FC: Child "privacy" law claims another victim: Altavista yanks sites

[Declan McCullagh <declan () well com>]

AltaVista said today that it "has closed down all of its community
services, which includes all interactive services, such as chat rooms,
bulletin boards and free email.  AltaVista is committed to screening
children under the age of 13 from accessing adult content on the
AltaVista Web site."

The BBB's CARU says "it found violations of the Guidelines and/or
COPPA." COPPA is the federal law that applies here, and the guidelines
were inspired by federal action.

COPPA has forced other companies to shut down free services too (funny
how its backers never mentioned its negative impacts when testifying
before an all-too-credulous, not to mention economically ignorant and
technically clueless Congress):
http://www.politechbot.com/cgi-bin/politech.cgi?name=coppa

News coverage:
http://news.cnet.com/news/0-1005-200-4820233.html?tag=mn_hd

One interesting bit from the BBB statement:
> While some "adults only" clubs required registration, others did not,
> and there was no need to register, or even give one's age, in order to
> view the pictures.  Despite statements that one must be over age 18 to
> enter, in fact, a child of any age, by merely clicking "OK," could
> certify that she was over age 18 and gain access to the rooms.  No
> request for date of birth or any other personal information was
> required.  Even users registered as age 13 were admitted to these
> "Clubs."

(Let's ignore that fact that a so-called "privacy" law is encouraging
sites to collect "personal information" about their visitors.)

Well, gosh darnit. Wasn't that what the ACLU litigated -- and won --
in the CO-oneP-A lawsuit? An entire section of the district court's
opinion was devoted to "Reorganizing a Web Site to Segregate Harmful
to Minors Materials." See:
http://www.aclu.org/court/acluvrenoII_pi_order.html

Civil libertarians quite properly objected to that
register-or-segregate approach, saying that the government should not
place additional burdens on First Amendment-protected speech. See:
http://www.politechbot.com/cgi-bin/politech.cgi?name=copa

What the censorhappy anti-porn folks failed to accomplish by a law
punishing sexually explicit material, they're managing to accomplish
through "privacy" laws instead.

We'll ban Net-sex not by claiming a child's innocence is being
violated, but that his privacy is. Ain't that just swell?

-Declan

***********

DECISION TO FOLLOW

CARU NEWS       Contact: Elizabeth Lascoutx
                         212.705.0123  or
                        Phyllis Spaeth
                        212-705-0117

FOR IMMEDIATE RELEASE



ALTA VISTA MAKES CHANGES TO PROTECT THE SAFETY OF CHILDREN ON ITS WEBSITE.
COMPANY DISCONTINUES ITS "COMMUNITY" FEATURES

New York, NY - February 14, 2001 - The Children's Advertising Review Unit
(CARU) of the Council of Better Business Bureaus, Inc. (CBBB) is pleased to
announce that Alta Vista Company (Alta Vista) has modified its Website in
order to protect the safety of children.  Until a week ago, Alta Vista was a
full service Internet portal that, in addition to its search engine, offered
such interactive features as chat rooms, photo albums, personal home pages
and free Internet service including free email.

When CARU examined altavista.com in the fall of 2000, the language of the
registration page "tipped off" children that they must be over age 13 to use
the interactive services offered on the site by stating "U.S. law prohibits
Alta Vista from registering anyone under the age of 13 without parental
permission. Please verify your age below," and then asking prospective
registrants if they were "less than 13 years old" or "13 or older..."  Those
who registered could freely access all interactive features on the site,
including unmoderated chat rooms in which participants could post personal
information and talk to users of all ages, and personal home pages, on which
registrants could post personal information that would be accessible to
other users of the Internet.  

In addition, Alta Vista failed to prevent children and teens from
registering for chat rooms listed under "romance and relationships," which
were "adults only" clubs, or to block those under 13 from accessing
pornographic pictures on its chat sites. While some "adults only" clubs
required registration, others did not, and there was no need to register, or
even give one's age, in order to view the pictures.  Despite statements that
one must be over age 18 to enter, in fact, a child of any age, by merely
clicking "OK," could certify that she was over age 18 and gain access to the
rooms.  No request for date of birth or any other personal information was
required.  Even users registered as age 13 were admitted to these "Clubs."  

Alta Vista has recently closed down all its "Community" services (i.e., all
its interactive services, such as chat rooms, bulletin boards and free
email) and now operates solely as a search engine.  The company stated,
"AltaVista is committed to screening children under the age of 13 from
accessing adult content on the AltaVista Web site."  There is no longer any
registration or collection of personal information on the site. 



