FTC STAFF SURVEY OF
CHILD-ORIENTED COMMERCIAL WEB SITES

A. Methodology

This appendix is designed to provide a snapshot of information practices that children may encounter on the World Wide Web.⁽¹⁾ In June 1996, FTC staff identified 272 sites from several lists of children's links.⁽²⁾ Sixty-nine sites were not operational at the time. Of the remaining 203 sites accessed by staff, 67 appeared to have some commercial content or activity on some of the site pages. Staff then conducted a closer review of 29 of these commercial sites that were collecting information about the user. Staff also reviewed 8 additional children's sites already known by staff to be collecting information.⁽³⁾ The following is a summary of the information collection practices of those 37 sites. Sample pages, downloaded between June and September 1966, are on file at the Federal Trade Commission.

B. Summary of Findings

Staff's survey identified a number of different techniques for collecting personal information from children on the Web. Some sites request visitor's name and postal and e-mail addresses to enable the child to correspond with fictional characters, to provide feedback regarding the site, or to receive information from the site, such as product information or notice of future site changes.⁽⁴⁾ Some sites collect information by requesting visitors to sign a "guest book," register, or "join" a site. Such information often includes name, age, gender, e-mail and postal addresses, or phone number.⁽⁵⁾ A number of sites conducting surveys and polls collect name, e-mail and postal addresses, age, and gender.⁽⁶⁾ Sites conducting contests collect such information as name, birth date, e-mail and postal addresses, gender, or phone numbers.⁽⁷⁾ Sites offering interactive features, such as bulletin boards and chat rooms, collect information including a participating visitor's name, e-mail address, age, or gender.⁽⁸⁾ Online pen-pal services (keypals) collect especially detailed information regarding children's interests in addition to their names and birth dates.⁽⁹⁾ Finally, sites that initiate or complete product sales online ask for information including e-mail and postal addresses, or phone number.⁽¹⁰⁾

C. Information Practices by Site

The following is a brief description of the types of information collected at each of the 37 commercial sites included in staff's survey.

1. Aha Kids www.aha-kids.com

• Requests name, age, e-mail address for bulletin board posting and for survey submission.
• Sells toys, games but order must be placed offline (800 number).
• Hyperlink was broken when tested by stealthencrypt.com on December 7, 1998.

2. Atari Jag-Wire www.atari.com

• Requests postcard providing name, address, e-mail address for placement on mailing list for new product information.
• Sells products by e-mail if provide name, address, phone, e-mail address, credit card number.
• December 8, 1998 - A phone number is provided and is not toll free, but Hasbro does not tell kids it costs money to call that number. In adult language, their terms page advises about export controls on downloadable software. Cookies are used to save game player information. On one page, Hasbro says they do not maintain a "chat" room or share information gathered from users of the Web site with third parties. They encourage kids to use a screen name "not your real name" for promotions, and though they do request addresses for sending kids stuff by regular mail. Kids under age 13 must get parental permission before providing address info. The game registration page has no current provision for online registration, but requests children to use regular mail to communicate with the postcard that came in their game box. But, here's something scary from the Hasbro terms page: "Should any viewer of a document on this web site respond to Hasbro with information including feedback data, such as questions, comments, suggestions, or the like regarding the site, or the content of any item, such information shall be deemed to be non-confidential and Hasbro shall have no obligation of any kind with respect to such information. In addition, Hasbro shall be free to reproduce, use, disclose, display, exhibit, transmit, perform, create derivative works, and distribute the information to others without limitation, and to authorize others to do the same. Further, Hasbro shall be free to use any ideas, concepts, know-how or techniques contained in such information for any purpose whatsoever, including, but not limited to, developing, manufacturing and marketing products and other items incorporating such information. "

3. Aunt Annie's Craft Page www.auntannie.com; www.outreach.com

• Requests name, e-mail address to be added to monthly mailing list of page updates; provides option to be removed from mailing list.
• Requests name, e-mail address, any other personal information persons wish to submit from those who submit craft ideas; provides option to indicate that name, e-mail address should not be published online.
• Provides option to order products (craft instructions) online by providing credit card information, e-mail address, or shipping address if diskette purchase is made.
• December 1998 - If you don't accept the cookie, you can't subscribe to Aunt Annie's newsletter. Their policy says "Contact information will only be used to correspond about the order and to ship software. You will only be sent new product announcements and upgrade notices at your request. In addition, contact information will not be given, traded, or sold to anyone else." A visit to the sister site www.outreach.com showed that it is a business site, not a children's site.

