No single group is seen as more vulnerable to privacy violations than children. Recent studies note that about two-thirds of all children have used the Internet, and that about 92 percent of Internet users in the United States are concerned with protection of their online privacy. Industry has responded to the increasing presence of children on the Internet by marketing blocking software designed to "filter" inappropriate Internet sites and to prevent children from disclosing personal information.

    In Washington policy circles, however, these efforts were seen as insufficient to protect children’s privacy on the Internet. In 1998, Congress passed the Children’s Online Privacy Protection Act (COPPA) to meet these concerns. On April 21, 2000, COPPA and the Federal Trade Commission’s rules implementing COPPA went into effect.

    The public debate over the privacy of children’s information on the Internet has seldom focused on the other side of the equation: Legal actions taken to restrict access to, and dissemination of, information to protect personal privacy may also restrict free expression. Freedom in the online world can be a zero-sum game -- increased protection for privacy can mean decreased freedom to communicate. The implementation of COPPA by the FTC presents just these issues.

    COPPA has two broad requirements: notice of privacy policies toward children, and parental consent. It requires that Web sites or online services that collect personal information from children must provide effective notice on the site about the information collected and the uses to which the operator puts that information. It also provides that Web site operators must obtain "verifiable parental consent" for the collection of personally identifiable information from a child. "Personal information" is defined broadly to include any information that "permits the physical or online contacting of the child," including first or last name, e-mail address, telephone number, physical address, or other information that may permit a child to be located.

    The FTC’s rules (available online at <www.ftc.gov>) establish that COPPA will apply not only to children’s Web sites such as Nickelodeon or Disney, but to a potentially far broader array of sites. COPPA will apply even to general-purpose Web sites if the FTC finds, based on a subjective interpretation of the "overall character" of a site, that any portion of the Web site has been directed at children. Criteria include the site’s visual or audio content, whether it uses animated characters, and whether it offers child-oriented activities.

    Moreover, any non-child-directed site that has gained actual knowledge that a child has used the site will be deemed to be on notice that it may have collected a child’s personal information. The FTC noted that it would examine closely those Web sites that do not ask users to reveal age information at all, but do ask for related information that could give operators knowledge that they are dealing with a child. If a general-purpose Web site gains actual knowledge that it has collected personal information from even one child, it will be required to design its entire information gathering procedures to comply with COPPA.

    Perhaps most importantly for media Web sites, the FTC’s rules also make it clear that COPPA will apply not only to sites that actively seek information from children, but also to sites where children themselves can supply personally identifiable information. For example, if a child in a child-oriented chat room posts identifying information in a real-time chat, the operator of that Web site will be deemed to have "collected" that personal information from the child.

    The net effect of such a ruling, many groups believe, will be to require any child-oriented chat rooms and bulletin boards either to close down or to adopt 24-hour monitoring to immediately remove any personal information posted by children. The American Library Association, ACLU, and Center for Democracy and Technology have urged a more workable reading of this rule. Under their suggested interpretation, an operator of a Web site that does not seek to collect personal information but merely provides a bulletin board, personal home page, or other communications services available to children would not be deemed to be "collecting" information within the meaning of COPPA.

    If COPPA is found to apply to a Web site or online service, FTC rules require the operator to take several steps. First, it must post a "clear, prominent, and understandable" privacy notice. The notice must list the information collected, how it will be used, and to whom it may be disclosed. Second, the operator must obtain "verifiable parental consent" for the collection, use, or disclosure of personal information from children. COPPA defines "verifiable parental consent" as "any reasonable effort (taking into consideration available technology)," to ensure parental authorization.

    The FTC lists several possible ways operators can obtain this consent, including requiring a parent to mail the operator a consent form or to call a toll-free telephone number. Until April 2002, the FTC will permit consent by e-mail, provided this method is accompanied by "additional steps" to "provide assurances that the parent is providing the consent." Third, the operator must provide opportunities for parents to review and delete their child’s personal information; must limit collection of personal information to that necessary for the activity; and must protect the integrity of the personal information collected.

    These provisions undoubtedly will prevent many children from unwittingly providing personally identifiable information that could put them in danger. It is difficult to take issue with this legitimate governmental objective, or with the good faith of both Congress and the FTC in passing and implementing the statute. Yet, certain interpretations of COPPA -- such as the FTC determination that a Web site has "collected" personal information from a child who has posted that information in a chatroom -- threaten to force some Web sites either to adopt extensive (and expensive) monitoring programs or to close up shop. Chilling or silencing such outlets of free expression bears significant First Amendment implications.