed under this title, any other authority conferred on it
by law.
(d) ACTIONS BY THE COMMISSION.—The
Commission shall prevent any person from violating a rule of the Commission
under section 1303 in the same manner, by the same means, and with the same
jurisdiction, powers, and duties as though all applicable terms and provisions
of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated
into and made a part of this title. Any entity that violates such rule shall
be subject to the penalties and entitled to the privileges and immunities provided
in the Federal Trade Commission Act in the same manner, by the same means, and
with the same jurisdiction, power, and duties as though all applicable terms
and provisions of the Federal Trade Commission Act were incorporated into and
made a part of this title.
(e) EFFECT ON OTHER LAWS.—Nothing
contained in the Act shall be construed to limit the authority of the Commission
under any other provisions of law.
SEC. 1307. REVIEW.
Not later than 5 years after the
effective date of the regulations initially issued under section 1303, the Commission
shall—
(1) review the implementation of
this title, including the effect of the implementation of this title on practices
relating to the collection and disclosure of information relating to children,
children's ability to obtain access to information of their choice online, and
on the availability of websites directed to children; and
(2) prepare and submit to Congress
a report on the results of the review under paragraph (1).
SEC. 1308. EFFECTIVE DATE.
Sections 1303(a), 1305, and 1306 of this title take effect on the later of—
(1) the date that is 18 months after
the date of enactment of this Act; or
(2) the date on which the Commission
rules on the first application filed for safe harbor treatment under section
1304 if the Commission does not rule on the first such application within one
year after the date of enactment of this Act, but in no case later than the
date that is 30 months after the date of enactment of this Act.
Source: The Federal Trade Commission
Email this article
Printer friendly page