4. Beakman and Jax www.nbn.com/youcan/index.html

• Visitors sign the Guest Book by providing first and last names, e-mail address, information re: favorite Web pages.
• December 1998 - Broken hyperlink

5. CBS www.cbs.com; concrete.onlinelabs.com

• Visitors wishing to vote in 1996 Family Film awards required to provide e-mail address, full name, full street address, birth date.
• Visitors wishing to send a message to CBS Kidzone requested to provide e-mail address.
• Visitors wishing to answer CBS Kidzone questionnaire re: "what's the best thing you did this summer?" requested to provide name or e-mail address and state.
• Visitors wishing to enter CBS Kidzone poll requested to provide e-mail address, gender, age, answer survey.
• Visitors wishing to be listed as a KidTriv winner requested to provide name, city/town, state and e-mail address.
• Legal disclosure link advises that any information disclosed to CBS "is ours to use without restriction."
• December 1998 - CBS disclosed that if you enter your zip code to access your local listings, a cookie will be saved to your system. Easily bypass that cookie by clicking on the network listings graphic. CBS does not require that a child's real name be used. CBS uses lawyer language on their KIDshow legal stuff page, telling kids that "If you send us drawings, creative suggestions, ideas, or other information (collectively, the "Items"), unfortunately we will not be able to return the Items to you. Once submitted, the Items will become the property of H+a and H+a be entitled to unrestricted use of the Items for any purpose whatsoever, without compensation to you. By submitting the Items, you waive all moral rights in the Items." There are notices that the site is advertiser-supported and click-on banners that lead to ordering items were on the Kidshow site. Our attempt to enter the store4kids brought up cookie alerts, and when we did not accept the cookie, our connection to the internet was mysteriously broken.

6. CyberJacques www.cyberjacques.com

• Registration form to play game, participate in bulletin board requests full name, date of birth, gender, e-mail address, full street address, parent's full name and e-mail address.
• Site states that name and address of parent is requested "so we can let them know what you are up to," and that e-mail address of player is required so site can locate visitor, track eligibility for prizes. Another area of site states that information is requested so site can have a better idea of who visitors are, what they like, and to enable the site to reach visitors by phone or postal mail if e-mail is unavailable.
• December 1998 -- Stealthencrypt.com visited Cyberjacques and saw that first and last names of recent contest winners were posted with their city and state. No cookies. Nothing for sale. No personal information was requested during our visit. All Cyberjacques online games require Macromedia's Shockwave plug-in, and though there is a link to the Macromedia site to download it, downloading, unzipping and installing software is not recommended for kids.

7. Discover Magazine www.enews.com/magazines/discover/webtur.html

• Subscriptions may be purchased online if visitor provides name, e-mail address, phone number, street address, credit card number; separate page states that the Electronic Newsstand is not responsible for the confidentiality of credit card information provided over the Internet.
• Sells other merchandise offline (1-800 number).
• December 10, 1998 -- Stealthencrypt.com logged onto discover.com and was immediately faced with an insecure temporary cookie that Microsoft Internet Explorer identified as discover-ROS_1, located in the domain 247media.com. For each visitor to www.247media.com, their Web server automatically recognizes your domain, the type of Internet browser you are using, the type of computer operating system you are using, and the domain name of the Web site from which surfers linked to their site. This information is collected automatically, and 247media states it is used for internal review, then discarded.
  We visited the Discover school programs site and saw that the content was for educators. A click on the archive link brought up a cookie from Webtrends. Other clicks on main menu items brought up more cookies, possibly the kind that follow surfers around a site. The free issue of Discover magazine requires a credit card number. The ordering is secure. Lots of offsite links to educational sites. The Discover site is copyrighted by Disney.

