Sony BMG Music Entertainment has agreed to pay $1 million to settle Federal Trade Commission charges that it violated the Children’s Online Privacy Protection Act (COPPA) and the commission’s implementing rule.
COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use or disclosure of personally identifiable information from and about children under 13 on the Internet. The law requires operators to notify parents and obtain their consent before collecting, using or disclosing children’s personal information.
The FTC’s complaint alleges that Sony BMG violated COPPA through its music-fan Web sites. It’s the largest civil penalty the FTC has ever levied in a COPPA case.
Sony’s Mea Culpa
Sony BMG operates more than 1,000 Web sites for its musical artists and labels. In order to register for these sites, Sony BMG requires users to submit a range of personal information, including date of birth.
On 196 of these sites, Sony BMG knowingly collected personal information from at least 30,000 underage children without first obtaining their parents’ consent. The result: Children were able to interact with Sony BMG fans of all ages, including adults.
“Sites with social-networking features, like any Web sites, need to get parental consent before collecting kids’ personal information,” FTC Chairman William E. Kovacic said. “Sony Music is paying the penalty for falling down on its COPPA obligations.”
Multiple Punishments
The FTC’s complaint alleges that Sony BMG violated COPPA by failing to provide sufficient notice on its Web sites of what information the company collects online from children, how it uses such information, and its disclosure practices.
The complaint also blames Sony BMG for failing to provide direct notice to parents of the information practices, failing to obtain verifiable parental consent, and failing to provide a reasonable means for parents to review the personal information collected from their children and to block its use.
In addition to the $1 million fine, the FTC’s consent order specifically prohibits Sony BMG from violating any provision of the rule and requires it to delete all personal information collected and maintained in violation of the rule.
The company is required to distribute the order and the FTC’s “How to Comply with the Children’s Online Privacy Protection Rule” to company personnel. The order also contains standard compliance, reporting and record-keeping provisions to help ensure the company abides by its terms.
Remember the Rootkit?
The fact that the FTC also recently settled a rootkit case with Sony BMG led Ari Schwartz, vice president and COO of the Center for Democracy and Technology, to conclude that Sony BMG raised a red flag with the government on its privacy practices.
Schwartz referred to Sony BMG’s January 2007 settlement with the FTC for the controversial embedding of antipiracy software on its music CDs without users’ knowledge. In that case, the company agreed to allow consumers to exchange their CDs and get reimbursements of up to $150 to repair any computer damage when they tried to remove the rootkit software.
“This $1 million settlement sends a message that just because the U.S. is switching administrations and there is going to be a new FTC chairman, the commissioners are united on the privacy front,” Schwartz said. “Children’s privacy remains an important issue no matter who the chairman is.”