Sony Agrees to $1 Million Penalty for Child Privacy Practices of Music Fan Websites

This posting was written by William Zale, Editor of CCH Advertising Law Guide.

Sony BMG Music Entertainment (Sony Music) has agreed to pay $1 million as part of a settlement to resolve Federal Trade Commission charges that it violated the Children’s Online Privacy Protection Act (COPPA) and the Commission’s implementing Rule, the FTC announced on December 11, 2008.

Collection, Maintenance, Disclosure of Information

The Commission’s complaint alleges that, through its music fan websites, Sony Music improperly collected, maintained and disclosed personal information from thousands of children under the age of 13, without their parents’ consent. The civil penalty to be paid by Sony Music matches the largest penalty ever in a COPPA case.

Sony BMG Music Entertainment, a subsidiary of Sony Corporation of America, represents hundreds of popular musicians and entertainers, including numerous artists popular with children and teenagers. The company operates over 1,000 websites for its musical artists and labels. Sony Music requires users to submit a broad range of personal information, together with date of birth, in order to register for these sites.

On 196 of these sites, Sony Music knowingly collected personal information from at least 30,000 underage children without first obtaining their parents’ consent, in violation of COPPA, according to the FTC.

Many of these sites also enable children to create personal fan pages, review artists’ albums, upload photos or videos, post comments on message boards and in online forums, and engage in private messaging. In this way, children were able to interact with Sony Music fans of all ages, including adults.

Requirement of Parental Consent

“Sites with social networking features, like any websites, need to get parental consent before collecting kids’ personal information,” said FTC Chairman William E. Kovacic. “Sony Music is paying the penalty for falling down on its COPPA obligations.”

COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use, or disclosure of personally identifiable information from and about children under 13 on the Internet. The law requires operators to notify parents and obtain their consent before collecting, using, or disclosing children’s personal information.

Notice of Information Collection and Use

The FTC’s complaint alleges that Sony Music violated COPPA by failing to provide sufficient notice on the Sony Music websites of what information the company collects online from children, how it uses such information, and its disclosure practices; failing to provide direct notice to parents of Sony Music’s information practices; failing to obtain verifiable parental consent; and, failing to provide a reasonable means for parents to review the personal information collected from their children and to refuse to permit its further use or maintenance.

FTC Act Section 5 Charges

The FTC’s complaint also charges Sony Music with violating Section 5 of the Federal Trade Commission Act by falsely stating in its privacy policy that users who indicate that they are under 13 on its website registration pages will be restricted from participating in Sony Music’s web page activities. In fact, Sony Music accepted registrations from children who entered a date of birth indicating that they were under 13.

Remedies

The Commission’s consent order calls for Sony Music to pay a $1 million civil penalty. In addition, the order specifically prohibits Sony Music from violating any provision of the Rule, and requires it to delete all personal information collected and maintained in violation of the Rule. The company is required to distribute the order and the FTC’s “How to Comply with the Children’s Online Privacy Protection Rule” to company personnel. The order also contains standard compliance, reporting, and record keeping provisions to help ensure the company abides by its terms.

To provide resources to parents and their children about children’s privacy in general and social networking sites in particular, the order requires Sony Music to link to certain FTC consumer education materials for the next five years. The company must include a link to the children’s privacy section of the Commission’s www.ftc.gov website on any site it operates that is subject to COPPA.

In addition, Sony Music must include links to the social networking section of the Commission’s www.onguardonline.gov website on any of its sites that offer users the opportunity to create publicly viewable profiles.

The Commission vote approving the complaint and consent order was 4-0. On December 10, 2008, the Department of Justice, on behalf of the FTC, filed the complaint in the U.S. District Court for the Southern District of New York and submitted the consent decree for the court’s approval.

A news release on the development appears here on the FTC website. Text of the complaint and consent decree appear here.

Further Information on COPPA

The text of the Children’s Online Privacy Protection Act is at CCH Trade Regulation Reports ¶27,590, CCH Advertising Law Guide ¶10,700, and CCH Privacy Law in Marketing ¶25,300.

The text of the FTC’s Children’s Online Privacy Protection Rule is at CCH Trade Regulation Reports ¶27,590, CCH Advertising Law Guide ¶16,010, and CCH Privacy Law in Marketing ¶26,300.

The Act and Rule are explained by advertising attorney Gonzalo E. Mon of Kelley Drye & Warren LLP at CCH Privacy Law in Marketing ¶9000 through ¶9080.

Further details about the Sony action will appear in CCH Trade Regulation Reports, CCH Advertising Law Guide, CCH Privacy Law in Marketing.