15 U.S.C. § 6502 — Regulation of unfair and deceptive acts

Page 2244 TITLE 15—COMMERCE AND TRADE § 6502 does not disclose or use that information for any other purpose; and (B) making personal information collected from a child by a website or online service directed to children or with actual knowl- edge that such information was collected from a child, publicly available in identifi- able form, by any means including by a pub- lic posting, through the Internet, or through— (i) a home page of a website; (ii) a pen pal service; (iii) an electronic mail service; (iv) a message board; or (v) a chat room. (5) Federal agency The term ‘‘Federal agency’’ means an agen- cy, as that term is defined in section 551(1) of title 5. (6) Internet The term ‘‘Internet’’ means collectively the myriad of computer and telecommunications facilities, including equipment and operating software, which comprise the interconnected world-wide network of networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or successor pro- tocols to such protocol, to communicate infor- mation of all kinds by wire or radio. (7) Parent The term ‘‘parent’’ includes a legal guard- ian. (8) Personal information The term ‘‘personal information’’ means in- dividually identifiable information about an individual collected online, including— (A) a first and last name; (B) a home or other physical address in- cluding street name and name of a city or town; (C) an e-mail address; (D) a telephone number; (E) a Social Security number; (F) any other identifier that the Commis- sion determines permits the physical or on- line contacting of a specific individual; or (G) information concerning the child or the parents of that child that the website collects online from the child and combines with an identifier described in this para- graph. (9) Verifiable parental consent The term ‘‘verifiable parental consent’’ means any reasonable effort (taking into con- sideration available technology), including a request for authorization for future collection, use, and disclosure described in the notice, to ensure that a parent of a child receives notice of the operator’s personal information collec- tion, use, and disclosure practices, and author- izes the collection, use, and disclosure, as ap- plicable, of personal information and the sub- sequent use of that information before that in- formation is collected from that child. (10) Website or online service directed to chil- dren (A) In general The term ‘‘website or online service di- rected to children’’ means— (i) a commercial website or online serv- ice that is targeted to children; or (ii) that portion of a commercial website or online service that is targeted to chil- dren. (B) Limitation A commercial website or online service, or a portion of a commercial website or online service, shall not be deemed directed to chil- dren solely for referring or linking to a com- mercial website or online service directed to children by using information location tools, including a directory, index, reference, pointer, or hypertext link. (11) Person The term ‘‘person’’ means any individual, partnership, corporation, trust, estate, cooper- ative, association, or other entity. (12) Online contact information The term ‘‘online contact information’’ means an e-mail address or another substan- tially similar identifier that permits direct contact with a person online. (Pub. L. 105–277, div. C, title XIII, § 1302, Oct. 21, 1998, 112 Stat. 2681–728.) Statutory Notes and Related Subsidiaries EFFECTIVE DATE Pub. L. 105–277, div. C, title XIII, § 1308, Oct. 21, 1998, 112 Stat. 2681–735, provided that: ‘‘Sections 1303(a), 1305, and 1306 of this title [enacting sections 6502(a), 6504, and 6505 of this title] take effect on the later of— ‘‘(1) the date that is 18 months after the date of en- actment of this Act [Oct. 21, 1998]; or ‘‘(2) the date on which the Commission rules on the first application filed for safe harbor treatment under section 1304 [enacting section 6503 of this title] if the Commission does not rule on the first such applica- tion within one year after the date of enactment of this Act, but in no case later than the date that is 30 months after the date of enactment of this Act.’’ SHORT TITLE Pub. L. 105–277, div. C, title XIII, § 1301, Oct. 21, 1998, 112 Stat. 2681–728, provided that: ‘‘This title [enacting this chapter] may be cited as the ‘Children’s Online Privacy Protection Act of 1998’.’’ § 6502. Regulation of unfair and deceptive acts and practices in connection with collection and use of personal information from and about children on the Internet (a) Acts prohibited (1) In general It is unlawful for an operator of a website or online service directed to children, or any op- erator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations pre- scribed under subsection (b). (2) Disclosure to parent protected Notwithstanding paragraph (1), neither an operator of such a website or online service nor the operator’s agent shall be held to be liable under any Federal or State law for any disclosure made in good faith and following reasonable procedures in responding to a re- Page 2245 TITLE 15—COMMERCE AND TRADE § 6502 quest for disclosure of personal information under subsection (b)(1)(B)(iii) to the parent of a child. (b) Regulations (1) In general Not later than 1 year after October 21, 1998, the Commission shall promulgate under sec- tion 553 of title 5 regulations that— (A) require the operator of any website or online service directed to children that col- lects personal information from children or the operator of a website or online service that has actual knowledge that it is col- lecting personal information from a child— (i) to provide notice on the website of what information is collected from chil- dren by the operator, how the operator uses such information, and the operator’s disclosure practices for such information; and (ii) to obtain verifiable parental consent for the collection, use, or disclosure of per- sonal information from children; (B) require the operator to provide, upon request of a parent under this subparagraph whose child has provided personal informa- tion to that website or online service, upon proper identification of that parent, to such parent— (i) a description of the specific types of personal information collected from the child by that operator; (ii) the opportunity at any time to refuse to permit the operator’s further use or maintenance in retrievable form, or future online collection, of personal information from that child; and (iii) notwithstanding any other provision of law, a means that is reasonable under the circumstances for the parent to obtain any personal information collected from that child; (C) prohibit conditioning a child’s partici- pation in a game, the offering of a prize, or another activity on the child disclosing more personal information than is reason- ably necessary to participate in such activ- ity; and (D) require the operator of such a website or online service to establish and maintain reasonable procedures to protect the con- fidentiality, security, and integrity of per- sonal information collected from children. (2) When consent not required The regulations shall provide that verifiable parental consent under paragraph (1)(A)(ii) is not required in the case of— (A) online contact information collected from a child that is used only to respond di- rectly on a one-time basis to a specific re- quest from the child and is not used to re- contact the child and is not maintained in retrievable form by the operator; (B) a request for the name or online con- tact information of a parent or child that is used for the sole purpose of obtaining paren- tal consent or providing notice under this section and where such information is not maintained in retrievable form by the oper- ator if parental consent is not obtained after a reasonable time; (C) online contact information collected from a child that is used only to respond more than once directly to a specific request from the child and is not used to recontact the child beyond the scope of that request— (i) if, before any additional response after the initial response to the child, the operator uses reasonable efforts to provide a parent notice of the online contact infor- mation collected from the child, the pur- poses for which it is to be used, and an op- portunity for the parent to request that the operator make no further use of the in- formation and that it not be maintained in retrievable form; or (ii) without notice to the parent in such circumstances as the Commission may de- termine are appropriate, taking into con- sideration the benefits to the child of ac- cess to information and services, and risks to the security and privacy of the child, in regulations promulgated under this sub- section; (D) the name of the child and online con- tact information (to the extent reasonably necessary to protect the safety of a child participant on the site)— (i) used only for the purpose of pro- tecting such safety; (ii) not used to recontact the child or for any other purpose; and (iii) not disclosed on the site, if the operator uses reasonable efforts to provide a parent notice of the name and on- line contact information collected from the child, the purposes for which it is to be used, and an opportunity for the parent to request that the operator make no further use of the information and that it not be maintained in retrievable form; or (E) the collection, use, or dissemination of such information by the operator of such a website or online service necessary— (i) to protect the security or integrity of its website; (ii) to take precautions against liability; (iii) to respond to judicial process; or (iv) to the extent permitted under other provisions of law, to provide information to law enforcement agencies or for an in- vestigation on a matter related to public safety. (3) Termination of service The regulations shall permit the operator of a website or an online service to terminate service