The children’s market is clearly emerging as a powerful demographic segment for marketers to target. While, historically, children have not been in a position to control purchasing decisions, this segment of the population is emerging as a sophisticated and powerful audience that is becoming increasingly attractive to marketers. Indeed, many established brand-name marketers, which traditionally appealed to the adult market, have begun developing products targeted specifically at the younger generation in hopes of building a younger, loyal customer base with whom the marketers can develop a long-term relationship.

While advertising and promotional campaigns targeted to children present exciting and challenging opportunities for marketers, these efforts must be carefully designed to avoid running afoul of the various rules and regulations designed to protect the young audience. Both the Federal Trade Commission and the Children’s Advertising Review Unit of the Better Business Bureau (CARU) have been active and aggressive in their efforts to protect children from misleading or deceptive advertising practices. Both agencies view children as a naïve group of consumers deserving of greater protection than might otherwise be required when targeting an adult audience. Marketing campaigns targeted to children will necessarily be subject to greater scrutiny by both organizations.

Any marketer who operates a Web site directed to children must, at the very least, be familiar with and comply with the requirements of the Children’s Online Privacy Protection Act of 1998 (COPPA). COPPA regulates the collection of personal or personally identifiable information online from children under the age of 13, and it requires verifiable parental consent prior to the collection of such information.

The Act also imposes additional obligations. For example, it requires the site operator to include certain specific disclosures in its privacy policy regarding the treatment of children’s personal information. It prohibits the operator from conditioning a user’s participation in an online activity on the disclosure of more personal information than is reasonably necessary to participate. It requires the operator to provide a means for parents to review and refuse further use of their children’s personal information. And it requires the site operator to take steps to protect the security and confidentiality of the collected personal information.

While the COPPA Rule ostensibly applies to Web sites directed to children under the age of 13, the FTC has interpreted the scope of the Rule far more broadly. Specifically, the FTC has determined that the Rule applies to children’s sites, children’s areas of general audience sites and sites that knowingly collect information from children under 13. The FTC treats each of these types of sites differently. On children’s sites or on children’s areas of general audience sites, site operators must treat everyone as if they are 13 or younger, and obtain the requisite verifiable parental consent prior to collecting any personal information online. On teen sites and on general audience sites, age screening is recommended. The user’s birth date should be requested in a neutral manner so as not to encourage the use of fake ages. In other words, the user should be asked to input their birth-dates rather than to indicate whether they are “under 13” or “over 13.” In addition, in the event that a user enters a birth-date that indicates the user is under the age of 13, the operator should drop a session or timed cookie to prevent that user from simply clicking the back key to change the birth-date that was originally entered. On children’s sites or on children’s areas of general audience sites, the age screening must be conducted prior to asking for any personal information.

By comparison, on teen sites and on general audience sites, age screening can take place as part of the online collection of personal information. However, if the information collected indicates that the user is under the age of 13, the information collected regarding that user should be automatically and immediately deleted.

I’ll tell mom!

Once it is determined that a user is under the age of 13, the Web site operator must obtain verifiable parental consent to collect personal information online. The FTC has approved specific mechanisms to reasonably ensure that the parent receives the required notice and consents to the Web site’s information collection, use and disclosure practices. These include: a consent form signed by a parent or guardian and returned by regular mail or fax; a toll-free telephone number staffed by trained personnel; a parent’s credit card number in connection with a transaction; and the use of a PIN or password. There are a few statutory exceptions to this rule.

Within the last two years, the FTC has been aggressive in its enforcement of COPPA rules and has extracted substantial penalties (ranging from $35,000 to $100,000) from companies alleged to have engaged in violations. Since the inception of COPPA, the FTC has brought approximately eight enforcement actions against various companies, including a number of established brand-name marketers.

Regrettably, it appears that many of the alleged violations that gave rise to the FTC actions resulted from inadvertent errors by the marketers involved. Unfortunately, when it comes to COPPA, good faith and good intentions do not provide an adequate defense.

Marketers must establish procedures designed to assure strict compliance with the requirements of COPPA, and marketers should monitor the procedures they have in place to ensure their effectiveness. Many companies have responded to the COPPA challenge by hiring dedicated “Privacy Officers” charged with the responsibility of ensuring compliance, not only with the requirements of COPPA, but with the broader range of privacy policies and requirements. Any marketer engaged in the collection and/or use of personal identifiable information should implement a comprehensive privacy compliance policy, which may include oversight by a dedicated privacy officer.

In addition to the specific requirements of COPPA, marketers of products and services to children should also be mindful of the fact that the FTC and other state and federal regulatory officials tend to view children as a particularly vulnerable and suspect audience. Accordingly, marketers should avoid ambiguity in copy claims or offer presentations, and, to the extent that any promotional incentives are involved, the full terms of the offer should be clearly and conspicuously disclosed in a manner and in a language that is readily understandable to children.

In this regard, marketers of products and services targeted to children must be mindful not only of the FTC’s requirements, but of the even more specific rules and regulations of the Children’s Advertising Review Unit of the Better Business Bureau (CARU). CARU has provided Self-Regulatory Guidelines regarding children’s advertising and marketing for over a quarter of a century. Although CARU guidelines do not have the force of law, non-compliant companies risk being the subject of a negative published Case Report and, in more egregious situations, referral to the FTC.