CARU's inquiry was conducted under NAD/NARB/CARU Procedures for Voluntary
Self-Regulation of National Advertising.  Details of the inquiry, CARU's
decision and the advertiser's response will be included in the next NAD Case
Report.  Members of the press who wish to see a copy of the decision now
should email CARU at elascoutx () caru bbb org or pspaeth () caru bbb org.  

                                                ###

The National Advertising Review Council (NARC) was formed in 1971 by the
Association of National Advertisers, Inc. (ANA), the American Association of
Advertising Agencies, Inc. (AAAA), the American Advertising Federation, Inc.
(AAF), and the Council of Better Business Bureaus, Inc. (CBBB).  Its purpose
is to foster truth and accuracy in national advertising through voluntary
self-regulation.  NARC is the body that establishes the policies and
procedures for the CBBB's National Advertising Division (NAD), the
Children's Advertising Review Unit (CARU), and the National Advertising
Review Board (NARB).


NAD and CARU are the investigative arms of the advertising industry's
voluntary self-regulation program.  Their casework results from competitive
challenges from other advertisers, and also from self-monitoring traditional
and new media, including the Internet.  The National Advertising Review
Board (NARB), the appeals body, is a peer group from which ad-hoc panels are
selected to adjudicate those cases that are not resolved at the NAD/CARU
level.  This unique, self-regulatory system is funded entirely by the
business community; CARU is financed by the children's advertising industry,
while NAD/NARB's sole source of funding is derived from membership fees paid
to the Council of Better Business Bureaus.

**********

ALTA VISTA COMPANY
Alta Vista Website
Altavista.com

        *       General interest Websites that have knowledge that children
under age 13 are on their site should not encourage those children to
misstate their ages in order to register for areas that are intended for
those over 13.

        *       General interest Websites that offer areas with "adult only"
content (for those age 18 and over), should age-screen for users under that
age and prevent children under that age from accessing those areas.

Basis of Inquiry:  In the fall of 2000, altavista.com came to the attention
of the Children's Advertising Review Unit (CARU) through its routine
monitoring of the Internet.   At that time, altavista.com was a full service
Internet portal that, in addition to its search engine, offered such
interactive features as chat rooms, photo albums, personal home pages and
free Internet service including free email.

CARU monitors Websites for compliance with CARU's Self-Regulaory Guidelines
for Children's Advertising (the Guidelines) as well to the federal
Children's Online Privacy Protection Act (COPPA). The Guidelines and COPPA
mandate prior parental permission before site operators can collect
personally identifiable information (PII) (e.g., first and last name, email
address, street address, etc.).  Because the operator acknowledges in its
Privacy Policy that children under age 13 could use its site, the site falls
under the jurisdiction of CARU. 

CARU's Findings:  When CARU first examined altavista.com, (AV) it found
violations of the Guidelines and/or COPPA involving the following:

1. Use of registration language that encourages children under age 13 to
misstate their ages. 
2. Failure to adequately prevent children from accessing altavista.com clubs
(chat rooms) with "adult only" content. 

Use of Language that Encourages Misstatement of Age/Failure to Use Tracking
Mechanism:  Despite the following language in Alta Vista's privacy policy, 

                "Our site complies with the terms of the Children's Online
Privacy Protection Act.  We will not knowingly collect personally
identifiable information on users under the age of 13 without parental
consent.  Parents have the ability to control what personal information
about their child may be disclosed to third parties..." 

children under age 13 could easily register for AV and use its interactive
services, such as chat rooms and free email, without parental consent.  This
was true for two reasons: First, children underage 13 were "tipped off"
regarding the age of admission for these services and therefore could easily
register for altavista.com and use its interactive services by claiming to
be 13 or over.  AV's registration page, directly before asking for date of
birth, contained the following statement:

                "U.S. law prohibits Alta Vista from registering anyone under
the age of 13 without parental permission. Please verify your age below."

Prospective registrants were then asked to click on one of the following:
        *       "I am less than 13 years old"
        *       "I am 13 or older and my birthdate is
Month______  Day_____  Year_______"

This type of language is prohibited by the Guidelines, which state, inter
alia, "Care should be taken so that screening questions do not encourage
children to provide inaccurate information to avoid obtaining parental
permission." (Page 9 of the Guidelines).

Further, CARU determined that AV's registration process is also ineffective
because it does not utilize a tracking mechanism (such as a "session
cookie") to prohibit underage users from changing their ages and immediately
reregistering.  For example, if a child clicked on the second option, but
gave a date of birth that corresponded to an age younger than 13, a message
would appear as follows:

                "We're sorry, but in order to comply with recent U.S.
legislation called COPPA (Children's Online Privacy Protection Act), which
is intended to protect the privacy of kids less than 13 years of age, we
cannot register anyone under 13 years old at this time."  

