Federal Trade Commission
Washington, DC
In the Matter of Amazon.com, Inc.
EPIC Complaint and Request for Injunction, Investigation and for Other Relief
INTRODUCTION
1. This complaint concerns the privacy practices of Amazon.com, Inc. ("Amazon"). As set forth in detail below, Amazon is violating the Children's Online Privacy Protection Act of 1998 ("COPPA"). Amazon is a major Internet retailer that directs portions of its web site towards children and, with actual knowledge of its actions, collects personal information from children. Under the COPPA, a company that engages in such activities must comply with specific statutory requirements. Despite the activities detailed herein, Amazon employs no apparent procedures to comply with COPPA. We urge the Commission to take immediate action to investigate the information collection, sharing, and disclosure practices of Amazon and to enjoin Amazon from violating the COPPA.
PARTIES
2. The Electronic Privacy Information Center ("EPIC") is a non-profit research organization incorporated in the District of Columbia. EPIC's activities include the review of government and private sector polices and practices to determine their possible impact on the privacy interests of the American public. Among its other activities, EPIC has prepared reports and presented testimony before Congress and administrative agencies on the Internet and privacy issues. EPIC has long supported protections for personal information of children collected on the Internet or through other means.[1]
3. Commercial Alert is a national nonprofit organization whose mission is to keep the commercial culture within its proper sphere, and to prevent it from exploiting children and subverting the higher values of family, community, environmental integrity and democracy.
4. Consumer Action is a San Francisco-based education and advocacy organization that has worked on banking, telecommunication and privacy issues for more than 30 years. It distributions more than two million pieces of multilingual consumer and privacy publications each year through its national network of more than 6,500 community based organizations.
5. Remar Sutton is the co-founder of the Privacy Rights Now Coalition. The Privacy Rights Now Coalition endeavors to publicize the efforts of key consumer groups in the country who deal with privacy issues.
6. The Center for Media Education is a national nonprofit organization dedicated to creating a quality electronic media culture for children and youth, their families and the community. CME's research focuses on the potential-and the peril-for children and youth of the rapidly evolving digital media age. Examining the issues and framing the discussion surrounding this emerging new media culture to move responsibly into the digital future is CME's major thrust. Over the years, CME has been the leading force in expanding both children's educational television programming and fostering television and Internet safeguard for children and teens.
7. Consumer Federation of America is a non-profit association of about 300 pro-consumer organizations, founding in 1967 to advance the consumer interest.
8. Junkbusters Corp. is a privacy advocacy firm that helps people get rid of junk messages of all kinds: spam, telemarketing calls, unwanted junk mail, junk faxes, and more. Its web site, junkbusters.com, is a leading consumer resource on the control of junk communications and the protection of privacy. Founded in April 1996 in Green Brook, New Jersey, Junkbusters Corp. is a small, privately-held for-profit corporation. The company works with governments, corporations, trade associations and public interest groups to further the goals of better privacy protection and stronger rights for individuals to control information about them and messages sent to them.
9. The Privacy Rights Clearinghouse is a nonprofit consumer information and advocacy program based in San Diego, California. Privacy Rights Clearinghouse is an advocate of consumers' privacy rights in local, state, and federal public policy proceedings, including legislative testimony, regulatory agency hearings, task forces, and study commissions as well as conferences and workshops.
10. The Media Access Project is a twenty-seven year old non-profit tax exempt public interest telecommunications law firm which promotes the public's First Amendment right to hear and be heard on the electronic media of today and tomorrow.
11. Privacyactivism is a non-profit organization whose goal is to enable people to make well-informed decisions about the importance of privacy on both a personal and societal level.
11a. Computer Professionals for Social Responsibility ("CPSR") provides the public and policymakers with realistic assessments of the power, promise, and problems of information technology. CPSR members work to direct public attention to critical choices concerning the applications of information technology and how those choices affect society.
12. Amazon.com, Inc. ("Amazon") is a publicly traded Internet retailer that was incorporated in 1994 in Washington State and reincorporated in 1996 in Delaware.[2] Amazon's principal office is located at 1200 12th Avenue South, Suite 1200, Seattle, Washington 98144-2734.[3] Amazon sells products from its web site at http://www.amazon.com that include "millions of unique new, used and collectible items in categories such as apparel and accessories, electronics, computers, kitchen and housewares, books, music, DVDs, videos, cameras and photo items, office products, toys, baby items and baby registry, software, computer and video games, cell phones and service, tools and hardware, travel services, magazine subscriptions and outdoor living items."[4] The acts and practices of Amazon are in or affecting commerce as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44. The Commission has the authority to enforce the COPPA under 15 U.S.C. § 6502 (c).
