Free Proposed Order - District Court of California - California

Case 3:08-cv-00639-SI

Document 4

Filed 01/30/2008

Page 1 of 14

1 JEFFREY S. BUCHOLTZ Acting Assistant Attorney General 2 EUGENE M. THIROLF 3 Director KENNETH L. JOST 4 Deputy Director Office of Consumer Litigation 5 MARY M. ENGLEHART (MD Bar - MD does not issue bar numbers) 6 Trial Attorney, Office of Consumer Litigation U.S. Department of Justice 7 1331 Pennsylvania Avenue, N.W. Washington, D.C. 20004-1710 8 PHONE: 202-307-0088 FAX: 202-514-8742 9 EMAIL: [email protected] 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 WHEREAS the plaintiff, the United States of America, has commenced this action by UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA Oakland Division ) ) Plaintiff, ) ) ) v. ) ) INDUSTRIOUS KID, INC., ) a corporation, ) ) ) ) JEANETTE SYMONS, ) individually and as an officer ) of the corporation, and ) ) Defendants. ) ____________________________________) UNITED STATES OF AMERICA, Attorneys for Plaintiff United States of America

CV No. 08-0639

CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTION, AND OTHER RELIEF

Case 3:08-cv-00639-SI

Document 4

Filed 01/30/2008

Page 2 of 14

1 filing the complaint herein; the defendants have waived service of the summons and complaint; 2 the parties have been represented by the attorneys whose names appear hereafter; and the parties 3 have agreed to settlement of this action upon the following terms and conditions, without 4 adjudication of any issue of fact or law and without the defendants admitting liability for any of 5 the matters alleged in the complaint or that the facts as alleged in the complaint, other than the 6 jurisdictional facts, are true; 7 THEREFORE, on the joint motion of the plaintiff and the defendants, it is hereby

8 ORDERED, ADJUDGED, and DECREED as follows: 9 10 11 12 13 14 15 16 17 18 19 20 21 DEFINITIONS 22 23 24 25 26 4. For purposes of this Consent Decree, the term "Rule" means the Federal Trade Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312. 5. For purposes of this Consent Decree, the terms "child," "collects," "collection," 1. 2. This Court has jurisdiction of the subject matter and of the parties. The complaint states a claim upon which relief may be granted against the

defendants under Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 ("COPPA"), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a), and 19 of the Federal Trade Commission Act ("FTC Act"), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a), and 57b. Among other things, the complaint alleges that the defendants violated COPPA by failing to provide sufficient notice to parents of their information practices either in their online or direct notices to parents and to obtain verifiable parental consent prior to collecting, using, or disclosing personal information from children online. 3. Entry of this Consent Decree and Order for Civil Penalties, Injunction, and Other

Relief is in the public interest.

"Commission," "delete," "disclosure," "Internet," "online contact information," "operator," "parent," "person," "personal information," "third party," "verifiable consent," and "website or Stip. Final Judgment CV 08-0639 Page 2 of 14

Case 3:08-cv-00639-SI

Document 4

Filed 01/30/2008

Page 3 of 14

1 online service directed to children," are defined as those terms are defined in Section 312.2 of 2 the Rule, 16 C.F.R. § 312.2. 3 6. For purposes of this Consent Decree, the term "blog" means a web-based

4 publication focusing on a particular subject or functioning as an online journal and typically 5 consisting of periodic entries containing text, images, and links to other web pages. 6 7. For purposes of this Complaint, a "blog hosting service" means a website or

7 online service that hosts blogs and often provides the software to use as a template for creating 8 blogs. 9 10 11 12 9. 13 representatives, and employees, and all persons in active concert or participation with them who 14 receive actual notice of this Consent Decree by personal service or otherwise, are hereby 15 enjoined, directly or through any corporation, subsidiary, division, website, or other device, 16 from: 17 18 19 20 21 22 23 24 25 26 b. a. Failing to provide sufficient notice on any website or other online service directed to children, or through which they, with actual knowledge, collect, use, and/or disclose personal information from children, of what information defendants collect online from children, how they use such information, their disclosure practices, and all other required content, in violation of Section 312.4(b) of the Rule, 16 C.F.R. § 312.4(b); Failing to include in their direct notice to parents sufficient notice of what information defendants collect online from children, how they use such information, their disclosure practices, and all other required content, in violation of Section 312.4(c) of the Rule, 16 C.F.R. § 312.4(c); Stip. Final Judgment CV 08-0639 Page 3 of 14 The defendants, their successors and assigns, and their officers, agents, servants, 8. For purposes of this Consent Decree, "defendants" means Industrious Kid, Inc., a

corporation, and Jeanette Symons, individually and as an officer of the corporation. INJUNCTION

Case 3:08-cv-00639-SI

Document 4

Filed 01/30/2008

Page 4 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 10.

c.

Failing to obtain verifiable parental consent before any collection, use, and/or disclosure of personal information from children, in violation of Section 312.5 of the Rule, 16 C.F.R. § 312.5(a)(1); or,

d.

Violating any other provision of the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312, and as the Rule may hereafter be amended. A copy of the Rule is attached hereto as "Appendix A" and incorporated herein as if fully set forth verbatim. CONSUMER EDUCATION REMEDIES

For a period of five (5) years from the date of entry of this Consent Decree, the

defendants, and their successors and assigns, in connection with the operation of any website or other online service directed to children or through which it, with actual knowledge, collects, uses, and/or discloses personal information from children, shall place a clear and conspicuous notice (1) within the privacy policy required to be posted on its website(s) by Section 312.4(b) of the Rule, 16 C.F.R. § 312.4(b); (2) within the direct notice required to be sent to parents by Section 312.4(c) of the Rule, 16 C.F.R. § 312.4(c); and (3) at each location on its website(s) where personal information is collected, which states as follows in bold typeface: NOTICE: Visit www.ftc.gov/privacy for information from the Federal Trade Commission about protecting children's privacy online. Where the above notice is posted on a website or delivered via email or other electronic service,

20 it shall be in the form of a hyperlink to www.ftc.gov/privacy. The Federal Trade Commission 21 may change the hyperlink/URL upon thirty (30) days prior written notice to the defendants, their 22 successors or assigns. 23 24 25 26 11. For a period of five (5) years from the date of entry of this Consent Decree, the defendants, and their successors and assigns, in connection with the operation of any blog or blog hosting service, shall place a clear and conspicuous notice on the homepage(s) and privacy notice(s) of their website(s), which states, in the form of a hyperlink in bold typeface, as follows: Stip. Final Judgment CV 08-0639 Page 4 of 14