provided to a child whose parent has refused, under the regulations prescribed under paragraph (1)(B)(ii), to permit the opera- tor’s further use or maintenance in retrievable form, or future online collection, of personal information from that child. (c) Enforcement Subject to sections 6503 and 6505 of this title, a violation of a regulation prescribed under sub- section (a) shall be treated as a violation of a rule defining an unfair or deceptive act or prac- Page 2246 TITLE 15—COMMERCE AND TRADE § 6503 tice prescribed under section 57a(a)(1)(B) of this title. (d) Inconsistent State law No State or local government may impose any liability for commercial activities or actions by operators in interstate or foreign commerce in connection with an activity or action described in this chapter that is inconsistent with the treatment of those activities or actions under this section. (Pub. L. 105–277, div. C, title XIII, § 1303, Oct. 21, 1998, 112 Stat. 2681–730.) Statutory Notes and Related Subsidiaries EFFECTIVE DATE For effective date of subsec. (a) of this section, see section 1308 of Pub. L. 105–277, set out as a note under section 6501 of this title. § 6503. Safe harbors (a) Guidelines An operator may satisfy the requirements of regulations issued under section 6502(b) of this title by following a set of self-regulatory guide- lines, issued by representatives of the marketing or online industries, or by other persons, ap- proved under subsection (b). (b) Incentives (1) Self-regulatory incentives In prescribing regulations under section 6502 of this title, the Commission shall provide in- centives for self-regulation by operators to im- plement the protections afforded children under the regulatory requirements described in subsection (b) of that section. (2) Deemed compliance Such incentives shall include provisions for ensuring that a person will be deemed to be in compliance with the requirements of the regu- lations under section 6502 of this title if that person complies with guidelines that, after no- tice and comment, are approved by the Com- mission upon making a determination that the guidelines meet the requirements of the regulations issued under section 6502 of this title. (3) Expedited response to requests The Commission shall act upon requests for safe harbor treatment within 180 days of the filing of the request, and shall set forth in writing its conclusions with regard to such re- quests. (c) Appeals Final action by the Commission on a request for approval of guidelines, or the failure to act within 180 days on a request for approval of guidelines, submitted under subsection (b) may be appealed to a district court of the United States of appropriate jurisdiction as provided for in section 706 of title 5. (Pub. L. 105–277, div. C, title XIII, § 1304, Oct. 21, 1998, 112 Stat. 2681–732.) § 6504. Actions by States (a) In general (1) Civil actions In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the en- gagement of any person in a practice that vio- lates any regulation of the Commission pre- scribed under section 6502(b) of this title, the State, as parens patriae, may bring a civil ac- tion on behalf of the residents of the State in a district court of the United States of appro- priate jurisdiction to— (A) enjoin that practice; (B) enforce compliance with the regula- tion; (C) obtain damage, restitution, or other compensation on behalf of residents of the State; or (D) obtain such other relief as the court may consider to be appropriate. (2) Notice (A) In general Before filing an action under paragraph (1), the attorney general of the State in- volved shall provide to the Commission— (i) written notice of that action; and (ii) a copy of the complaint for that ac- tion. (B) Exemption (i) In general Subparagraph (A) shall not apply with respect to the filing of an action by an at- torney general of a State under this sub- section, if the attorney general determines that it is not feasible to provide the notice described in that subparagraph before the filing of the action. (ii) Notification In an action described in clause (i), the attorney general of a State shall provide notice and a copy of the complaint to the Commission at the same time as the attor- ney general files the action. (b) Intervention (1) In general On receiving notice under subsection (a)(2), the Commission shall have the right to inter- vene in the action that is the subject of the notice. (2) Effect of intervention If the Commission intervenes in an action under subsection (a), it shall have the right— (A) to be heard with respect to any matter that arises in that action; and (B) to file a petition for appeal. (3) Amicus curiae Upon application to the court, a person whose self-regulatory guidelines have been ap- proved by the Commission and are relied upon as a defense by any defendant to a proceeding under this section may file amicus curiae in that proceeding. (c) Construction For purposes of bringing any civil action under subsection (a), nothing in this chapter