In October 2001, FTC Chairman Timothy J. Muris announced that the Federal Trade Commission would increase the resources the Commission devotes to enforcing privacy laws such as the Children’s Online Privacy Protection Act by 50%. That effort produced its most dramatic results in February in two high profile cases that the FTC clearly intended as a lesson for online retailers and other marketers.
In February, the FTC announced a settlement with Hershey Foods Corp. over alleged violations of the Children’s Online Privacy Protection Act. The FTC alleged that Hershey did not take steps required by law to obtain parental consent from children who entered online sweepstakes. Hershey agreed to an $85,000 civil penalty. On the same day, the FTC announced that Mrs. Fields Original Cookies Inc. had agreed to a $100,000 penalty for allegedly failing to adequately disclose its privacy practices or obtain parental consent for children who submitted information online.
As part of its enforcement strategy, the FTC has sought higher civil penalties in recent cases. Although a settlement with the FTC is not an admission of wrongdoing, the Hershey and Mrs. Fields cases represent the largest civil penalties for alleged COPPA violations to date. This establishes a precedent that companies who market to children need to keep at the front of their minds as they create online promotions.
Further, the FTC isn’t the only organization monitoring online sweepstakes. The Children’s Advertising Review Unit of the Council of Better Business Bureaus regularly reviews promotions to ensure that companies comply with COPPA as well as with CARU’s Self-Regulatory Guidelines for Children’s Advertising. Over the past year, the Children’s Advertising Review Unit has challenged sweepstakes sponsored by a number of companies, including General Mills Inc., Microsoft Corp., and the Wm. Wrigley Jr. Co. These challenges from CARU and the FTC demonstrate that promotions directed to children are being watched closely by regulators and self-regulatory bodies.
According to the FTC’s complaint against Hershey, Hershey informed children under 13 that they had to obtain parental consent before entering an online sweepstakes. Hershey’s web sites included an online parental consent form. Once the consent form was submitted, an entry form would pop up on which the child was required to provide personal information. The FTC argued that this method of obtaining parental consent was not “reasonably calculated” to ensure the person providing consent was actually the child’s parent because a child could have easily completed the form.
The majority of the FTC and CARU challenges to sweepstakes involve one of three themes. Sponsors of online sweepstakes need to:
- ensure that their ads are appropriate to children;
- establish effective mechanisms to screen children;
- follow the correct procedures for obtaining parental consent.
Advertisers should take into account the level of knowledge and maturity of the audience. CARU Guidelines state all prizes should be clearly depicted and suitable for the children eligible to enter the sweepstakes. Terms of the promotion should also be expressed in clear, simple language to increase the likelihood that children will understand them. For example, many states require sponsors to disclose the odds of winning. Most children will not understand the phrase “Odds of winning depend on the number of eligible entries received,” however. Instead, the sponsor should use language such as “Many will enter, but only a few will win.”
If a sponsor plans to collect information on a web site directed at children, it must establish a mechanism to identify which are under 13. Although COPPA does not specify how children must be screened, CARU’s Guidelines provide that sponsors take care that “screening questions are asked in a neutral manner so as not to encourage children to provide inaccurate information to avoid obtaining parental consent.” For example, rather than asking entrants to indicate whether they are older or younger than 13, the sponsor can ask entrants to enter their dates of birth. Sponsors should also employ an effective tracking mechanism, such as a session or timed cookie to prevent underage users from changing their ages and entering without parental consent.
COPPA generally requires companies to provide notice of their privacy practices to parents and obtain verifiable consent from parents before collecting personal information from children under 13. The FTC has adopted a sliding-scale approach to obtaining verifiable parental consent. If a company will use personal information only for internal purposes, it may obtain consent by sending parents an e-mail and taking additional steps to ensure that a parent is the person providing consent. For example, the company may send a confirmation e-mail or follow up with a phone call. If a company plans to share the information with third parties, it must employ a more rigorous method of obtaining consent. For example, the company may require a parent to sign a form, provide a credit card number, or speak to a trained telephone operator.
Obtaining verifiable parental consent from each child who enters a sweepstakes could be burdensome. Fortunately, COPPA contains five exceptions, one of which allows a web site operator to collect “online contact information from a child to be used to respond directly more than once to a specific request from a child [as long as] such information is not used for any other purpose.” The FTC has stated that, under this exception, a company can collect a child’s e-mail address in order to provide the child with “a contest entry and subsequent award.”