Case 3:08-cv-00639-SI

Document 4

Filed 01/30/2008

Page 5 of 14

1 2 3 4

Visit www.OnGuardOnline.gov for social networking safety tips for parents and youth, http://onguardonline.gov/socialnetworking ["parents" must contain a hyperlink to www.onguardonline.gov/socialnetworking.html, and "youth" must contain a hyperlink to www.onguardonline.gov/socialnetworking_youth.html]

5 The Federal Trade Commission may change the hyperlinks/URLs upon thirty (30) days prior 6 written notice to the defendants, their successors or assigns. 7 8 9 10 11 12 13 14 15 16 17 18 19 DELETION OF CHILDREN'S PERSONAL INFORMATION 20 21 22 23 24 25 14. The defendants, and their successors and assigns, within five (5) days from the date of entry of this Consent Decree, shall delete all personal information collected and maintained in violation of the Rule through the date of entry of this Consent Decree. DISTRIBUTION OF ORDER AND COMPLIANCE GUIDE BY THE DEFENDANTS 15. The defendants, and their successors and assigns, within thirty (30) days from the 12. CIVIL PENALTY The defendants, and their successors and assigns, jointly and severally shall pay

to the plaintiff a civil penalty, pursuant to Section 5(m)(1)(A) of the FTC Act, 15 U.S.C. § 45(m)(1)(A), in the amount of One Hundred Thirty Thousand Dollars ($130,000) due and payable within five (5) days following entry of this Consent Decree. Unless otherwise directed, payment shall be made by electronic fund transfer in accordance with procedures specified by the Office of Consumer Litigation, Civil Division, U.S. Department of Justice, Washington, DC 20530. 13. In the event of any default payment, which default continues for ten (10) days

beyond the due date of payment, the entire unpaid penalty, together with interest, as computed pursuant to 28 U.S.C. § 1961, from the date of default to the date of payment, shall immediately become due and payable.

26 date of entry of this Consent Decree, shall provide a copy of this Consent Decree and the Federal Trade Commission compliance guide entitled How to Comply with the Children's Online Stip. Final Judgment CV 08-0639 Page 5 of 14

Case 3:08-cv-00639-SI

Document 4

Filed 01/30/2008

Page 6 of 14

1 Privacy Protection Rule (Nov. 1999) ("compliance guide") (attached hereto as "Appendix B") to 2 each of its current principals, officers, directors, and managers; and to all current employees and 3 agents having responsibilities related to the operation of any website or online service subject to 4 this Consent Decree; and to all current representatives having responsibilities related to 5 compliance with this Consent Decree; and secure from each such person a signed statement 6 acknowledging receipt of a copy of this Consent Decree and the compliance guide. The 7 defendants shall, within ten (10) days of complying with this paragraph, submit to the 8 Commission a signed statement setting forth the fact and manner of the defendants' compliance, 9 including the name and title of each person to whom a copy of the Consent Decree and 10 compliance guide has been provided. 11 16. The defendants, and their successors and assigns, for a period of three (3) years

12 from the date of entry of this Consent Decree, shall provide a copy of this Consent Decree and 13 the compliance guide to each of its future principals, officers, directors, and managers; and to all 14 future employees, agents, and representatives having responsibilities related to the operation of 15 any website or online service subject to this Consent Decree, and secure from each such person a 16 signed and dated statement acknowledging receipt of a copy of this Consent Decree and the 17 compliance guide, within thirty (30) days after the person assumes such position or 18 responsibilities. The defendants shall maintain copies of the signed statements, as well as other 19 information regarding the fact and manner of their compliance, including the name and title of 20 each person to whom a copy of the Consent Decree and compliance guide has been provided 21 and, upon request, shall make the statements and other information available to the Commission. 22 23 24 25 26 17. monitored: a. For a period of three (3) years from the date of entry of this Consent Decree, COMPLIANCE REPORTING BY THE DEFENDANTS In order that compliance with the provisions of this Consent Decree may be

Stip. Final Judgment CV 08-0639

Page 6 of 14

Case 3:08-cv-00639-SI

Document 4

Filed 01/30/2008

Page 7 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

i.

Individual defendant Symons shall notify the Commission of the following:

(1)

Any changes in her residence addresses, mailing addresses, and telephone numbers, within thirty (30) days of the date of such change;

(2)

Any changes in her employment status (including selfemployment), and any change in her ownership in any business entity that may affect compliance obligations arising under this Consent Decree, within thirty (30) days of the date of such change. Such notice shall include the name and address of each business that the defendant is affiliated with, employed by, creates, forms, or performs services for; a statement of the nature of the business; and a statement of her duties and responsibilities in connection with the business or employment; and

(3) ii.

Any changes in the defendant's name; and Each defendant shall notify the Commission of any changes in corporate structure of the corporate defendant, or any business entity that defendant Symons directly or indirectly controls or has an ownership interest in, that may affect compliance obligations arising under this Consent Decree, including but not limited to a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor entity; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this Consent Decree; the filing of a bankruptcy petition; or a change in the corporate name or address, at least thirty (30) days prior to such change, provided that, with

Stip. Final Judgment CV 08-0639

Page 7 of 14

Case 3:08-cv-00639-SI

Document 4

Filed 01/30/2008

Page 8 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 ii. 19 20 21 22 23 24 25 26 (3) (2) (1) (2) b.

respect to any proposed change in the corporation about which a defendant learns less than thirty (30) days prior to the date such action is to take place, such defendant shall notify the Commission as soon as is practicable after obtaining such knowledge. Sixty (60) days after the date of entry of this Consent Decree and at such times as the Federal Trade Commission shall reasonably require, the defendants each shall provide a written report to the Commission, sworn to under penalty of perjury, setting forth in detail the manner and form in which they have complied and are complying with this Consent Decree. This report shall include, but not be limited to: i. (1) For individual defendant Symons: Her then-current residence addresses, mailing addresses, and telephone numbers; and Her then-current employment and business addresses and telephone numbers; a description of the business activities of each such employer or business, and the title and responsibilities of the defendant for each such employer or business. For all defendants: a statement setting forth in detail the criteria and process through which any of their websites register visitors online for any activity requiring the submission of personal information, and a copy of each different screen or page providing or collecting registration information; a copy of each different privacy notice posted on any of their websites; a statement setting forth in detail each place where the privacy Page 8 of 14

