Companies collecting data from children should take note of a recent settlement between Xanga.com and the FTC. Xanga.com is one of the most popular social networking sites on the Internet. It enables users to post information about themselves for other users to read and respond to and allows users to create their own pages or blogs that contain profile information, online journals, videos, etc. Thus, a user could go onto Xanga.com, register, and set up a web page or blog accessible by others.

The FTC alleged that Xanga.com’s practices violated COPPA and the COPPA Rule. Congress enacted COPPA in 1998 to protect the safety and privacy of children on the Internet. COPPA directed the FTC to promulgate a rule implementing COPPA, and in response, the FTC promulgated the COPPA Rule. The COPPA Rule requires a subject web site operator to meet specific requirements prior to collecting online, using or disclosing personal information from children. This includes (1) posting a clear privacy policy describing the information that it collects, and how it uses and discloses the information; (2) providing clear notice directly to parents; and (3) obtaining parent consent before collecting, using or disclosing personal information from children.

In its action against Xanga.com, the FTC alleged that Xanga.com violated these rules because it collected, used and disclosed personal information from children without first obtaining the requisite parental consent. Specifically, Xanga.com had a registration page that allowed children to enter the site and create a web page if they checked a box that stated “I am over the age of 13.” If they checked the box and agreed that they were over the age of 13, they were able to register on the site by providing personal information, including their date of birth, first and last name, gender, state and phone number. If the person entered a date of birth that showed he was under the age of 13, Xanga.com still allowed that person to create web page, upload pictures and create personal profiles. The complaint alleged 1.7 million accounts were created for people indicating that they were below the age of 13.

In addition, the FTC alleged that Xanga.com failed to notify parents directly about their information practices regarding children. The FTC also argued that Xanga.com failed to take steps to obtain verifiable parental consent from parents prior to collecting, using or disclosing their children’s personal information. Finally, the FTC alleged that Xanga.com did not provide parents with reasonable access to and control over their children’s information on the Xanga.com web site.

In settlement of these allegations, Xanga.com must pay a civil penalty of $1 million. In addition, the Consent Order between Xanga.com and the FTC contains strong conduct provisions that will be monitored by the FTC. In addition, Xanga.com must distribute to certain company personnel the Consent Order and the FTC’s How to Comply with the COPPA Rule.

Anthony V. Lupo
202.857.6353
lupo.anthony@arentfox.com

Sarah E. Bruno
202.775.5760
bruno.sarah@arentfox.com