THE IMPORTANCE OF PRIVACY PROTECTION
13. The right of privacy is a fundamental right in the United States. The privacy of an individual is directly implicated by the collection, use, and dissemination of personal information. The opportunities for an individual to secure employment, insurance, and credit, to obtain medical services, and the rights of due process may be jeopardized by the misuse of certain personal information.
14. Children who use the Internet are at particular risk for privacy violations. Research conducted in 1996 by Kathryn Montgomery and Shelley Pasnik and published by the Center for Media Education ("CME"), showed that young children cannot understand the potential effects of revealing their personal information; neither can they distinguish between substantive material on websites and the advertisements surrounding it. Targeting of children by marketing techniques resulted in the release of huge amounts of private information into the market and triggered the need for the COPPA.
AMAZON IS IN VIOLATION OF COPPA
COPPA's Requirements
15. Congress enacted COPPA, 5 U.S.C. §§ 6501 et seq., to prohibit unfair or deceptive acts or practices in connection with the collection, use, or disclosure of personally identifiable information from and about children on the Internet. For purposes of COPPA, a "child" is any person under the age of 13. The Act sets forth responsibilities for operators of web sites directed at children, or where the operator has knowledge that children's personal information is collected through the site. Before collecting, using, or disclosing personal information from children, a web site operator must:
Provide notice of information practices to the parent; obtain prior verifiable parental consent for the collection, use, or disclosure of personal information from children; provide a parent, upon request, with the means to review the personal information collected from his/her child; provide a parent with the opportunity to prevent the further use of personal information that has already been collected, or the future collection of personal information from that child; and establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of the personal information collected.[5]
STATEMENT OF FACTS
Amazon's Privacy Policy and Information Collection Practices
16. Amazon displays a privacy policy on its web site that is attached as Exhibit A.[6] That policy states that visitors to Amazon's web site are bound by the policy. The policy summarizes the different ways in which Amazon collects information in order to "personalize" content on the site. Additionally, the privacy policy sets forth terms for accessing stored personal information, but provides no apparent method for customer deletion of personal information.
17. Amazon's privacy policy contains one section that references collection of children's personal information:
Children
Amazon.com does not sell products for purchase by children. We sell children's products for purchase by adults. If you are under 18, you may use Amazon.com only with the involvement of a parent or guardian.[7]
18. Amazon allows users to write and post reviews of products sold on its web site. In order to do so, Amazon requires the user to register. The first step of this process requires the individual to transmit an e-mail address (see Exhibit B attached hereto). The user is then forwarded to a screen where he or she must provide his or her name and birth date (but not birth year) (see Exhibit C attached hereto).
19. Amazon's only apparent COPPA compliance mechanism is incorporated in this review system. In the first step of the registration process, Amazon provides a link labeled "Under 13? Use our Kid's Review Form" (see Exhibit B). In repeated visits to the Amazon site, this link did not direct the browser to the Kid's Review Form; instead, the user was forwarded back to the product page that the user was attempting to review.
Amazon Monitors Reviews Posted on its Site
20. When writing product reviews, registered users (i.e., those who have provided personally identifiable information) are directed to a page containing a text box for entry of information about the product (see Exhibit D attached hereto). That page contains a section stating that Amazon holds reviews for five to seven business days before they are posted, and that Amazon monitors reviews posted on the site:
The Fine Print:
All submitted reviews are subject to the license terms set forth in our Conditions
of Use.
Your reviews will be posted within five to seven business days.
Submissions that do not follow our review guidelines will not be posted.
21. Amazon clearly examines the content of reviews submitted for posting. Amazon's "General Review Writing Guidelines" (attached hereto as Exhibit E) specify that certain information, including profanity, single-word reviews, and typographical errors should not be submitted in a review. The guidelines specify that: "Any review in violation of these guidelines will not be posted."
Amazon's Sale of Children's Toys and Other Products
on Child-Directed Portions of the Web Site
22. Amazon's privacy policy specifies that it sells products from children's stores, including Toysrus.com, Babiesrus.com, and Imaginarium.com.[8] The Amazon web site features a "Toy Store" page, a copy of which is attached hereto as Exhibit F.[9] Amazon markets children's products on the Toy Store page. Amazon uses brightly-colored tabs to designate portions of the site that contain children's books, children's videos, children's music, and children's software. Amazon uses colorful and child-like fonts for this portion of the site, while other portions of the site devoted to adult products lack such child-oriented decoration. Amazon's Toy Store page features child models to assist in selecting age ranges for products. Amazon markets gifts for children from Barbie, Sony, Playskool, Tonka, and the Transformers on its Toy Store page. Child-oriented cartoon characters also appear on this portion of the site, including a giraffe, a "Yu-Gi-Oh!" action figure, an image of a Barbie head, and the insignia for the Transformers' "Autobots."