Stip. Final Judgment CV 08-0639

Case 3:08-cv-00639-SI

Document 4

Filed 01/30/2008

Page 9 of 14

1 2 3 4 5 6 7 8 9 10 11 12 (8) 13 14 (7) (6) (4) (5)

notice on any website is located and a copy of each screen or page on which the website collects personal information; a copy of each different privacy notice sent to parents; a statement setting forth in detail when and how each notice to parents is provided; a statement setting forth in detail the methods used to obtain verifiable parental consent prior to any collection, use, and/or disclosure of personal information from children; a statement setting forth in detail the means provided for parents to review the personal information collected from their children and to refuse to permit its further use or maintenance; a statement setting forth in detail why each type of information collected from a child is reasonably necessary for the provision of the particular related activity; and

15 16 17 18 19 20 21 22 23 24 25 26 c. (9) a statement setting forth in detail the procedures used to protect the confidentiality, security, and integrity of personal information collected from children. For the purposes of this Consent Decree, the defendants shall, unless otherwise directed by the Commission's representatives, mail all written notifications to the Commission to: Associate Director for Enforcement Federal Trade Commission 600 Pennsylvania Avenue, NW Washington, D.C. 20580 Re: U.S. v. Industrious Kid, Inc., Civil Action No. 08-0639.

Stip. Final Judgment CV 08-0639

Page 9 of 14

Case 3:08-cv-00639-SI

Document 4

Filed 01/30/2008

Page 10 of 14

1 2 18.

RECORD-KEEPING PROVISIONS For a period of three (3) years from the date of entry of this Consent Decree, the

3 defendants, and their successors and assigns, shall maintain, and make available to the Federal 4 Trade Commission for inspection and copying within fourteen (14) days of the date of receipt of 5 a written request, a print or electronic copy in HTML format of all documents demonstrating 6 compliance with the terms and provisions of this Consent Decree, including, but not limited to, 7 copies of acknowledgments of receipt of this Consent Decree; all reports submitted to the 8 Commission pursuant to this Consent Decree; a sample copy of every different form, web page, 9 or screen through which personal information is collected; and a sample copy of each different 10 document containing any representation regarding the defendants' collection, use, and disclosure 11 practices pertaining to personal information of a child. Each web page copy shall be 12 accompanied by the URL of the web page where the material was posted online. Electronic 13 copies shall include all text and graphics files, audio scripts, and other computer files used in 14 presenting information on the Internet. Provided, however, that the defendants shall not be 15 required to retain any document for longer than two (2) years after the document was created, or 16 to retain a print or electronic copy of any amended web page or screen to the extent that the 17 amendment does not affect the defendants' compliance obligations under this Consent Decree. 18 19 20 21 22 23 24 20. 25 of the parties to this Consent Decree to apply to the Court at any time for such further orders or 26 directives as may be necessary or appropriate for the interpretation or modification of this Stip. Final Judgment CV 08-0639 Page 10 of 14 This Court shall retain jurisdiction of this matter for the purposes of enabling any 19. PROVISION OF TAXPAYER IDENTIFYING NUMBERS Defendant, Industrious Kid, Inc., is hereby required, in accordance with 31 U.S.C.

§ 7701, to furnish to the Federal Trade Commission its taxpayer identifying number, which shall be used for purposes of collecting and reporting on any delinquent amount arising out of its relationship with the government. CONTINUING JURISDICTION

Case 3:08-cv-00639-SI

Document 4

Filed 01/30/2008

Page 11 of 14

1 Consent Decree, for the enforcement of compliance therewith, or for the punishment of 2 violations thereof. 3 JUDGMENT IS THEREFORE ENTERED in favor of the plaintiff and against the

4 defendants, pursuant to all the terms and conditions recited above. 5 6 7 8 9 10 11 12 may arise under the Equal Access to Justice Act, 28 U.S.C. § 2412, concerning the investigation 13 and prosecution of this action. 14 15 16 17 18 19 20 21 22 23 24 25 26 UNITED STATES DISTRICT JUDGE Dated this __________ day of _______________, 2008.

The parties, by their counsel, hereby consent to the terms and conditions of the Consent Decree as set forth above and consent to the entry thereof. The defendants waive any rights that

Stip. Final Judgment CV 08-0639

Page 11 of 14

Case 3:08-cv-00639-SI

Document 4

Filed 01/30/2008

Page 12 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 ___________/s/___________________________ MARY M. ENGLEHART Trial Attorney Office of Consumer Litigation U.S. Department of Justice 1331 Pennsylvania Avenue, N.W. Washington, D.C. 20004-1710 PHONE: 202-307-0088 FAX: 202-514-8742 EMAIL: [email protected] FOR THE UNITED STATES OF AMERICA: JEFFREY S. BUCHOLTZ Acting Assistant Attorney General Civil Division U.S. Department of Justice EUGENE M. THIROLF Director KENNETH L. JOST Deputy Director, Office of Consumer Litigation

Stip. Final Judgment CV 08-0639

Page 12 of 14

Case 3:08-cv-00639-SI

Document 4

Filed 01/30/2008

Page 13 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 FOR THE FEDERAL TRADE COMMISSION:

___________/s/_________________________ MAMIE KRESSES PHYLLIS HURWITZ MARCUS Attorneys Federal Trade Commission 600 Pennsylvania Avenue, NW Washington, D.C. 20580 (202) 326-2070/2854 (voice) (202) 326-3259 (fax)

Stip. Final Judgment CV 08-0639

Page 13 of 14

Case 3:08-cv-00639-SI

Document 4

Filed 01/30/2008

Page 14 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 Stip. Final Judgment CV 08-0639 Page 14 of 14 __________/s/_________________________ JEANETTE SYMONS, individually and as an officer of the corporation __________/s/__________________________ RANDAL M. SHAHEEN, ESQ. Arnold & Porter LLP 555 Twelfth Street, N.W. Washington, D.C. 20004 (202) 942-5734 (voice) (202) 942-5999 (fax) Attorney for defendant Industrious Kid, Inc. __________/s/__________________________ JEANETTE SYMONS President and Chief Executive Officer Industrious Kid, Inc. 311 Oak Street, Suite 104 Oakland, California 94607 FOR THE DEFENDANTS: INDUSTRIOUS KID, INC.