In addition to the general guidelines designed to ensure that advertising directed to children is not misleading or deceptive, CARU has very specific guidelines for promotional incentives and sweepstakes geared to children. These are premised upon CARU’s fundamental belief that children are more vulnerable and that, accordingly, the terms of any promotional offer must be clearly explained in a manner which children are likely to understand and comprehend. It is clear that the CARU guidelines set a higher standard for children’s advertising than advertising targeted to the general audience.

One of the areas in which CARU has been particularly aggressive in recent years is sweepstakes. For example, it requires specific disclosure for sweepstakes directed toward children. Prior to a child entering a sweepstakes, the advertiser must clearly depict the prizes, clearly disclose the number of prizes or odds of winning, disclose any alternate method of entry, and not misrepresent the odds of winning. In recent months, CARU has interpreted this guideline to require very specific disclosure in ad copy, clearly informing children that their odds of wining are quite low. In particular, CARU has suggested that the marketer employ language such as “many will enter, few will win,” or similar language designed to clearly communicate to the child the likelihood that they will not be a winner. In sweepstakes directed to children involving multiple prizes, CARU has also required that the advertiser disclose clearly that only one of the grand prizes featured will be awarded, so that the child understands that the likelihood of winning that prize is slim.

In short, CARU has been extremely conservative in its interpretation of its sweepstakes guidelines and has required marketers to go to great lengths to make sure that every potential entrant understands that his or her chances of wining are remote.

Consistent with its paternalistic approach to advertising, CARU has also taken a rather conservative approach to COPPA. For example, COPPA permits a Web site to obtain verifiable parental consent to collect personal information to be used solely for internal purposes via e-mail, as long as a follow-up email, telephone call or letter is sent to the parent. This method is often referred to as the “e-mail-plus” verifiable parental consent mechanism. Despite the legality of email-plus and the FTC’s acceptance of this method, CARU has taken the position that e-mail plus is not a reasonable method to obtain verifiable parental consent. As a result, CARU could determine that a COPPA compliant Web site that uses e-mail-plus is not in compliance with its Interactive Electronic Media Guidelines.

Can a marketer be too cautious? Probably not. While the children’s market presents new and exciting marketing opportunities, marketers must recognize and appreciate that their efforts are likely to be subject to increased scrutiny as a result of the perceived vulnerability of the child audience. Therefore, while marketers should not shy away from the tremendous opportunities this target audience presents, they must take care to ensure that their advertising and marketing campaigns comply with the specific rules and regulations designed to protect this segment of the population.

Linda A. Goldstein is a partner-in-charge of the advertising, marketing and media department for law firm Hall Dickler Kent Goldstein & Wood, New York City. She is also the co-chair of the Government and Legal Affairs Committee of the Promotion Marketing Association, and chairman of the board of the Electronic Retailing Association.

Following the Rules

Once a marketer realizes that a user is under the age of 13, it must obtain verifiable parental consent to collect personal information online. Personal information includes:

• first name
• last name
• physical address
• e-mail address
• telephone number
• social security number

Personal information also includes any otherwise non-personal information that is combined with personal information. For example, if a Web site operator collects Jane Doe’s first and last name and the fact that her favorite color is green, the color green must now be treated as personal information.

Marketers targeting kids online have until April 21, 2000, to set up parental consent procedures under the Children’s Online Privacy Protection Act that became law in October ’98.

The Protection Act requires Web sites and online services that target kids and collect personal information from children under 13 – name, home or e-mail address, phone number, Social Security number – to provide notice on the site about what info is collected and how it is used and shared with other marketers. More importantly for marketers, the Act requires site operators to get verifiable parental consent before collecting data from kids.

The Federal Trade Commission will enforce the law. It has until Oct. 21 to finish a rulemaking process that interprets what the new law will require of marketers. Hall Dickler Kent Friedman & Wood, a New York City-based law firm, suggests that online marketers consider submitting comments to the FTC. The firm also recommends that sites targeting kids under 13 “adopt policies and procedures to ensure that parents are provided with adequate notice of and control over the information their children submit to the site. More importantly, sites should have some form of parental consent mechanism in place even before official regulations are instituted.”

“If a marketer is doing an online sweepstakes for kids and asks for an entry form, that will trigger this restriction,” says Linda Goldstein, chair of Hall Dickler’s advertising, marketing, and promotion department.

The law defines “verifiable parental consent” as any reasonable effort to notify parents of a site’s data collection and use and get their approval before collecting information. The law doesn’t define “reasonable effort,” but the FTC gave a few examples in its report to Congress, according to Hall Dickler. A site could have a consent form kids must print out and have their parents sign before giving personal information. Or it could provide a toll-free number for parents to call and give consent. (Callers would supply a credit card number or answer certain questions to prove they’re the parents.)

“While these measures have not been officially endorsed or approved by the FTC, they do provide some insight on the FTC’s thinking at this point,” Hall Dickler comments.

There are some exemptions. Marketers don’t need parental consent if they only use a child’s data once to respond to the child or to contact parents. After they respond to a child, marketers must make reasonable efforts to notify parents of the info it has, and allow parents to “opt out” – have the information erased from the files.