A Sweet Victory for Kids’ Privacy

In settlements that the Federal Trade Commission called “food for thought,” two of the nation’s biggest name brands in the candy and cookies market agreed to settle charges that their Web sites illegally collected personal data from children.

Both Mrs. Fields Cookies, a privately held, Salt Lake City-based franchise operation, and publicly traded Hershey Foods Corp. signed consent decrees to settle charges that they had violated the Children’s Online Privacy Protection Act (COPPA).

They were accused of collecting personal information from children without first obtaining proper parental consent.

Mrs. Fields will pay civil penalties of $100,000 and Hershey will pay civil penalties of $85,000. The separate settlements bar the companies from violating the COPPA Rule in the future and represent the biggest penalties awarded to date under the measure, the FTC said.

“If your Web site collects personal information from children, comply with the law or face the consequences,” said Howard Beales, director of the FTC’s Bureau of Consumer Protection. The COPPA Rule applies to operators of commercial Web sites and online services directed to children under the age of 13.

According to the FTC, portions of Mrs. Fields’ Web sites – mrsfields.com, pretzeltime.com, and pretzelmaker.com — were directed to children. These Web pages offered birthday clubs for children 12 or under and provided birthday greetings and coupons for free cookies or pretzels. While Mrs. Fields did not disseminate the information it collected to third parties, the company allegedly collected personal information — including full name, home address, e-mail address and birth date — from more than 84,000 children without first obtaining parental consent.

Hershey operates more than 30 Web sites – many of which are candy-related sites directed to children. On a number of these sites, the company allegedly employed a method of obtaining parental consent that does not meet the standard delineated under the COPPA Rule. Specifically, Hershey instructed children under 13 to have their parents fill in an online parental consent form. The FTC alleges the company took no steps to ensure that a parent or guardian actually saw or filled out the consent forms. The FTC further alleges that even if a parent or guardian did not submit information on the consent form, the company proceeded to collect personal information — including full name, home address, e-mail address and age — from children.

The also require that the companies delete any information collected in violation of COPPA.