The COPPA Rule applies to operators of commercial Web sites and online services directed to children under the age of 13, and to general audience Web sites and online services that knowingly collect personal information from children. Among other things, the Rule requires that Web sites get verifiable consent from a parent or guardian before they collect personal information from children.

This case was brought to the FTC’s attention by the Children’s Advertising Review Unit (CARU) of the Council of Better Business Bureaus. CARU evaluated the Lisa Frank Web site in late 2000, after the COPPA Rule became effective. According to CARU’s press release announcing referral of the matter to the FTC, Lisa Frank, Inc. committed serious violations of the COPPA Rule and, despite CARU’s urging, failed to make the changes needed to bring the Lisa Frank Web site into compliance with the Rule.

In its complaint, the FTC alleges that the Lisa Frank Web site, www.lisafrank.com, is directed to children, as that term is defined by the Rule. It further alleges that between April 21 and January 2001, lisafrank.com asked girls to register before they accessed many areas of the site, including the "club" and "shop" areas. The registration form asked girls for their first and last names, street addresses, phone numbers, e-mail addresses and birth dates, as well as their favorite color and season. Although directed to children, the site did not obtain consent from parents before collecting this information as required by the Rule, according to the complaint. The complaint further alleges that, in violation of the Rule, Lisa Frank did not provide direct notice to parents about the company’s privacy practices and did not inform parents that the company wanted to collect information from their children and that prior parental consent was required. Additionally, according to the complaint, the company failed to include in its Web site privacy policy required notices that an operator is prohibited from conditioning a child’s participation in an activity on the child’s disclosing more personal information than is reasonably necessary to participate in such activity and that parents have the right to review and have deleted their child’s personal information. Finally, the complaint alleges that the company violated the FTC Act’s prohibition on deceptive practices because lisafrank.com’s privacy policy falsely claimed that the site required parental consent for children 13 and younger and that parents would be required to fill in a registration form agreeing to the collection practices.

Settlement of the FTC charges permanently bars Lisa Frank, Inc. from future violations of the COPPA Rule; enjoins it, in connection with the operation of any Web site or other online service, from failing to comply with certain representations about children’s privacy; and requires that if the company operates a child-directed site in the future, it place a hyperlink to the FTC ’s website pages about the COPPA Rule within that site’s privacy policy and on notices to parents about collection of information from children. Finally, the company will pay a civil penalty of $30,000.

The Commission vote to approve the complaint and consent settlement was 5-0.

The proposed consent decree was filed on October 1, 2001 by the Department of Justice at the request of the FTC. It is subject to court approval.