Food For Thought

Hershey, Mrs. Fields Fined for Violating Children's Online Privacy

February 27, 2003

• Sony BMG to Pay $1 Million for Violating Children's Privacy • Texas Reins in Santa.com • Texas Sues Kids' Web Sites • Xanga.com Fined for Children's Privacy Violations • FTC "Concerned" About MySpace & Other Networking Sites • Hershey, Mrs. Fields Fined for Violating Children's Online Privacy • Jolly Time Web Site Fined $10,000 for Violating Children's Privacy • Three Web Sites Fined For Violating Children's Privacy • Girls Web Site Fined $25,000 On FTC Privacy Charges

Mrs. Fields Cookies and Hershey Foods Corporation have each agreed to settle Federal Trade Commission charges that their Web sites violated the Children's Online Privacy Protection Act (COPPA) Rule by collecting personal information from children without first obtaining the proper parental consent.

Mrs. Fields will pay civil penalties of $100,000 and Hershey will pay $85,000. The separate settlements bar the companies from violating the rule in the future and represent the biggest COPPA penalties awarded to date.

"These settlements offer food for thought for anyone who operates a Web site that caters to kids," said Howard Beales, Director of the FTC's Bureau of Consumer Protection. "If your Web site collects personal information from children, comply with the law or face the consequences."

The COPPA Rule applies to operators of commercial Web sites and online services directed to children under the age of 13 and to general audience Web sites and online services that knowingly collect personal information from children under 13. Among other things, the Rule requires that Web site operators obtain verifiable consent from a parent or guardian before they collect personal information from children.

According to the FTC complaints, the Mrs. Fields and Hershey sites each violated the COPPA Rule when they failed to obtain verifiable parental consent before collecting personal information from children under 13. In addition, the sites allegedly failed to post adequate privacy policies, to provide direct notice to parents about the information they were collecting and how it would be used, and to provide a reasonable means for parents to review the personal information collected from their children and to refuse to permit its further use.

Mrs. Fields Cookies

According to the FTC, portions of Mrs. Fields' Web sites - mrsfields.com, pretzeltime.com, and pretzelmaker.com - were directed to children. These Web pages offered birthday clubs for children 12 or under and provided birthday greetings and coupons for free cookies or pretzels. While Mrs. Fields did not disseminate the information it collected to third parties, the company allegedly collected personal information - including full name, home address, e-mail address and birth date - from more than 84,000 children, without first obtaining parental consent.

Hershey Foods Corporation

Hershey operates more than 30 Web sites - many of which are candy-related sites directed to children. On a number of these sites, the company allegedly employed a method of obtaining parental consent that does not meet the standard delineated under the COPPA Rule. Specifically, Hershey instructed children under 13 to have their parents fill in an online parental consent form. The FTC alleges the company took no steps to ensure that a parent or guardian saw or filled out the consent forms. The FTC further alleges that even if a parent or guardian did not submit information on the consent form, the company proceeded to collect personal information - including full name, home address, e-mail address and age - from children. According to the complaint, this method of obtaining parental consent was not reasonably calculated to ensure that the person providing consent was the child's parent. This is the first COPPA case to challenge a company's method of obtaining parental consent.

Back to the top | News Index