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 1 of 20

How to Comply With The Children's Online Privacy Protection Rule
A Guide from the Federal Trade Commission the Direct Marketing Association

and the Internet Alliance

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 2 of 20

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 3 of 20

The Children's Online Privacy Protection Act, effective April 21, 2000, applies to the online collection of personal information from children under 13. The new rules spell out what a Web site operator must include in a privacy policy, when and how to seek verifiable consent from a parent and what responsibilities an operator has to protect children's privacy and safety online.

The Federal Trade Commission staff, the Direct Marketing Association and the Internet Alliance prepared this guide to help you comply with the new requirements for protecting children's privacy online and understand the FTC's enforc e m e n t a u t h o r i t y.
The Childre n 's Online Privacy Protection Act of 1998 is included at the end of this publication for your re f e re n c e .

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 4 of 20

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 5 of 20

WHO MUST COMPLY
If you operate a commercial Web site or an online service directed to children under 13 that collects personal information from children or if you operate a general audience Web site and have actual knowledge that you are collecting personal information from children, you must comply with the Children's Online Privacy Protection Act (COPPA). · To determine whether a Web site is directed to children, the FTC considers several factors, including the subject matter; visual or audio content; the age of models on the site; language; whether advertising on the Web site is directed to children; information regarding the age of the actual or intended audience; and whether a site uses animated characters or other child-oriented features. · To determine whether an entity is an "operator" with respect to information collected at a site, the FTC will consider who owns and controls the information; who pays for the collection and maintenance of the information; what the pre-existing contractual relationships are in connection with the information; and what role the Web site plays in collecting or maintaining the information.

mechanisms - when they are tied to individually identifiable information.

BASIC PROVISIONS
Privacy Notice
Placement

An operator must post a link to a notice of its information practices on the home page of its Web site or online service and at each area where it collects personal information from children. An operator of a general audience site with a separate children's area must post a link to its notice on the home page of the children's area. The link to the privacy notice must be clear and prominent. Operators may want to use a larger font size or a different color type on a contrasting background to make it stand out. A link in small print at the bottom of the page - or a link that is indistinguishable from other links on your site - is not considered clear and prominent.
Content

The notice must be clearly written and understandable; it should not include any unrelated or confusing materials. It must state the following information: · The name and contact information (address, telephone number and e-mail address) of all operators collecting or maintaining children's personal information through the Web site or online service. If more than one operator is collecting information at the site, the site may select and provide contact information for only one operator who will respond to all inquiries from parents about the site's privacy policies. Still, the names of all the operators must be listed in the notice. · The kinds of personal information collected from children (for example,

Personal Information
The Children's Online Privacy Protection Act and Rule apply to individually identifiable information about a child that is collected online, such as full name, home address, e-mail address, telephone number or any other information that would allow someone to identify or contact the child. The Act and Rule also cover other types of information -- for example, hobbies, interests and information collected through cookies or other types of tracking

1

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 6 of 20

name, address, e-mail address, hobbies, etc.) and how the information is collected - directly from the child or passively, say, through cookies. · How the operator uses the personal information. For example, is it for marketing back to the child? Notifying contest winners? Allowing the child to make the information publicly available through a chat room? · Whether the operator discloses information collected from children to third parties. If so, the operator also must disclose the kinds of businesses in which the third parties are engaged; the general purposes for which the information is used; and whether the third parties have agreed to maintain the confidentiality and security of the information. · That the parent has the option to agree to the collection and use of the child's information without consenting to the disclosure of the information to third parties. · That the operator may not require a child to disclose more information than is reasonably necessary to participate in an activity as a condition of participation. · That the parent can review the child's personal information, ask to have it deleted and refuse to allow any further collection or use of the child's information. The notice also must state the procedures for the parent to follow.

collection, use and disclosure of the information; and how the parent can provide consent. The notice to parents must be written clearly and understandably, and must not contain any unrelated or confusing information. An operator may use any one of a number of methods to notify a parent, including sending an e-mail message to the parent or a notice by postal mail.

VERIFIABLE PARENTAL CONSENT
Before collecting, using or disclosing personal information from a child, an operator must obtain verifiable parental consent from the child's parent. This means an operator must make reasonable efforts (taking into consideration available technology) to ensure that before personal information is collected from a child, a parent of the child receives notice of the operator's information practices and consents to those practices. Until April 2002, the FTC will use a sliding scaleapproach to parental consent in which the required method of consent will vary based on how the operator uses the child's personal information. That is, if the operator uses the information for internal purposesa less rigorous method of consent , is required. If the operator discloses the informationto others, the situation presents greater dangers to children, and a more reliable method of consent is required. The sliding scale approach will sunset in April 2002 subject to a Commission review planned for October 2001.
Internal Uses

DIRECT NOTICE TO PARENTS
Content

The notice to parents must contain the same information included on the notice on the Web site. In addition, an operator must notify a parent that it wishes to collect personal information from the child; that the parent's consent is required for the

Operators may use e-mail to get parental consent for all internal uses of personal information, such as marketing back to a child based on his or her preferences or

2

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 7 of 20

communicating promotional updates about site content, as long as they take additional steps to increase the likelihood that the parent has, in fact, provided the consent. For example, operators might seek confirmation from a parent in a delayed confirmatory e-mail, or confirm the parent's consent by letter or phone call.
Public Disclosures

Exceptions

The regulations include several exceptions that allow operators to collect a child's e-mail address without getting the parent's consent in advance. These exceptions cover many popular online activities for kids, including contests, online newsletters, home work helpand electronic postcards. Prior parental consent is not required when: · an operator collects a child's or parent's e-mail address to provide notice and seek consent; · an operator collects an e-mail address to respond to a one-timerequest from a child and then deletes it; · an operator collects an e-mail address to respond more than onceo a specific t request - say, for a subscription to a newsletter. In this case, the operator must notify the parent that it is communicating regularly with the child and give the parent the opportunity to stop the communication before sending or delivering a second communication to a child; · an operator collects a child's name or online contact information to protect the safety of a child who is participating on the site. In this case, the operator must notify the parent and give him or her the opportunity to prevent further use of the information; · an operator collects a child's name or online contact information to protect the security or liability of the site or to respond to law enforcement, if necessary, and does not use it for any other purpose.
October 2001/April 2002

When operators want to disclose a child's personal information to third parties or make it publicly available (for example, through a chat room or message board), the sliding scale requires them to use a more reliable method of consent, including: · getting a signed form from the parent via postal mail or facsimile; · accepting and verifying a credit car d number in connection with a transaction; · taking calls from parents, through a toll-free telephone number staffed by trained personnel; · e-mail accompanied by digital signature; But in the case of a monitored chat room, if all individually identifiable information is stripped from postings before it is made public - and the information is deleted from the operator's records - an operator does not have to get prior parental consent.
Disclosures to Third Parties

An operator must give a parent the option to agree to the collection and use of the child's personal information without agreeing to the disclosure of the information to third parties. However, when a parent agrees to the collection and use of their child's personal information, the operator may release that information to others who use it solely to provide support for the internal operations of the Web site or service, including technical support and order fulfillment.

