Violating children’s on-line privacy results in $185,000 fines

Mrs. Fields will pay civil penalties of $100,000 and Hershey will pay civil penalties of $85,000. The separate settlements bar the companies from violating the Rule in the future and represent the biggest COPPA penalties awarded to date.

"These settlements offer food for thought for anyone who operates a web site that caters to kids," said Howard Beales, Director of the FTC's Bureau of Consumer Protection. "If your web site collects personal information from children, comply with the law or face the consequences."

The COPPA Rule applies to operators of commercial web sites and on-line services directed to children under the age of 13 and to general audience web sites and on-line services that knowingly collect personal information from children under 13. Among other things, the Rule requires that web site operators obtain verifiable consent from a parent or guardian before they collect personal information from children.

According to the FTC complaints, the Mrs. Fields and Hershey sites each violated the COPPA Rule when they failed to obtain verifiable parental consent before collecting personal information from children under 13.

In addition, the sites allegedly failed to post adequate privacy policies, to provide direct notice to parents about the information they were collecting and how it would be used, and to provide a reasonable means for parents to review the personal information collected from their children and to refuse to permit its further use.

Mrs. Fields Cookies

According to the FTC, portions of Mrs. Fields' web sites mrsfields.com, pretzeltime.com, and pretzelmaker.com were directed to children.

These web pages offered birthday clubs for children of 12 years or under and provided birthday greetings and coupons for free cookies or pretzels.

While Mrs. Fields did not disseminate the information it collected to third parties, the company allegedly collected personal information including full name, home address, e-mail address and birth date from more than 84,000 children, without first obtaining parental consent.

Hershey Foods Corporation

Hershey operates more than 30 Web sites - many of which are confectionery-related sites directed to children. On a number of these sites, the company allegedly employed a method of obtaining parental consent that does not meet the standard delineated under the COPPA Rule.

Specifically, Hershey instructed children under 13 to have their parents fill in an on-line parental consent form.

The FTC alleges the company took no steps to ensure that a parent or guardian saw or filled out the consent forms. The FTC further alleges that even if a parent or guardian did not submit information on the consent form, the company proceeded to collect personal information - including full name, home address, e-mail address and age - from children.

According to the complaint, this method of obtaining parental consent was not reasonably calculated to ensure that the person providing consent was the child's parent. This is the first COPPA case to challenge a company's method of obtaining parental consent.

Perhaps most significantly for the companies, the settlements require that the companies delete any information collected in violation of COPPA – effectively, the companies' marketing databases. They also bar future COPPA violations, require the civil penalty payments, and contain certain record-keeping requirements to allow the FTC to monitor the companies' compliance with the order.

The consent decrees by which the cases were settled means that there is no actual admission by the defendants of a law violation. However, consent decrees have the force of law when signed by the judge.