[Code of Federal Regulations]
[Title 16, Volume 1]
[Revised as of January 1, 2006]
From the U.S. Government Printing Office via GPO Access
[CITE: 16CFR312.5]

[Page 384-385]
 
                     TITLE 16--COMMERCIAL PRACTICES
 
                   CHAPTER I--FEDERAL TRADE COMMISSION
 
PART 312_CHILDREN'S ONLINE PRIVACY PROTECTION RULE--Table of Contents
 
Sec. 312.5  Parental consent.

    (a) General requirements. (1) An operator is required to obtain 
verifiable parental consent before any collection, use, and/or 
disclosure of personal information from children, including consent to 
any material change in the collection, use, and/or disclosure practices 
to which the parent has previously consented.
    (2) An operator must give the parent the option to consent to the 
collection and use of the child's personal information without 
consenting to disclosure of his or her personal information to third 
parties.
    (b) Mechanisms for verifiable parental consent. (1) An operator must 
make reasonable efforts to obtain verifiable parental consent, taking 
into consideration available technology. Any method to obtain verifiable 
parental consent must be reasonably calculated, in light of available 
technology, to ensure that the person providing consent is the child's 
parent.
    (2) Methods to obtain verifiable parental consent that satisfy the 
requirements of this paragraph include: providing a consent form to be 
signed by the parent and returned to the operator by postal mail or 
facsimile; requiring a parent to use a credit card in connection with a 
transaction; having a parent call a toll-free telephone number staffed 
by trained personnel; using a digital certificate that uses public key 
technology; and using e-mail accompanied by a PIN or password obtained 
through one of the verification methods listed in this paragraph. 
Provided that: Until the Commission otherwise determines, methods to 
obtain verifiable parental consent for uses of information other than 
the ``disclosures'' defined by Sec. 312.2 may also include use of e-
mail coupled with additional steps to provide assurances that the person 
providing the consent is the parent. Such additional steps include: 
sending a confirmatory e-mail to the parent following receipt of 
consent; or obtaining a postal address or telephone number from the 
parent and confirming the parent's consent by letter or telephone call. 
Operators who use such methods must provide notice that the parent can 
revoke any consent given in response to the earlier e-mail.
    (c) Exceptions to prior parental consent. Verifiable parental 
consent is required prior to any collection, use and/or disclosure of 
personal information from a child except as set forth in this paragraph. 
The exceptions to prior parental consent are as follows:
    (1) Where the operator collects the name or online contact 
information of a parent or child to be used for the sole purpose of 
obtaining parental consent or providing notice under Sec. 312.4. If the 
operator has not obtained parental consent after a reasonable time from 
the date of the information collection, the operator must delete such 
information from its records;
    (2) Where the operator collects online contact information from a 
child for the sole purpose of responding directly on a one-time basis to 
a specific request from the child, and where such information is not 
used to recontact the child and is deleted by the operator from its 
records;
    (3) Where the operator collects online contact information from a 
child to be used to respond directly more than once to a specific 
request from the child, and where such information is not used for any 
other purpose. In such cases, the operator must make reasonable efforts, 
taking into consideration available technology, to ensure that a parent 
receives notice and has the opportunity to request that the operator 
make no further use of the information, as described in Sec. 312.4(c), 
immediately after the initial response and before making any additional 
response to the child. Mechanisms to provide such notice include, but 
are not limited to, sending the notice by postal mail or sending the 
notice to the parent's e-mail address, but do not include asking a child 
to print a notice form or sending an e-mail to the child;
    (4) Where the operator collects a child's name and online contact 
information to the extent reasonably necessary to protect the safety of 
a child participant on the website or online service, and the operator 
uses reasonable efforts to provide a parent notice as described in Sec. 
312.4(c), where such information is:

[[Page 385]]

    (i) Used for the sole purpose of protecting the child's safety;
    (ii) Not used to recontact the child or for any other purpose;
    (iii) Not disclosed on the website or online service; and
    (5) Where the operator collects a child's name and online contact 
information and such information is not used for any other purpose, to 
the extent reasonably necessary:
    (i) To protect the security or integrity of its website or online 
service;
    (ii) To take precautions against liability;
    (iii) To respond to judicial process; or
    (iv) To the extent permitted under other provisions of law, to 
provide information to law enforcement agencies or for an investigation 
on a matter related to public safety.

[64 FR 59911, Nov. 3, 1999, as amended at 67 FR 18821, Apr. 17, 2002; 70 
FR 21106, Apr. 22, 2005]