In October 2001, the Commission will seek public comment to determine whether technology has progressed and whether secure electronic methods for obtaining verifiable parental consent are widely available and affordable. Subject to the

3

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 8 of 20

Commission's review, the sliding scale will expire in April 2002. Until then, operators are encouraged to use the more reliable methods of consent for all uses of children's personal information.
New Notice for Consent

· taking calls from parents on a toll-free telephone number staffed by trained personnel; · e-mail accompanied by digital signature; · e-mail accompanied by a PIN or password obtained through one of the verification methods above.
Operators who follow one of these procedures acting in good faith to a request for parental access are protected from liability under federal and state law for inadvertent disclosures of a child's information to someone who purports to be a parent. Revoking & Deleting

An operator is required to send a new notice and request for consent parentsif there are to material changes in the collection, use or disclosure practices to which the parent had previously agreed. Take the case of the operator who got parental consent for a child to participate in contests that require the child to submit limited personal information, but who now wants to offer the child chat rooms. Or, consider the case of the operator who wants to disclose the child's information to third parties who are in materially different lines of business from those covered by the original consent - for example, marketers of diet pills rather than marketers of stuffed animals. In these cases, the Rule requires new notice and consent.

ACCESS
Verification

At a parent's request, operators must disclose the general kinds of personal information they collect online from children (for example, name, address, telephone number, e-mail address, hobbies), as well as the specific information collected from children who visit their sites. Operators must use reasonable procedures to ensure they are dealing with the child's parent before they provide access to the child's specific information. They can use a variety of methods to verify the parent's identity, including: · obtaining a signed form from the parent via postal mail or facsimile; · accepting and verifying a credit card number;

At any time, a parent may revoke his/her consent, refuse to allow an operator to further use or collect their child's personal information, and direct the operator to delete the information. In turn, the operator may terminate any service provided to the child, but only if the information at issue is reasonably necessary for the child's participation in that activity. For example, an operator may requir e children to provide their e-mail addresses to participate in a chat room so the operator can contact a youngster if he is misbehaving in the chat room. If, after giving consent, a parent asks the operator to delete the child's information, the operator may refuse to allow the child to participate in the chat room in the future. If other activities on the Web site do not require the child's e-mail address, the operator must allow the child access to those activities.

TIMING
The Rule covers all personal information collected after April 21, 2000, regardless of any prior relationship an operator has had with a child. For example, if an operator collects the name and e-mail address of a child before April 21, 2000, but plans to seek information about the child's street address after that date, the later collection

4

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 9 of 20

would trigger the Rule's requirements. In addition, come April 21, 2000, if an operator continues to offer activities that involve the ongoing collection of information from children - like a chat room - or begins to offer such activities for the first time, notice and consent are required for all participating children regardless of whether the children had already registered at the site.

Specifically, it is a deceptive practice under Section 5 to represent that a Web site is collecting personal identifying information from a child for one reason (say, to earn points to redeem a premium) when the information will be used for another reason that a parent would find material - and when the Web site does not disclose the other reason clearly or prominently.
In addition, an act or practice is unfair if the

SAFE HARBORS
Industry groups or others can create self-regulatory programs to govern participants' compliance with the Children's Online Privacy Protection Rule. These guidelines must include independent monitoring and disciplinary procedures and must be submitted to the Commission for approval. The Commission will publish the guidelines and seek public comment in considering whether to approve the guidelines. An operator's compliance with Commission-approved self-regulatory guidelines will generally serve as a "safe harbor" in any enforcement action for violations of the Rule.

injury it causes, or is likely to cause, is: · substantial; · not outweighed by other benefits; and · not reasonably avoidable. For example, it is likely to be an unfair practice in violation of Section 5 to collect personal identifying information from a child, such as e-mail address, home address or phone number, and disclose that information to a third party without giving parents adequate notice and a chance to control the collection and use of the information.

ENFORCEMENT
The Commission may bring enforcement actions and impose civil penalties for violations of the Rule in the same manner as for other Rules under the FTC Act. The Commission also retains authority under Section 5 of the FTC Act to examine information practices for deception and unfairness, including those in use before the Rule's effective date. In interpreting Section 5 of the FTC Act, the Commission has determined that a representation, omission or practice is deceptive it is if likely to: · mislead consumers; and · affect consumers' behavior or decisions about the product or service.

5

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 10 of 20

FOR MORE INFORMATION
If you have questions about the Children's Online Privacy Protection Act, or the FTC's Final Rule, visit the FTC online at www.ftc.gov/kidzprivacy. You also may call the FTC toll free at 1.877.FTC.HELP (1.877.382.4357), or write Consumer Response Center, Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580. You also can contact The DMA's Ethics and Consumer Affairs Department at 202.955.5030 or [email protected].

YOUR OPPORTUNITY TO COMMENT
The Small Business and Agriculture Regulatory Enforcement Ombudsman and 10 Regional Fairness Boards collect comments from small businesses about federal enforcement actions. Each year, the Ombudsman evaluates enforcement activities and rates each agency's responsiveness to small business. To comment on FTC actions, call 1.888.734.3247.

CREATE A PRIVACY POLICY IN COMPLIANCE WITH THIS LAW
The DMA created a privacy policy tool to help your company create its notice to families on how it handles information collected from children. See the Children's Privacy Policy Generator at The DMA's Web site: www.the-dma.org.

6

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 11 of 20

TITLE XIII-CHILDREN'S ONLINE PRIVACY PROTECTION
SEC. 1301. SHORT TITLE.
This title may be cited as the "Children's Online Privacy Protection Act of 1998".

