COPPA complaint targets preteen referrals

Correction: The story initially stated that Samet Privacy has a business relationship with Cartoon Network. While Cartoon Network is part of the kidSAFE Seal Program, it does not have a business relationship with Samet Privacy.

Five major brands were the subject of a Federal Trade Commission (FTC) complaint filed August 22 by a group of 17 advocacy organizations. Led by the Center for Digital Democracy (CDD), the complaints allege that McDonald’s, General Mills, Subway, Viacom’s, and Turner’s Cartoon Network violate the Children’s Online Privacy Protection Act (COPPA) and the FTC’s COPPA enforcement rule.

The complaints, available on the CDD’s website, focus primarily on youth-oriented brand websites that provide opportunities for visitors to email messages to friends—in short, viral marketing for the preteen set.

At issue is the question of whether the refer-a-friend features run afoul of COPPA’s stringent rules against the collection of data from or about preteens without parental consent and the delivery of unsolicited messages. Section 312.5c of the FTC’s Children’s Online Privacy Protection Rule spells out situations in which prior parental consent is not necessary to collect and deliver messages, and mentions a “one-time basis” on which certain specific requests may be acted upon provided that no information is stored and there is only one contact attempt made.

The FTC has provided further guidance that spells out situations in which “electronic post cards” may be sent without prior parental consent, but the complaints charge that the sites have crossed the boundaries established by COPPA by creating opportunities for children to provide contact information about each other to the brand.

In a statement, McDonald’s was circumspect: “McDonald’s makes every effort to be in compliance with all government regulations. Rest assured we take these matters seriously and are currently examining the complaint to better understand the allegations.”

General Mills, however, directly refuted the assertions made in the complaint. “COPPA permits ‘send to a friend’ emails, provided the sending friend’s email address or full name is never collected and the recipient’s email address is deleted following the sending of the message. The FTC has published a specific FAQ on this point,” said spokesperson Tom Forsythe in a statement, referring to “FAQ 44.” “General Mills follows that COPPA-approved procedure.”

FAQ 44 is an FTC document that explains the “electronic post card” exception. The coalition’s position is that the FTC document is flawed and the statute and enforcement rule should prohibit these youth-oriented viral marketing tactics.

“FAQ 44 is non-binding guidance, and we actually think the FAQ is misleading and should be either rescinded or amended to comply with what the rule says,” says Laura Moy, staff attorney at the Institute for Public Representation, which prepared the complaint. “These companies are not in compliance with the guidance, and even if they were we don’t think it [the guidance] is accurate.”

Whether or not the FTC takes action based on today’s complaints, the situation shines a brighter spotlight on the ongoing process of reviewing and revising COPPA enforcement rules, which have been on the books since the late 1990s.

The FTC is examining proposals to: apply restrictions to mobile data, including location information; impose new restrictions on images of preteen children even in the absence of identifying data; and revise language to reflect social networks, which did not exist when the statute and rule were first drafted.

“Companies should be looking closely at the proposed changes to the COPPA rule and how that’s going to affect marketing and advertising practices going forward. Now is the time to speak up and comment to the FTC,” says Shai Samet, founder and president of the kidSAFE Seal Program, as well as the consultancy practice Samet Privacy.

The FTC’s supplemental comment period for COPPA rule changes ends on September 10. Over the next three weeks, brands may need to do a great deal of self-evaluation over data collection and marketing practices that have even a remote chance of reaching a youth audience.

Related Posts