Directly below this message, however, the potential registrant is presented
with her previously filled in personal information, including date of birth.
One can now change one's year of birth to reflect an age 13 or over, and
thereby gain entrance to any of the interactive features offered by the
operator.  When a CARU staff member, who had attempted to register as a 12
year old, was given this message, she merely changed the last digit on her
year of birth, from a 9 (in 1989) to a 6, and left everything else as it was
presented to her, and was easily able to be accepted as a registrant, with
full access to all interactive features.  CARU finds that the operator thus
had actual knowledge that there was a child under 13, and therefore is in
violation of the requirements of both the Guidelines and COPPA.

Inadequate Age-Screening for "Adults Only" Chat Rooms:  AV contains several
chat rooms, sometimes referred to as "clubs" on its Website, which are
designated "Adults Only."  If one clicks on one of the sites, for example,
"! 4-Dates Chat and Matchmaking!" a screen will appear stating:

                "ADULTS ONLY CLUB ! 4-Dates Chat and Matchmaking! Welcome.
The Club you are about to enter has been identified as containing adult
content.  Discussions and other postings might not be appropriate for all
users.  Before entering this Club or any Club that contains adult content
you must read and agree to the following:
                                1.      You are an adult ( 18 years or
older) and have read and understand the Adult 
                                Content Agreement...."

The user is then asked to click on either "OK" or "Cancel."  No request for
date of birth or any other personal information is required.  Even users
registered as age 13 are admitted to these "Clubs."  Although Alta Vista
acknowledges in its Privacy Policy that it has children under age 13 on its
site, the operator failed to insure that children under 13 could not
register for the chat rooms and failed to screen those under age 18 from
registering for its "adults only" clubs.  Anyone using the AV Website (even
those who have not registered, and therefore, regardless of age) is able to
access pornographic pictures on the site.   While some "adults only" clubs
require registration, others do not, and there is no need to register, or
even give one's age, in order to view pornographic pictures.  

In light of the fact that AV has knowledge that some of its users are 13 (or
even younger, as seen by their first attempt at registration), and
acknowledges that certain clubs should only be available to those age 18 or
over, CARU finds that the failure to screen out users under 18 from these
clubs is a violation of CARU's Guidelines and COPPA.

Advertiser's Position:  When contacted by CARU, the operator readily agreed
to change its registration page by removing any reference to the necessity
of being age 13 or over to register and substituting the following:



                "U.S. law requires that we ask your birthdate. Please verify
your age:
                Month______ day_____year______"

This change was made by mid-December of 2000.  The operator explained that
it had used the original registration statement because many adult users
were reluctant to give their correct age and were entering a year of birth
that would result in an age of less than one year.  Further, AV stated that
it expected to shut down its "Community" services (i.e., all its interactive
services, such as chat rooms, bulletin boards and free email) in the very
near future. 

In addition, when it was brought to the operator's attention that the AV
Website made pornography and inappropriate chat accessible to those under
age 18, and even those under 13, AV acknowledged the problem, stating that
"anonymous users may enter the adult areas of our community services by
confirming their age as over 18."  The operator asserted, however, that
because the company intended to close down all its "Community" services
(i.e., all its interactive services, such as chat rooms, bulletin boards and
free email) by the end of January or mid-February 2001, it did not need to
add the use of a tracking mechanism in the interim.  

DECISION

CARU is pleased that Alta Vista was willing to make expeditious changes in
its registration in order to avoid encouraging children to misstate their
ages.  Although the site still offered pornographic chat rooms on January
23, 2001, when CARU sent the operator its decision (including an admonition
to employ a method to prevent children under age 18 from accessing
pornography), CARU confirmed that, on February 6, when CARU received the
advertiser's statement, AV had closed down all of its community services and
offered no interactive features on its Website.  CARU is gratified that AV
has taken all the above-stated actions. 

Advertiser's Statement:  "Alta Vista has closed down all of its community
services, which includes all interactive services, such as chat rooms,
bulletin boards and free email.  AltaVista is committed to screening
children under the age of 13 from accessing adult content on the AltaVista
Web site."  

* 2001.  Council of Better Business Bureaus, Inc.
(#0000 pbs closed 2/7/01)
       
***********



-------------------------------------------------------------------------
POLITECH -- Declan McCullagh's politics and technology mailing list
You may redistribute this message freely if it remains intact.
To subscribe, visit http://www.politechbot.com/info/subscribe.html
This message is archived at http://www.politechbot.com/
-------------------------------------------------------------------------