SEC. 1302. DEFINITIONS.
In this title: (1) CHILD.-The term "child" means an individual under the age of 13. (2) OPERATOR.-The term "operator"(A) means any person who operates a website located on the Internet or an online service and who collects or maintains personal information from or about the users of or visitors to such website or online service, or on whose behalf such information is collected or maintained, where such website or online service is operated for commercial purposes, including any person offering products or services for sale through that website or online service, involving commerce(i) among the several States or with 1 or more foreign nations; (ii) in any territory of the United States or in the District of Columbia, or between any such territory and(I) another such territory; or (II) any State or foreign nation; or (iii) between the District of Columbia and any State, territory, or foreign nation; but (B) does not include any nonprofit entity that would otherwise be exempt from coverage under section 5 of the Federal Trade Commission Act (15 U.S.C. 45). (3) COMMISSION.-The term "Commission" means the Federal Trade Commission. (4) DISCLOSURE.-The term "disclosure" means, with respect to personal information(A) the release of personal information collected from a child in identifiable form by an operator for any purpose, except where such information is provided to a person other than the operator who provides support for the internal operations of the website and does not disclose or use that information for any other purpose; and (B) making personal information collected from a child by a website or online service directed to children or with actual knowledge that such information was collected from a child, publicly available in identifiable form, by any means including by a public posting, through the Internet, or through(i) a home page of a website; (ii) a pen pal service;

7

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 12 of 20

(iii) an electronic mail service; (iv) a message board; or (v) a chat room. (5) FEDERAL AGENCY.-The term "Federal agency" means an agency, as that term is defined in section 551(1) of title 5, United States Code. (6) INTERNET.-The term "Internet" means collectively the myriad of computer and telecommunications facilities, including equipment and operating software, which comprise the interconnected worldwide network of networks that employ the Transmission Control Protocol/ Internet Protocol, or any predecessor or successor protocols to such protocol, to communicate information of all kinds by wire or radio. (7) PARENT.-The term "parent" includes a legal guardian. (8) PERSONAL INFORMATION.-The term "personal information" means individually identifiable information about an individual collected online, including(A) a first and last name; (B) a home or other physical address including street name and name of a city or town; (C) an e-mail address; (D) a telephone number; (E) a Social Security number; (F) any other identifier that the Commission determines permits the physical or online contacting of a specific individual; or (G) information concerning the child or the parents of that child that the website collects online from the child and combines with an identifier described in this paragraph. (9) VERIFIABLE PARENTAL CONSENT.-The term "verifiable parental consent" means any reasonable effort (taking into consideration available technology), including a request for authorization for future collection, use, and disclosure described in the notice, to ensure that a parent of a child receives notice of the operator's personal information collection, use, and disclosure practices, and authorizes the collection, use, and disclosure, as applicable, of personal information and the subsequent use of that information before that information is collected from that child. (10) WEBSITE OR ONLINE SERVICE DIRECTED TO CHILDREN.(A) IN GENERAL.-The term "website or online service directed to children" means(i) a commercial website or online service that is targeted to children; or (ii) that portion of a commercial website or online service that is targeted to children. (B) LIMITATION.-A commercial website or online service, or a portion of a commercial website or online service, shall not be deemed directed to children solely for referring or linking to a commercial website or online service directed to children by using information location tools, including a directory, index, reference, pointer, or hypertext link. (11) PERSON.-The term "person" means any individual, partnership, corporation, trust, estate, cooperative, association, or other entity.

8

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 13 of 20

(12) ONLINE CONTACT INFORMATION.-The term "online contact information" means an email address or another substantially similar identifier that permits direct contact with a person online.

SEC. 1303. REGULATION OF UNFAIR AND DECEPTIVE ACTS AND PRACTICES IN CONNECTION WITH THE COLLECTION AND USE OF PERSONAL INFORMATION FROM AND ABOUT CHILDREN ON THE INTERNET. (a) ACTS PROHIBITED.(1) IN GENERAL.-It is unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under subsection (b). (2) DISCLOSURE TO PARENT PROTECTED.-Notwithstanding paragraph (1), neither an operator of such a website or online service nor the operator's agent shall be held to be liable under any Federal or State law for any disclosure made in good faith and following reasonable procedures in responding to a request for disclosure of personal information under subsection (b)(1)(B)(iii) to the parent of a child.

(b) REGULATIONS.(1) IN GENERAL.-Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate under section 553 of title 5, United States Code, regulations that(A) require the operator of any website or online service directed to children that collects personal information from children or the operator of a website or online service that has actual knowledge that it is collecting personal information from a child(i) to provide notice on the website of what information is collected from children by the operator, how the operator uses such information, and the operator's disclosure practices for such information; and (ii) to obtain verifiable parental consent for the collection, use, or disclosure of personal information from children; (B) require the operator to provide, upon request of a parent under this subparagraph whose child has provided personal information to that website or online service, upon proper identification of that parent, to such parent (i) a description of the specific types of personal information collected from the child by that operator; (ii) the opportunity at any time to refuse to permit the operator's further use or maintenance in retrievable form, or future online collection, of personal information from that child; and (iii) notwithstanding any other provision of law, a means that is reasonable under the circumstances for the parent to obtain any personal information collected from that child;

9

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 14 of 20

(C) prohibit conditioning a child's participation in a game, the offering of a prize, or another activity on the child disclosing more personal information than is reasonably necessary to participate in such activity; and (D) require the operator of such a website or online service to establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children. (2) WHEN CONSENT NOT REQUIRED.-The regulations shall provide that verifiable parental consent under paragraph (1)(A)(ii) is not required in the case of(A) online contact information collected from a child that is used only to respond directly on a one-time basis to a specific request from the child and is not used to recontact the child and is not maintained in retrievable form by the operator; (B) a request for the name or online contact information of a parent or child that is used for the sole purpose of obtaining parental consent or providing notice under this section and where such information is not maintained in retrievable form by the operator if parental consent is not obtained after a reasonable time; (C) online contact information collected from a child that is used only to respond more than once directly to a specific request from the child and is not used to recontact the child beyond the scope of that request(i) if, before any additional response after the initial response to the child, the operator uses reasonable efforts to provide a parent notice of the online contact information collected from the child, the purposes for which it is to be used, and an opportunity for the parent to request that the operator make no further use of the information and that it not be maintained in retrievable form; or (ii) without notice to the parent in such circumstances as the Commission may determine are appropriate, taking into consideration the benefits to the child of access to information and services, and risks to the security and privacy of the child, in regulations promulgated under this subsection; (D) the name of the child and online contact information (to the extent reasonably necessary to protect the safety of a child participant on the site)(i) used only for the purpose of protecting such safety; (ii) not used to recontact the child or for any other purpose; and (iii) not disclosed on the site, if the operator uses reasonable efforts to provide a parent notice of the name and online contact information collected from the child, the purposes for which it is to be used, and an opportunity for the parent to request that the operator make no further use of the information and that it not be maintained in retrievable form; or (E) the collection, use, or dissemination of such information by the operator of such a website or online service necessary(i) to protect the security or integrity of its website; (ii) to take precautions against liability; (iii) to respond to judicial process; or (iv) to the extent permitted under other provisions of law, to provide information to law enforcement agencies or for an investigation on a matter related to public safety.