23. Individuals who browse to http://www.toyrsus.com, http://www.babiesrus.com/, or http://www.imaginarium.com are redirected to Amazon's "Toy Store" or a similar page that is directed to children. It is likely that many children locate and visit Amazon's Toy Store site when shopping for toys online. In fact, Amazon's "Toy Store" page is the first result returned when one searches for "Toys" on Google.com.[10]
Amazon's Collection and Disclosure of Children's Personal Information
Associated With Product Reviews and Personalization Features
24. A cursory search of Amazon's web site indicates that a number of individuals under the age of 13 are registered users. As explained in ¶¶18-19, supra, these users have registered with Amazon, and thus Amazon has obtained their e-mail addresses and names. Further, some of the children who have registered with Amazon have posted personal information, including full name, e-mail address, age, gender, and full address.
25. One registered reviewer on Amazon's web site employs the username "[REDACTED]." This user, whose name is listed as "[REDACTED]," has listed his full physical address on the Amazon web site (see Exhibit G attached hereto):
Name: [REDACTED]
Nickname: [REDACTED]
Reviewer Rank: [REDACTED]
About me: I live in New York City. My address is [REDACTED]. I play with my trains and do fun stuff. My favorite all time movie is Thomas and the Magic Railroad and Hey Arnold! the movie. If I had a day off from work I would go to the movies with a friend. If I had an amazon gift certificate I would buy Hey Arnold and Thomas & Friends stuff. Russell Hill gave me a gift certificate when I was 10 years old. I'm a DVD Collector. When I get DVDs I do both Renting and Buying. When I get Videos I rent them.
26. User [REDACTED] has a posted review displayed on Amazon's site for a children's product titled "Thomas & The Magic Railroad: Original Motion Picture Soundtrack." In this review, the user stated that he was 10 years old when the text was written and posted. The review (attached hereto as Exhibit H) states:
Great to the movie, October 18, 2001
Reviewer: [REDACTED]...from New York, NY USA
This is a good soundtrack. Songs He's Really Useful Engine, Shining Time, I Know How the Moon Must Feel, Somethings Never Leave You, Summer Sunday, The Locomotion, Main Title, Lily Travels to the Island of Sodor, Burnett & Lady/ Diesel 10 & Splodge, Diesel Thretans Mr. C/Lily & Patch, Through the Magic Buffers & The Chase, The Clue, & The Happy Ending. I like the song He's A Really Useful Engine. I am a big fan of Thomas The Tank Engine and the movie is my favorite movie. Everyone had great acting. Thomas, Diesel 10, Percy, Toby, James, Splatter, Dodge, Harold, Henry, Gordon, Bertie & Lady did O.K. acting in the movie. I am 10 yrs old. I saw the movie 3 times. I wanted to see it 10 times. This is a good Thomas The Tank Engine video
27. Another registered reviewer on the Amazon site employs the username "[REDACTED]" (see Exhibit I attached hereto). The profile for this reviewer states:
Nickname: [REDACTED]
About me: I'm romantic ,but have a fun willing sprit 46 of the movies are mine that I reviewed but the other two are my sister's Krystle's I just adore romance and guys being around girls I know it's silly but it's the truth !
28. User [REDACTED] has posted numerous reviews on the Amazon site (see Exhibit I). This user indicated in the review below that she was 12 years old when the review was written and posted:
Newsies the perfect flim for the entire family! April 8, 2002 You ain't nothin without the Newsies abousoletly nothin! I saw basically all the film just when Jack,David,Scratchy,Gravy,Speck and all the other Newsies were beat very bad bye the police .So far it is a radical film rembmember we don't sell papes Newsies sell papes .This movie contains vilonce which may not be enjoyable for kids under the age of 8 but most Youth ,and Kids adore this film ! I'm just 12 and I know how I feel about Newsies you should feel the same way...