8. Disney www.disney.com; game2.disney.com

• Site has a sign-in process for visitors wishing to participate in the numerous contests at the site. Sign-in form requests full name, e-mail address and states that visitors can get "free updates" by providing birth date, mailing address, and by indicating areas about which they would like to receive information.
• Some contests permit entry by submission on postcard of full name, mailing address, e-mail address, date of birth and daytime phone number.
• One survey permits entry by submission online of full name, mailing address, daytime phone number, age and survey responses.
• In June 1996, site advised that "information provided by our guests during the registration process is for internal Disney use only and will not be made available to third parties."
• In September 1996, site featured the following warning: "If you are under 18 years of age, Disney.com recommends that you get your parent or guardian's permission before you provide any information about yourself." In September, however, the site no longer contained a promise to limit information to internal use.
• Site also features contest rules and "Legal Restrictions" pages, but none state the use of information collected.
• Merchandise sold offline.
• December 1998 - If you have your Internet Explorer browser set for high security, the Disney cookie security alert will be forced on your children over and over and they may have to press cancel a whopping 35 TIMES. During this cookie force-feeding, Disney.com will not let the back button on the browser be used, and kids can't open a new window either. We couldn't believe it, so we tested it again, this time with Netscape. If the Disney cookie is not accepted before the cancel button has been pressed from between 23-48 times, the Netscape 4.x browser cannot even be shut down normally. The Disney cookie must be accepted or the browser must be shut down with control, alt, delete and the end task button! When surfers click on the privacy policy, a cookie warning pops up. Stealthencrypt.com got no further with reviewing this site because, well, we didn't want to eat the Disney cookies and were tired of hitting the cancel button. By the way if your child sends them anything, Disney says they own it.

9. Dodoland www.swifty.com/azatlan/dojune/castle.htm

• Online request for visitors to provide e-mail and home address via postal service in order to obtain membership; need membership to access some portions of the site. As staff could not access entire site, it could not determine what additional information it collects.
• December 1998 - Dodoland's link is now at http://www.swifty.com/azatlan/. The make a wish and pollution solutions pages reveal first and last names of some children, just first names of others. Kids can also send in the endings that they write to stories posted on the site. No cookies encountered. Good content onsite.

10. ParentsPlace www.parentsplace.com

• Features chat rooms for adults and kids. To participate, visitors must register by providing full name, e-mail address, age, gender; also requests number and age of children. This sites states that it will not sell trade or exchange information provided and that information will be kept confidential.
• Sells magazine subscription online to those who provide name, e-mail, phone, and billing address.
• Features birthday club. To join, visitors must input name, e-mail address and birth date. Each day the site's birthday page prints out name and age of registered visitors celebrating birthdays.
• December 10, 1998 -- Going to this site provoked an attempted launch of an insecure long term cookie from ads.ivillage.com with an expiration date of Tue, 09 Nov 1999 23:12:40 GMT and this data: d1b9a208-18872-913288106-1. Some other cookies attempted to launch from preferences.com, focalink.com, and some other marketing-type tracking sites. By clicking on the doorway to a web chat room about bereavement, 2 cookies attempted launch, one was for password authorization and the other was from focalink.com which offers post-click tracking and other services.

11. Family Internet www.familyinternet.com

• Includes a survey that requests name, e-mail address, gender, age, age and gender of other household members, education, occupation, household income, and whether user has ever bought anything on Internet or is likely to do so.
• December 10, 1998 - Right off the bat, www.smartclassroom.com tried to give Stealthencrypt.com's researcher a one year insecure cookie, and preferences.com tried to issue an insecure cookie that expires Mon, 18 Jun 2007 04:20:21 GMT! If you click on an email link, a cookie attempts to notify preferences.com. We didn't go far into this site, because it seemed like every link is connected to a cookie, making navigation nearly impossible in Microsoft Internet Explorer's high security mode.

