UMG Recordings, which operates several hundred music-related web
sites, will pay civil penalties of $400,000, the largest civil
penalty to date for a COPPA violation.
Bonzi Software, distributor of the BonziBUDDY internet surfing
software, will pay civil penalties of $75,000. The Bonzi Software
case is the first COPPA case to challenge the information
collection practices of an on-line service in connection with a
software product. Previous FTC COPPA cases have addressed web site
operators' information collection practices.
The FTC COPPA Rule applies to operators of commercial web sites
and on-line services directed to children under the age of 13 and
to general audience web sites and on-line services that have actual
knowledge that they are collecting personal information from
children under the age of 13.
Among other things, the Rule requires that these web site
operators post privacy policies, provide parental notice, and
obtain verifiable consent from a parent or guardian before
collecting personal information from children.
According to the FTC complaints, UMG and Bonzi each violated the
COPPA Rule when they failed to obtain verifiable parental consent
before collecting extensive personal information from children
under the age of 13.
The companies each collected birth date information through
their on-line registration processes, and thus had actual knowledge
that they were collecting and maintaining personal information from
thousands of children under the age of 13.
In addition, the complaints allege that the two companies failed
to post clear and complete privacy notices or to provide adequate
direct notices to parents of what personal information they sought
to collect from children.
The case against UMG
Recordings
According to the FTC, UMG Recordings operates hundreds of
general audience web sites that advertise and promote its numerous
music labels and recording artists, many of whom are popular with
children.
UMG's web sites offer e-mail newsletters and updates, fan clubs,
and bulletin boards. The complaint charges that UMG's web site
registration forms collected extensive personal information
including full name, birth date, e-mail address, home address,
phone number, gender, and other information such as visitors'
preferences in music, sports, and apparel.
The complaint also alleges that UMG gained actual knowledge that
a child was registering on the site whenever a child entered a
birth date indicating he was under the age of 13, but did not
notify parents or obtain verifiable parental consent.
In some instances, UMG sent notices to parents after collecting
their children's personal information, but they were sent after the
collection of personal information and, says the FTC, were
deficient in other respects.
The complaint also alleges that, in some instances, UMG used the
children's personal information to e-mail them marketing materials
on other musicians and web sites.
The case against Bonzi
Software
Bonzi Software markets software products including the
BonziBUDDY, a free downloadable software that displays an
interactive, animated purple gorilla on users' computers. The
BonziBUDDY interacts with users while they are on-line, providing
shopping advice, jokes, and trivia and makes money by delivering
targeted adverts.
The BonziBUDDY on-line registration form requires users to
provide a birth date and several other types of personal
information. Like UMG, Bonzi Software had actual knowledge, as a
result of collecting birth date information, that thousands of
children were registering for BonziBUDDY but, according to the FTC
complaint, failed to notify parents or obtain verifiable parental
consent.
The complaint also alleges that Bonzi Software failed to post a
clear and complete privacy notice for its on-line service or to
provide a reasonable means for parents to review the personal
information collected from their children.
The settlements prohibit future COPPA violations, require that
the companies delete any information collected in violation of
COPPA, require civil penalty payments of $400,000 and $75,000,
respectively, and contain certain record-keeping requirements to
allow the FTC to monitor the companies' compliance with the
orders.
In conjunction with the announcement of these two cases, the FTC
has released a Business Alert reminding web site owners of the
requirements of the actual knowledge standard.