10

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 15 of 20

(3) TERMINATION OF SERVICE.-The regulations shall permit the operator of a website or an online service to terminate service provided to a child whose parent has refused, under the regulations prescribed under paragraph (1)(B)(ii), to permit the operator's further use or maintenance in retrievable form, or future online collection, of personal information from that child. (c) ENFORCEMENT.-Subject to sections 1304 and 1306, a violation of a regulation prescribed under subsection (a) shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)). (d) INCONSISTENT STATE LAW.-No State or local government may impose any liability for commercial activities or actions by operators in interstate or foreign commerce in connection with an activity or action described in this title that is inconsistent with the treatment of those activities or actions under this section.

SEC. 1304. SAFE HARBORS. (a) GUIDELINES.-An operator may satisfy the requirements of regulations issued under section
1303(b) by following a set of self-regulatory guidelines, issued by representatives of the marketing or online industries, or by other persons, approved under subsection (b).

(b) INCENTIVES.(1) SELF-REGULATORY INCENTIVES.-In prescribing regulations under section 1303, the Commission shall provide incentives for self-regulation by operators to implement the protections afforded children under the regulatory requirements described in subsection (b) of that section. (2) DEEMED COMPLIANCE.-Such incentives shall include provisions for ensuring that a person will be deemed to be in compliance with the requirements of the regulations under section 1303 if that person complies with guidelines that, after notice and comment, are approved by the Commission upon making a determination that the guidelines meet the requirements of the regulations issued under section 1303. (3) EXPEDITED RESPONSE TO REQUESTS.-The Commission shall act upon requests for safe harbor treatment within 180 days of the filing of the request, and shall set forth in writing its conclusions with regard to such requests. (c) APPEALS.-Final action by the Commission on a request for approval of guidelines, or the failure to act within 180 days on a request for approval of guidelines, submitted under subsection (b) may be appealed to a district court of the United States of appropriate jurisdiction as provided for in section 706 of title 5, United States Code.

SEC. 1305. ACTIONS BY STATES. (a) IN GENERAL.(1) CIVIL ACTIONS.-In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of any person in a practice that violates any regulation of the Commission prescribed

11

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 16 of 20

under section 1303(b), the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction to(A) enjoin that practice; (B) enforce compliance with the regulation; (C) obtain damage, restitution, or other compensation on behalf of residents of the State; or (D) obtain such other relief as the court may consider to be appropriate. (2) NOTICE.(A) IN GENERAL.-Before filing an action under paragraph (1), the attorney general of the State involved shall provide to the Commission(i) written notice of that action; and (ii) a copy of the complaint for that action. (B) EXEMPTION.(i) IN GENERAL.-Subparagraph (A) shall not apply with respect to the filing of an action by an attorney general of a State under this subsection, if the attorney general determines that it is not feasible to provide the notice described in that subparagraph before the filing of the action. (ii) NOTIFICATION.-In an action described in clause (i), the attorney general of a State shall provide notice and a copy of the complaint to the Commission at the same time as the attorney general files the action.

(b) INTERVENTION.(1) IN GENERAL.-On receiving notice under subsection (a)(2), the Commission shall have the right to intervene in the action that is the subject of the notice. (2) EFFECT OF INTERVENTION.-If the Commission intervenes in an action under subsection (a), it shall have the right(A) to be heard with respect to any matter that arises in that action; and (B) to file a petition for appeal. (3) AMICUS CURIAE.-Upon application to the court, a person whose self-regulatory guidelines have been approved by the Commission and are relied upon as a defense by any defendant to a proceeding under this section may file amicus curiae in that proceeding.

(c) CONSTRUCTION.-For purposes of bringing any civil action under subsection (a),
nothing in this title shall be construed to prevent an attorney general of a State from exercising the powers conferred on the attorney general by the laws of that State to(1) conduct investigations; (2) administer oaths or affirmations; or (3) compel the attendance of witnesses or the production of documentary and other evidence.

(d) ACTIONS BY THE COMMISSION.-In any case in which an action is instituted by
or on behalf of the Commission for violation of any regulation prescribed under section 1303, no

12

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 17 of 20

State may, during the pendency of that action, institute an action under subsection (a) against any defendant named in the complaint in that action for violation of that regulation.

(e) VENUE; SERVICE OF PROCESS.(1) VENUE.-Any action brought under subsection (a) may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code. (2) SERVICE OF PROCESS.-In an action brought under subsection (a), process may be served in any district in which the defendant(A) is an inhabitant; or (B) may be found.

SEC. 1306. ADMINISTRATION AND APPLICABILITY OF ACT. (a) IN GENERAL. -Except as otherwise provided, this title shall be enforced by the Commission
under the Federal Trade Commission Act (15 U.S.C. 41 et seq.).

