Xanga.com to pay $1 Million for Violating Children’s Online Privacy Protection Rule

Social networking Web site operators Xanga.com, Inc. and its principals, Marc Ginsburg and John Hiler, will pay a $1 million civil penalty for allegedly violating the Children's Online Privacy Protection Act (“COPPA”), and its implementing Rule, under the terms of a settlement with the Federal Trade Commission (“FTC” or “Commission”) announced on September 7, 2006. According to the FTC, Xanga.com collected, used, and disclosed personal information from children under the age of 13 without first notifying parents and obtaining their consent. The penalty is the largest ever assessed by the FTC for a COPPA violation, and is more than twice the next largest penalty.
The complaint charges that the defendants had actual knowledge they were collecting and disclosing personal information from children. The Xanga site stated that children under 13 could not join, but then allowed visitors to create Xanga accounts even if they provided a birth date indicating they were not 13 years of age or older. Further, they failed to notify the children's parents of their information practices or provide the parents with access to and control over their children's information. The defendants created 1.7 million Xanga accounts over the past five years for users who submitted age information indicating they were not at least 13 years old.

Xanga.com is one of the most popular social networking sites on the Internet. After setting up a personal profile, users can post information about themselves for other users to read and respond to. On Xanga.com, users can create their own pages or Web logs (blogs) that contain profile information, online journals, text, hypertext images, as well as links to audio, video, and other files or sites. Information on the Xanga site is available to the general public through the use of global search engines such as Google and Yahoo. Incorporated in 1999 and based in New York City, privately held Xanga.com, Inc. was founded by Ginsburg and Hiler. In 2005, Xanga had about 25 million registered accounts.

According to the Commission's complaint, the defendants violated COPPA, the COPPA Rule, and the FTC Act by collecting personal information from children with actual knowledge that they were under the age of 13, failing to post on their site sufficient notice of their information practices regarding children, failing to notify parents directly about their information practices regarding children, and failing to obtain verifiable parental consent before collecting, using, or disclosing children's personal information. The complaint also alleges the defendants failed to provide parents with reasonable access to and control over their children's information on the Xanga.com site.

The consent order is designed to prohibit Xanga, Ginsburg and Hiler from violating COPPA and the COPPA Rule in the future. Accordingly, it contains strong conduct provisions that will be monitored by the FTC. The order specifically prohibits the defendants from violating any provision of the Rule and requires them to delete all personal information collected and maintained by the site in violation of the Rule. The defendants further must distribute the order and the FTC's “How to Comply with the Children's Online Privacy Protection Rule” to certain company personnel. The order also contains standard compliance, reporting, and record keeping provisions to help ensure the defendants abide by its terms.

To provide resources to parents and their children about the risks associated with social networking sites, the order additionally requires the defendants to provide links on certain of their sites to FTC consumer education materials for the next five years. First, the defendants must include a link to the Children's Privacy section of the Commission's ftc.gov site on any site they operate that is subject to COPPA. Second, the defendants must include links to the Commission's recently published safety tips for social networking on any of their social networking sites.

Authored by

Camelia C. Mazard
202-589-1837
cmazard@dbmlawgroup.com