29. Another registered reviewer on the Amazon site employs the username "[REDACTED]" (see Exhibit J attached hereto). The profile of this reviewer reveals that she is 12 years old and includes her name, e-mail address, and geographical location:
Name: [REDACTED]
Nickname: [REDACTED]
E-mail: [REDACTED]
Reviewer Rank: [REDACTED]
About me: I am 12 years old and love contemporary romances. I love J.D. Robb and Nora Roberts and I live in Houston Texas
30. Another registered reviewer on the Amazon site employs the username "[REDACTED]" (see Exhibit K attached hereto). The profile for this reviewer reveals that she is 11 years old and includes her full name and geographic location:
Name: [REDACTED]
Nickname: [REDACTED]
Reviewer Rank: [REDACTED]
About me: I am 11 years old and I live in Brookfield, Wisconsin in the United States of America. I love reading books I mostly read historical fiction books because I am a historical fiction
freak. I like the mostly up to date music, like Britany Spears, NSYNC that sort of thing. I really like Beanie Babies, my favorites are teddy bears and the dogs. I like Mary-Kate and Ashley movies my favorite is Swithing Goals.
31. Another registered reviewer on the Amazon site employs the username "[REDACTED]" (see Exhibit L attached hereto). This reviewer is 12 years old:
Nickname: [REDACTED]
Reviewer Rank: [REDACTED]
About me: I am 12 years, however I like many old things...
32. Another registered review on the Amazon site employs the username "[REDACTED]" (see Exhibit M attached hereto). The profile for this reviewer includes a full name:
Name: [REDACTED]
Nickname: [REDACTED]
33. User [REDACTED]has a posted review on the Amazon site for a "Butterfly Garden." This review reveals that [REDACTED] is 7 years old and includes his or her geographical location (see Exhibit N attached hereto):
a good butterfly garden, November 30, 2002
Reviewer: [REDACTED] (see more about me) from fort worth, texas
i am 7 years old and have a 5 year old brother. my uncle ordered this for me when he was in iceland...
34. Another registered reviewer on the Amazon site employs the username "[REDACTED]." Apparently a child, [REDACTED] indicates his full name and geographic location in a review of "Transformers: Armada Mini-Cons Street Action Team 3-Pack: Grindor, High Wire & Sureshock" (see Exhibit O attached hereto):
cool, December 2, 2002
Reviewer: [REDACTED] from w.hempstead /NY/USA
i am [REDACTED] toy expert i am 11 and i love it is so cool i play with it no stop it rocks I am homeschooled i am advanced so i start at 7 and end at12 or sooner my siblings at3 anyway iam plaing all day with it cause i get 1 hour of TV a day and have no vidiogames or allowince so you get the picture they rock in veical and robot mode and they can be put together to make a big robot called preceptacon he rules I GIve it A plus.
Amazon's Practices With Respect to Children Violate COPPA
35. Amazon operates a web site directed at children, collects personal information from children, and displays that on its web site, in clear violation of COPPA. Further, Amazon has actual knowledge of its collection of children's personal information through its systematic monitoring of product reviews posted on its web site.
36. The COPPA Regulations specify that operators of sites "directed to children" must comply with the privacy protections described in ¶15, supra.[11] Amazon has not incorporated these protections into its site. There is no apparent parents' privacy notice; no apparent system for obtaining parental collection, use or disclosure of personal information from children; no apparent means to review children's personal information that has been collected; and no apparent means to prevent the further use of personal information collected from children.
37. In determining whether a web site is directed at children, the Commission will examine "among other things, the site's 'subject matter, visual or audio content, age of models, language or other characteristics of the website or online service.'" The "Commission will look at the overall character of the site-and not just the presence or absence of one or more factors-in determining whether a website is directed to children."[12]
38. In a prior proceeding, the Commission found that Lisafrank.com was a web site directed to children and thus subject to COPPA.[13] The Lisafrank.com site employed child models, sold children's products, used child-like fonts, and child-oriented cartoon characters.
39. Amazon clearly directs the Toy Store portion of its web site at children, thus triggering COPPA compliance obligations. This section's subject matter focuses on children's books, software, and toys. Like Lisafrank.com, Amazon's visual content indicates that it is directed at children. This portion of the site employs child-like fonts and uses child models. Amazon employs vivid colors on tabs that allow the user to navigate among the children's sections. Amazon's Toy Store page also includes child-oriented cartoon characters.
40. In determining whether a site is directed to children, the Commission considers "competent and reliable empirical evidence regarding audience composition as well as evidence regarding the intended audience of the site."[14] The facts alleged in ¶¶25-34, supra, constitute empirical evidence regarding the audience composition as well as the intended audience of the site. These facts demonstrate that a number of children appear to have registered on the Amazon site in order to review children's products.
