FTC Receives Largest COPPA Civil Penalties to Date in Settlements with Mrs. Fields Cookies and Hershey Foods

FTC Alleges Companies' Web Sites Violated Children's Online Privacy Protection Act

February 27, 2003

Mrs. Fields Cookies and Hershey Foods Corporation have each agreed to settle Federal Trade Commission charges that their Web sites violated the Children's Online Privacy Protection Act (COPPA) Rule by collecting personal information from children without first obtaining the proper parental consent. Mrs. Fields will pay civil penalties of $100,000 and Hershey will pay civil penalties of $85,000. The separate settlements bar the companies from violating the Rule in the future and represent the biggest COPPA penalties awarded to date.

"These settlements offer food for thought for anyone who operates a Web site that caters to kids," said Howard Beales, Director of the FTC's Bureau of Consumer Protection. "If your Web site collects personal information from children, comply with the law or face the consequences."

The COPPA Rule applies to operators of commercial Web sites and online services directed to children under the age of 13 and to general audience Web sites and online services that knowingly collect personal information from children under 13. Among other things, the Rule requires that Web site operators obtain verifiable consent from a parent or guardian before they collect personal information from children.

According to the FTC complaints, the Mrs. Fields and Hershey sites each violated the COPPA Rule when they failed to obtain verifiable parental consent before collecting personal information from children under 13. In addition, the sites allegedly failed to post adequate privacy policies, to provide direct notice to parents about the information they were collecting and how it would be used, and to provide a reasonable means for parents to review the personal information collected from their children and to refuse to permit its further use.

Mrs. Fields Cookies

According to the FTC, portions of Mrs. Fields' Web sites - mrsfields.com, pretzeltime.com, and pretzelmaker.com - were directed to children. These Web pages offered birthday clubs for children 12 or under and provided birthday greetings and coupons for free cookies or pretzels. While Mrs. Fields did not disseminate the information it collected to third parties, the company allegedly collected personal information - including full name, home address, e-mail address and birth date - from more than 84,000 children, without first obtaining parental consent.

Hershey Foods Corporation

Hershey operates more than 30 Web sites - many of which are candy-related sites directed to children. On a number of these sites, the company allegedly employed a method of obtaining parental consent that does not meet the standard delineated under the COPPA Rule. Specifically, Hershey instructed children under 13 to have their parents fill in an online parental consent form. The FTC alleges the company took no steps to ensure that a parent or guardian saw or filled out the consent forms. The FTC further alleges that even if a parent or guardian did not submit information on the consent form, the company proceeded to collect personal information - including full name, home address, e-mail address and age - from children. According to the complaint, this method of obtaining parental consent was not reasonably calculated to ensure that the person providing consent was the child's parent. This is the first COPPA case to challenge a company's method of obtaining parental consent.

The settlements bar future COPPA violations, require that the companies delete any information collected in violation of COPPA, require civil penalty payments, and contain certain record-keeping requirements to allow the FTC to monitor the companies' compliance with the order.

The Commission vote to approve the complaints and consent decrees was 5-0. The U.S. Department of Justice filed the Hershey Foods complaint and consent decree in the U.S. District Court for the Middle District of Pennsylvania in Harrisburg, and the Mrs. Fields complaint and consent decree were filed in the U.S. District Court for the District of Utah, Central Division on February 26, 2003 at the request of the FTC.

An FTC Web site at http://www.ftc.gov/kidzprivacy contains information to help educate Web site operators about their responsibilities under the COPPA Rule and to assist parents and teachers in understanding how the Rule protects children's privacy.