Well, to Sony BMG Entertainment group, the answer was recently “about $ 33.00”.  That’s the amount per child Sony paid in settling a civil action brough by the US government for violations of the Children’s Online Privacy Protection Act (COPPA), a federal law enacted in 1998 and implemented by the FTC in 2000.

While the financial portion of the settlement — $ 1 million — may not be much to Sony BMG Entertainment, it should serve as a warning to smaller companies with a kid-friendly web presence that they need to learn about and abide by COPPA.  Any broadcast television or radio station that dedicates a portion of its website to children’s programming, a “Kid’s Club” or “Birthday Club”, etc., or otherwise directs content to or collects information from children under the age of 13 should definitely read further.

Under COPPA, the FTC has the power to ensure that personal information relating to children under the age of 13 is not collected or distributed without parental consent.

The law applies to your website if

  • You operate a commercial website or online service directed to children under the age of 13. This would include any page within a website of general operation that is specifically directed to children under the age of 13, such as a page within the website for kids.

  • You run a general commercial website or online service and have actual knowledge that you are collecting personally identifying information from children under the age of 13.    Actual knowledge is defined as “asking for and receiving information from which the age of the user can be determined to be under the age of 13.” The most obvious situation would be where the website, in the course of collecting information from a user, asks for the user’s age or date of birth.

“Personally identifying information” includes:

  • First and last name
  • Home or other physical address, including street name and name of a city
  • E-mail address
  • Social Security number
  • Any other information that could specifically identify the child

The easiest way to avoid triggering COPPA is simply not to collect personally identifying information from children under the age of 13. A website that falls into either category listed above must comply in six different ways.

  1. The website must post a clear and comprehensive privacy policy on the website describing how it collects and protects personally identifying information obtained from children.
  2. The website must (a) provide direct notice to parents of the intended collection of personally identifying information and (b) obtain verifiable parental consent before collecting that information (in other words, once you have identified that you are about to collect personally identifying information about a child, you must stop the collection process until you have a parent’s consent to move forward).
  3. The website must offer the parent the choice of consenting to the collection and use of the information – it cannot force the parent to comply – and must also allow the parent to prohibit the website operator from sharing that information to third parties.
  4. The website must allow a parent to access his or her child’s personally identifying information at any time in order to review the information that the website has collected from that child.
  5. The website must give parents the opportunity to opt-out of further use or collection of a child’s information at any time.
  6. The website must take steps to maintain the confidentiality, security and information of the information it collects from children under the age of thirteen.

Sony BMG Entertainment failed to follow these requirements in many significant ways, leading to the filing of a civil lawsuit by the federal government that ended in a consent decree  which, in addition to imposing the $1 million forfeiture, requires significant changes to Sony BMG Entertainment websites and  the company’s general operating policies (including educational outreach about children’s privacy for the next five years). Specifically, Sony BMG Entertainment, on more than 1,000 of its websites, enticed over 30,000 children to sign up for various fan clubs and then distributed the information without parental consent to others by signing the children up for contests and sweepstakes. So the $1 million price tag, spread over 30,000 kids, comes to about $33.00 per child.

We suspect that many of you broadcasters allow children to sign up for various contests or promotions through your sites.  You may even share this information with other stations or affiliated companies.  STOP!!!  The message should be clear: either study up on and comply with COPPA (we can help with this) or don’t collect any personally identifying information from your younger viewers or listeners . . . or be prepared to face expensive litigation.