The operator of a website called Skid-e-Kids, a self-described “Facebook and MySpace for kids,” has learned that it is not enough merely to have a privacy policy that requires parental consent prior to obtaining personal information online from children under the age of 13. Such website operators must actually abide by that policy as well. The Federal Trade Commission (FTC) reinforced that lesson via an enforcement action and settlement with the company this week.

Skid-e-Kids (skidekids.com) advertises itself as “Safe, Fun and very educational.” Their target group is children ages 7-14. The Children’s Online Privacy Protection Act of 1998 (COPPA) and corresponding FTC rule require parental consent before children under the age of 13 can be requested or required to provide personal information online.

Skid-e-Kids had a Privacy Policy that “requires child users to provide a parent’s valid email address in order to register on the website.” In practice, however, that was not the case. Children were required to provide a birth date, gender, user name, password and email address prior to using the website. Once that information was provided, the child was automatically registered on the website. Worse still, Skid-e-Kids did not even request a parent’s email address and made no attempt to notify parents or obtain parental consent.

This week, Jones O. Godwin, operator of the Skid-e-Kids website, entered into a Consent Decree, agreeing to comply with COPPA and to delete personal information obtained from children without parental consent. Godwin was also required to pay a civil penalty of $100,000, all but $1,000 of which was suspended pending compliance with COPPA and the Consent Decree for the next ten years. The Consent Decree also requires Godwin to retain an independent third party to assess the site’s compliance with COPPA for the next five years.

This case acts as a reminder that posting a COPPA-compliant policy is not enough. Stations that maintain websites or web pages directed to children under age 13 must actually obtain the necessary parental consent before proceeding to collect personal information from children.

We've written about these new media privacy issues before, and our firm's Privacy and Security Blog cover these issues regularly.   This is an important area that broadcasters need to pay attention to, especially as they increase commercial activity from their websites, on mobile applications, and in other forms of digital media.  Plaintiff''s attorneys are looking for companies who do not adhere to their privacy policies or who provide personally identifiable information (known as "PII" in the privacy world) to third parties without permission.  Congress, the FTC, the FCC, and the Commerce Department have all been looking at new regulatory regimes to govern privacy in many areas - including enhanced and targeted advertising, and the use of geo-location information.  Pay attention to these development as, while the web offers many new opportunities to increase revenues, it also may well bring new legal concerns for broadcasters beyond those FCC issues with which broadcasters have so long concerned themselves.

Everyone knows that one of the great benefits of the Internet and the many services available on-line and through mobile apps, is the ability to personalize so as to provide a unique listening or viewing experience for every user. Instead of being limited to the linear programming that a broadcast service provides to all users at the same time, users can tailor their digital media experience to give them what they want and, as wireless broadband penetration increases through smart phones and other devices, almost whenever they want it. In some cases, the costs of providing an individualized service, because of bandwidth needs, royalties and license fees and for other reasons, the cost per each additional listener is often higher than that incurred by the traditional media. And online users thus far have been unwilling to tolerate the commercial advertising load that a traditional media experience might provide. To meet these higher marginal costs, and the lower spot loads, many digital media companies have looked to personalization of advertising to allow for higher advertising rates on the theory that advertising will be more efficient if you can guarantee that it will be targeted to reach its intended audience – geographical, demographic or based on expressed interests. As digital media companies have sought to refine the targeting available through their advertising, privacy issues have arisen.

At the same time, private attorneys and private parties have entered the fray, as there are already various data security and privacy statutes on the books under both Federal and state laws, filing lawsuits in various jurisdictions challenging companies, including many media companies, of misusing personally identifiable information that they have collected. Often, these suits are based on claims that the information was used in a manner not clearly disclosed in a company’s privacy policy. Thus, media companies who collect information need to be very sure that any information that is collected is used in a manner totally consistent with their policies and with any laws limiting the use of private information.

The FTC has also been involved in policing some of these very issues, and we’ll soon write about some of the recent consent decrees entered into between media companies and the FTC. As digital media becomes a more and more important portion of the revenues of every media company, and as the ability to gather personal information about individuals who use a site increases, the potential for conflicts between commercial practices and the privacy laws and policies will no doubt increase. So watch this space, and our firm’s Privacy and Security Blog, for more information about these topics, and be prepared.