Mrs. Fields will pay civil penalties of $100,000 and Hershey
will pay civil penalties of $85,000. The separate settlements bar
the companies from violating the Rule in the future and represent
the biggest COPPA penalties awarded to date.
"These settlements offer food for thought for anyone who
operates a web site that caters to kids," said Howard Beales,
Director of the FTC's Bureau of Consumer Protection. "If your web
site collects personal information from children, comply with the
law or face the consequences."
The COPPA Rule applies to operators of commercial web sites and
on-line services directed to children under the age of 13 and to
general audience web sites and on-line services that knowingly
collect personal information from children under 13. Among other
things, the Rule requires that web site operators obtain verifiable
consent from a parent or guardian before they collect
personal information from children.
According to the FTC complaints, the Mrs. Fields and Hershey
sites each violated the COPPA Rule when they failed to obtain
verifiable parental consent before collecting personal information
from children under 13.
In addition, the sites allegedly failed to post adequate privacy
policies, to provide direct notice to parents about the information
they were collecting and how it would be used, and to provide a
reasonable means for parents to review the personal information
collected from their children and to refuse to permit its further
use.
Mrs. Fields Cookies
According to the FTC, portions of Mrs. Fields' web sites
mrsfields.com, pretzeltime.com, and pretzelmaker.com were
directed to children.
These web pages offered birthday clubs for children of 12 years
or under and provided birthday greetings and coupons for free
cookies or pretzels.
While Mrs. Fields did not disseminate the information it
collected to third parties, the company allegedly collected
personal information including full name, home address,
e-mail address and birth date from more than 84,000
children, without first obtaining parental consent.
Hershey Foods Corporation
Hershey operates more than 30 Web sites - many of which are
confectionery-related sites directed to children. On a number of
these sites, the company allegedly employed a method of obtaining
parental consent that does not meet the standard delineated under
the COPPA Rule.
Specifically, Hershey instructed children under 13 to have their
parents fill in an on-line parental consent form.
The FTC alleges the company took no steps to ensure that a
parent or guardian saw or filled out the consent forms. The FTC
further alleges that even if a parent or guardian did not submit
information on the consent form, the company proceeded to collect
personal information - including full name, home address, e-mail
address and age - from children.
According to the complaint, this method of obtaining parental
consent was not reasonably calculated to ensure that the person
providing consent was the child's parent. This is the first COPPA
case to challenge a company's method of obtaining parental
consent.
Perhaps most significantly for the companies, the settlements
require that the companies delete any information collected in
violation of COPPA – effectively, the companies' marketing
databases. They also bar future COPPA violations, require the civil
penalty payments, and contain certain record-keeping requirements
to allow the FTC to monitor the companies' compliance with the
order.
The consent decrees by which the cases were settled means that
there is no actual admission by the defendants of a law violation.
However, consent decrees have the force of law when signed by the
judge.