12. 4Kids Treehouse array.4kids.com

• Provides option to sign the Guest Book by providing e-mail address, name, and "where [visitor is] calling from."
• Page states that "Guest book entries may be used for advertising purposes."
• December 10, 1998 -- Hyperlink broken.

13. Freezone freezone.com

• Registration required for entry to interactive areas (chat rooms, bulletin boards, e-pals); registration requires first and last name;
• Additional information is optional: e-mail address, mailing address, phone, parent or guardian's name and e-mail address.
• Form states that the first and last name is used for internal use only and that registration is used to help monitor live activities.
• Site contains survey requesting predictions about future; entrants are requested to provide name, age, grade, and hometown.
• December 10, 1998 -- Freezone's privacy statement is written in kid language and posted at http://freezone.com/safety/privacy.html. The site's privacy policies and code of conduct forbid kids from giving out personal information in interactive areas, talking about inappropriate subjects, and posting links to inappropriate sites. They can't be mean to each other either. The kids' posted feedback to the strict rules and their comments are very positive. No cookies encountered. Kids are to use Freezone screen names. No real names required.

14. FritoLay DreamSite www.dreamsite.fritolay.com

• Collects name, e-mail address from correspondents via e-mail.
• December 1998 -- Dreamsite link was not available so stealthencrypt.com went to the fritolay main page at http://www.fritolay.com. Their privacy policy is accessible from the home page. Personal information is provided voluntarily by surfers and Frito-Lay's sites may collect non-personal information from our online visitors (such as the user's type of browser, operating system and domain names). They use the info to track numbers of visitors to each of their sites and use the information to improve their sites. Nondisclosure to third parties, says Frito-Lay. Content is not really for kids, despite the fun graphics.

15. Hasbro (Actionman, GI Joe, etc.) www.actionman.com

• Collects name, comments, country for voluntary registration; discloses that "all agent dossiers [visitor files] are treated as high level security. No information submitted will be passed on."
• Collects first and last name and e-mail address of those wanting notice of when Hasbro Interactive Site is operational.
• To enter competition, visitor must provide name, e-mail address, postal address, gender, and answers to questions re: number of Actionman characters owned, and how many hours per week are spent online.
• For 1998 information from Stealthencrypt.com, please see Atari's listing in this article.

16. Internet for Kids www.internet-for-kids.com

• Collects nickname, birth date, age, gender, three greatest interests, hometown for online penpal service. This information is listed on the service for anyone who wants to correspond with persons listed.
• System's business statement makes reference to conduct of market research and states that its web site is designed to "facilitate our information-gathering with children in this age group."
• December 1998 - No privacy statement, but business statement with similar information. No information selling, no products for sale, strict rules and safety advice for pen pal program, no cookies encountered. "Get Your Baby on the Computer" section has a realistic interface with huge buttons and alphabet-linked bright colored graphics. This section encourages parents to participate by combining early childhood development with interactive parenting through the Internet.

17. Internet Movie Database us.imdb.com

• Contains Internet movie database survey, a lengthy survey of movie viewing habits and database use, and also seeking age, gender, country, zip code, name, e-mail address, industry of employment, job title.
• States that all personal data will be treated in confidence and used only for statistical purposes.
• States that there will be a prize awarded to survey entrants who provide e-mail address.
• Logging onto this site revealed an 11-month cookie from lsco.ngadcenter.net, an ad center. We surfed to http://kids.imdb.com/ and went to the terms page (another cookie) and the copyright page a cookie from gm.preferences.com that expires on Mon, 18 Jun 2007 at 04:20:21 GMT. The privacy policy page launches another cookie from preferences.com which also expires in 2007. On the privacy page, they promise not to spam you.They say they occasionally like to send out details about updates to their site, but first ask your permission. But then, this: "The same applies to IMDB approved partners who we feel have offers of interest to surfers and who would like to send details directly. You can opt in and out of the scheme using the registration administration system at any time using the User Administration pages. Because we feel very strongly about privacy we are registered with the UK Data Protection Registrar (IMDb is a UK limited company). We abide by all relevant codes of practice as laid down by the registrar. "