(b) PROVISIONS.-Compliance with the requirements imposed under this title shall be
enforced under(1) section 8 of the Federal Deposit Insurance Act (12 U.S.C. 1818), in the case of(A) national banks, and Federal branches and Federal agencies of foreign banks, by the Office of the Comptroller of the Cur rency; (B) member banks of the Federal Reserve System (other than national banks), branches and agencies of foreign banks (other than Federal branches, Federal agencies, and insured State branches of foreign banks), commercial lending companies owned or controlled by foreign banks, and organizations operating under section 25 or 25(a) of the Federal Reserve Act (12 U.S.C. 601 et seq. and 611 et seq.), by the Board; and (C) banks insured by the Federal Deposit Insurance Corporation (other than members of the Federal Reserve System) and insured State branches of foreign banks, by the Board of Directors of the Federal Deposit Insurance Corporation; (2) section 8 of the Federal Deposit Insurance Act (12 U.S.C. 1818), by the Director of the Office of Thrift Supervision, in the case of a savings association the deposits of which are insured by the Federal Deposit Insurance Corporation; (3) the Federal Credit Union Act (12 U.S.C. 1751 et seq.) by the National Credit Union Administration Board with respect to any Federal credit union; (4) part A of subtitle VII of title 49, United States Code, by the Secretary of Transportation with respect to any air carrier or foreign air carrier subject to that part; (5) the Packers and Stockyards Act, 1921 (7 U.S.C. 181 et seq.) (except as provided in section 406 of that Act (7 U.S.C. 226, 227)), by the Secretary of Agriculture with respect to any activities subject to that Act; and

13

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 18 of 20

(6) the Farm Credit Act of 1971 (12 U.S.C. 2001 et seq.) by the Farm Credit Administration with respect to any Federal land bank, Federal land bank association, Federal intermediate credit bank, or production credit association. (c) EXERCISE OF CERTAIN POWERS.-For the purpose of the exercise by any agency referred to in subsection (a) of its powers under any Act referred to in that subsection, a violation of any requirement imposed under this title shall be deemed to be a violation of a requirement imposed under that Act. In addition to its powers under any provision of law specifically referred to in subsection (a), each of the agencies referred to in that subsection may exercise, for the purpose of enforcing compliance with any requirement imposed under this title, any other authority conferred on it by law. (d) ACTIONS BY THE COMMISSION.-The Commission shall prevent any person from violating a rule of the Commission under section 1303 in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this title. Any entity that violates such rule shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act in the same manner, by the same means, and with the same jurisdiction, power, and duties as though all applicable terms and provisions of the Federal Trade Commission Act were incorporated into and made a part of this title. (e) EFFECT ON OTHER LAWS.-Nothing contained in the Act shall be construed to limit the authority of the Commission under any other provisions of law.

SEC. 1307. REVIEW.
Not later than 5 years after the effective date of the regulations initially issued under section 1303, the Commission shall(1) review the implementation of this title, including the effect of the implementation of this title on practices relating to the collection and disclosure of information relating to children, children's ability to obtain access to information of their choice online, and on the availability of websites directed to children; and (2) prepare and submit to Congress a report on the results of the review under paragraph (1).

SEC. 1308. EFFECTIVE DATE.
Sections 1303(a), 1305, and 1306 of this title take effect on the later of(1) the date that is 18 months after the date of enactment of this Act; or (2) the date on which the Commission rules on the first application filed for safe harbor treatment under section 1304 if the Commission does not rule on the first such application within one year after the date of enactment of this Act, but in no case later than the date that is 30 months after the date of enactment of this Act.

14

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 19 of 20

DIRECT MARKETING ASSOCIATION, INC.
The Direct Marketing Association (The DMA) is the largest trade association for businesses interested in database and interactive marketing, with more than 5,000 member companies from the United States and 53 other nations. Founded in 1917, its members include direct marketers from every business segment as well as the nonprofit sector. Included are catalogers, Internet retailers and service providers, financial services providers, book and magazine publishers, book and music clubs, retail stores, industrial manufacturers and the segments that support them. According to a DMA-commissioned study conducted by the WEFA Group, direct marketing sales in the United States exceeded $1.5 trillion in 1999. The DMA Web site is www.the-dma.org. Its consumer Web site is www.shopthenet.org.

THE INTERNET ALLIANCE
The Internet Alliance (IA) is the leading consumer Internet industry association representing the industry on the state, federal and international levels. Through public policy, advocacy, consumer outreach and strategic alliances, the IA is seeking to build the confidence and trust necessary for the Internet to become the massmarket medium of the 21st Century. The IA is an independent subsidiary of the Direct Marketing Association. Its Web site is www.internetalliance.org.

FEDERAL TRADE COMMISSION
The Federal Trade Commission (FTC) works for the consumer to prevent fraudulent, deceptive and unfair business practices in the marketplace and to provide information to help consumers spot, stop and avoid them. The FTC also publishes a series of publications to help businesses understand compliance requirements. Many are available at www.ftc.gov; click on Consumer Protection for a list of subjects. For printed copies, contact the FTC toll free at 1.877.FTC.HELP.

Case 3:08-cv-00639-SI

Document 4-2

Filed 01/30/2008

Page 20 of 20

Direct Marketing Association, Inc.

Internet Alliance

Federal Trade Commission

Headquarters:

1120 Avenue of the Americas New York, NY 10036-6700 212.768.7277 www.the-dma.org 1111 19th Street, NW, Suite 1100 Washington, DC 20036-3603 202.955.5030 www.the-dma.org

1111 19th Street, Suite 1180 Washington, DC 20036-3603 202.861.2491 www.internetalliance.org

For the Consumer 600 Pennsylvania Avenue, NW Washington, DC 20580 1.877.FTC.HELP www.ftc.gov

ETH 700I

JUNE 200

Case 3:08-cv-00639-SI

Document 4-3

Filed 01/30/2008

Page 1 of 4

ATTESTATION OF CONCURRENCE IN FILING
United States v. Industrious Kid, Inc. and Jeanette Symons, No. CV 08-0639 (N.D. Cal.)

In accord with the Northern District of California's General Order No. 45, Section X.(B), I attest that concurrence in the filing of this document has been obtained from each of the other signatories who are listed on the signature pages. In addition, pursuant to the final sentence of Section X.(B) of General Order No. 45, I am attaching a scanned image Of the s!gnature pages, signed by the parties, of the document being electronically filed, in lieu of maintaining the paper record for subsequent production if required.
Dated: January 30, 2008

/S/Mary M. Englehart MARY M. ENGLEHART (MD Bar - MD Bar does not issue bar numbers) Trial Attorney Office of Consumer Litigation U.S. Department of Justice P.O. Box 386 Washington, DC 20044 (202) 307-0088 [email protected]

Case 3:08-cv-00639-SI

Document 4-3

Filed 01/30/2008

Page 2 of 4

1 2 3 4 5 6 7 8 9 10 11 12 13 .14 15 16 17 18 19 20 21 22 23 24 25 26

Acting Assistant Attorney General Civil Division U.S. Department of Justice EUGENE M. THIROLF Director KENNETH L. JOST