Under the rules -- which are mandated by the Children's Online Privacy Protection Act, or COPPA, signed into law last year -- sites will have to get parental permission via mail, fax, credit card, or digital signature before disclosing a child's personal information to a third party.
If a site plans to use the information only internally, the company can rely on consent via e-mail from a parent, at least for the first two years. After that, the FTC will require sites to get more "reliable" parental consent (fax, mail, credit card) for all information collected.
The rules also spell-out practices that do not require parental consent, such as answering a one-time request for homework.
In addition, the new rules also require children's sites to post privacy notices and give parents the option of prohibiting the sale of information that has been collected for internal use.
One controversial rule lets schools act as parents' agents when dealing with Web sites.
Advocates applaud rules
"We're quite pleased with the rules," said Kathryn Montgomery, executive director of the Center for Media Education. "They've covered all the basics."
However, Catlett and other privacy groups criticized the FTC's plan to let schools act on behalf of parents. "Parents shouldn't assume that schools are looking out for the privacy interests of their children," he said. He said privacy advocates would keep a close watch on that practice.
The new rules come after more than a year of wrangling with groups that claimed COPPA had the potential to violate free speech. But Ari Schwartz, policy analyst with the Center for Democracy and Technology, said the FTC did a good job of addressing his concerns with the new rules. "They were very considerate in taking into account our comments," he said.
Schwartz said his group still plans to monitor how the rules are implemented. "Kids have to at the very least be able to participate in the interactive experience of the Internet and not just be passive observers."
Privacy advocates applauded the new rules. "The FTC here has followed both the intention of Congress and the common sense expectations of parents," Jason Catlett, president of privacy protection group Junkbusters Corp.