41. The Commission has noted that web site operators may not, in an attempt to avoid COPPA's obligations, "construct a 'veil of ignorance' where the operator can determine through questions whether a visitor is a child without specifically asking for the visitor's age."[15]
42. Amazon has constructed such a "veil of ignorance." It operates a site featuring products tantalizing to children, and then disclaims any responsibility for marketing to children by asserting in its privacy policy that it technically only sells products to adults. Amazon has constructed a commercial web site featuring products directed toward children with graphics, text, and models intended to entice children, collects personal information from children, and markets aggressively to children, but disclaims any responsibility for compliance with the COPPA by stating simply that it only sells products to adults.
43. As set forth in ¶19, supra, Amazon's purported "kid's review page" does not actually function, which likely results in children employing the adult registration procedures to review products. Such ineffective procedures have allowed Amazon to engage in activities that normally trigger COPPA obligations while avoiding the use of procedures that would reveal that some members of the site's audience are under the age of 13. However, even if the kid's review page functioned, Amazon must comply with COPPA requirements because the site is directed to children.
44. Furthermore, Amazon is in violation of COPPA because it has actual knowledge that it is collecting information from children. Amazon's product review feature delays the posting of registered users' submitted reviews for five to seven business days. Amazon's guidelines specify that certain information is inappropriate for inclusion in product reviews, and that reviews with certain material will not be posted on the site. This policy and procedure indicates that Amazon monitors submitted product reviews, thus establishing that the company has actual notice that it is collecting information and disclosing personal information from and about children.
REQUEST FOR RELIEF
Wherefore, the Complainants request that the Commission:
Order Amazon to immediately delete the personal information of children posted on the site;
Initiate an investigation into the information collection and sharing practices of Amazon;
Initiate an investigation into the information collection and sharing practices of Amazon's child-directed joint-marketing partners, Toysrus.com, Babiesrus.com, and Imaginarium.com;
Order Amazon to fully comply with the COPPA regulations;
Order Amazon to destroy all records collected from children in violation of the COPPA;
Provide such other relief as the Commission finds necessary to redress injury to consumers resulting from Amazon's practices as described herein.
Respectfully Submitted,
Marc Rotenberg
Executive Director
David L. Sobel
General Counsel
_______________________________
Chris Jay Hoofnagle
Deputy Counsel
ELECTRONIC PRIVACY INFORMATION CENTER
1718 Connecticut Ave., N.W.
Suite 200
Washington, DC 20009
(202) 483-1140
April 22, 2003
* This complaint has been redacted so as not to reveal the personal information
of children.
1 Testimony and Statement for the Record of Marc Rotenberg, Director Electronic
Privacy Information Center on the Children's Privacy Protection and Parental
Empowerment Act, H.R. 3508 Before the House of Representatives, Committee
on the Judiciary, Subcommittee on Crime September 12, 1996, available at http://www.epic.org/privacy/kids/EPIC_Testimony.html.
2 Amazon.com, Inc. SEC Form 10-K (fiscal year ending December 31, 2002) (filed
Feb. 19, 2003), available at http://www.sec.gov/Archives/edgar/data/1018724/000095014903000355/v87419ore10vk.htm#001.
3 Id.
4 Id.
5 Children's Online Privacy Protection Act Final Rule, 64 Fed. Reg. 59888
(Nov. 3, 1999) (codified at 16 CFR Part 312).
6 Amazon.com Privacy Notice, available at http://www.amazon.com/exec/obidos/tg/browse/-/468496/002-1641816-7492034
(last visited Apr. 10, 2003).
7 Id. (emphasis in the original).
8 Id.
9 Toysrus.com / Amazon.com Toy Store, available at http://www.amazon.com/exec/obidos/tg/browse/-/171280/ref%3Dtab%5Fgw%5Ft%5F6/002-0230051-8468058
(last visited Apr. 10, 2003).
10 See http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=Toys&btnG=Google+Search.
11 Children's Online Privacy Protection Act Final Rule, 64 Fed. Reg. 59888
(Nov. 3, 1999) (codified at 16 CFR Part 312).
12 Id. at 59893.
13 Commission Complaint in US v. Lisa Frank, Inc. at ¶12, available
at http://www.ftc.gov/os/2001/10/lfcmp.pdf.
14 Children's Online Privacy Protection Act Final Rule, 64 Fed. Reg. 59888
(Nov. 3, 1999) (codified at 16 CFR Part 312).
15 Id.