UMG Recordings, which operates several hundred music-related web sites, will pay civil penalties of $400,000, the largest civil penalty to date for a COPPA violation.
Bonzi Software, distributor of the BonziBUDDY internet surfing software, will pay civil penalties of $75,000. The Bonzi Software case is the first COPPA case to challenge the information collection practices of an on-line service in connection with a software product. Previous FTC COPPA cases have addressed web site operators' information collection practices.
The FTC COPPA Rule applies to operators of commercial web sites and on-line services directed to children under the age of 13 and to general audience web sites and on-line services that have actual knowledge that they are collecting personal information from children under the age of 13.
Among other things, the Rule requires that these web site operators post privacy policies, provide parental notice, and obtain verifiable consent from a parent or guardian before collecting personal information from children.
According to the FTC complaints, UMG and Bonzi each violated the COPPA Rule when they failed to obtain verifiable parental consent before collecting extensive personal information from children under the age of 13.
The companies each collected birth date information through their on-line registration processes, and thus had actual knowledge that they were collecting and maintaining personal information from thousands of children under the age of 13.
In addition, the complaints allege that the two companies failed to post clear and complete privacy notices or to provide adequate direct notices to parents of what personal information they sought to collect from children.
The case against UMG Recordings
According to the FTC, UMG Recordings operates hundreds of general audience web sites that advertise and promote its numerous music labels and recording artists, many of whom are popular with children.
UMG's web sites offer e-mail newsletters and updates, fan clubs, and bulletin boards. The complaint charges that UMG's web site registration forms collected extensive personal information including full name, birth date, e-mail address, home address, phone number, gender, and other information such as visitors' preferences in music, sports, and apparel.
The complaint also alleges that UMG gained actual knowledge that a child was registering on the site whenever a child entered a birth date indicating he was under the age of 13, but did not notify parents or obtain verifiable parental consent.
In some instances, UMG sent notices to parents after collecting their children's personal information, but they were sent after the collection of personal information and, says the FTC, were deficient in other respects.
The complaint also alleges that, in some instances, UMG used the children's personal information to e-mail them marketing materials on other musicians and web sites.
The case against Bonzi Software
Bonzi Software markets software products including the BonziBUDDY, a free downloadable software that displays an interactive, animated purple gorilla on users' computers. The BonziBUDDY interacts with users while they are on-line, providing shopping advice, jokes, and trivia and makes money by delivering targeted adverts.
The BonziBUDDY on-line registration form requires users to provide a birth date and several other types of personal information. Like UMG, Bonzi Software had actual knowledge, as a result of collecting birth date information, that thousands of children were registering for BonziBUDDY but, according to the FTC complaint, failed to notify parents or obtain verifiable parental consent.
The complaint also alleges that Bonzi Software failed to post a clear and complete privacy notice for its on-line service or to provide a reasonable means for parents to review the personal information collected from their children.
The settlements prohibit future COPPA violations, require that the companies delete any information collected in violation of COPPA, require civil penalty payments of $400,000 and $75,000, respectively, and contain certain record-keeping requirements to allow the FTC to monitor the companies' compliance with the orders.
In conjunction with the announcement of these two cases, the FTC has released a Business Alert reminding web site owners of the requirements of the actual knowledge standard.