18. Jelly Belly www.jellybelly.com

• Awards sample of jelly beans to survey entrants who provide full name, postal address, e-mail address, age range (including "11 and under"), gender, and information regarding jelly bean preferences. States that any information provided becomes property of product vendor.
• Free jellybeans to the first 500 people who fill out an online survey. The daily survey opening time is rotated so that it is fairer. Here's their "Privacy Statement: You can be sure all of your personal information is treated as strictly confidential and will not be sold or rented for any reason. We use the information to send you a sample and to better understand our customers. If you are under 18 years of age, please obtain parental permission before completing this survey." Jelly Belly has an online shopping cart on the same page as the kid-oriented Jelly Belly Taste Bud Club Membership with T-shirt, along with a photo of two children wearing the T-shirts.

19. Kellogg www.kelloggs.com

• Visitors to various pages of Clubhouse and Store sections of site are asked a series of questions requesting the following information: full name, e-mail address, city and state, zip code, country, age, gender, cereal eating habits, and whether the child's parents let them pick their own cereal.
• Students wanting information for a "school report" are requested to provide e-mail, name, postal address, and educational level.
• Those wishing to place orders for products (such as t-shirts) must provide full name and address, but orders are placed offline.
• Warns that those under 18 need parent permission to order.
• Those wishing to provide feedback are requested to provide full name, e-mail and postal address.
• Site includes opportunity to ask Kellogg's to delete visitor's e-mail address from the database.
• December 10, 1998 - Stealthencrypt.com visited "Planet K" and read the Privacy Practices page. Kellogg's active self-regulation to ensure responsible marketing and protection of children's privacy. They developed their privacy practices from (Children's Advertising Review Unit) CARU and other guidelines. They sometimes ask for personal information during promotions, and occasionally use cookies.

20. Kidscom www.kidscom.com

• Children wishing to use site must register by providing full name, birth date, gender, number in household, grade, favorite show, commercial and musical group, interests. Page states that registration gives access to the site, registers child for pen-pal list, and lets child talk to "the Internet Guru." Children who have registered may then use entire site (including bulletin boards, games) and seek a penpal of a specified gender, age, country and having specified interests.
• One area of the site is a survey that requests full name, e-mail address, age, gender, country, and interests. Survey changes from time to time.
• Another area of the site advises parents that information collected from the surveys has on occasion been released on an aggregate, anonymous basis to third parties for market research purposes, but that personal identities are never released.
• Registration forms and survey forms advise children to get parental consent. Children are awarded premiums for getting parents to fax a consent form to the site.
• December 7, 1998 - Stealthencypt.com found that Kidscom.com claims rights to children's creative works which are sent to them. Kidscom.com requires children to disclose real first and last name to be able to chat or contribute content. Also if they want to chat or contribute content, kids must provide personal data such as their birthday and how many people live in their house. They also have PERSONAL CONTACT with member kids during "on location" tours and publish photographs of those children on the Internet. Scared yet? Here's more...

21. Lego www.lego.com

• Requests name, age, gender, computer type, e-mail address, and information regarding number of currently owned Lego products to get membership certificate, personalized homepage.
• States that if e-mail address is provided, Lego will provide "extra information" on Lego products. Immediately upon inputting e-mail address, the site sends back a membership number.
• According to their privacy policy on this page http://www.lego.com/professionals/privacypolicy.asp, Lego collects information for internal purposes only, and runs online promotions that kids view. Kids can sign up for a screen name and a password to some parts of the site. However, a visit to this page, legal.asp contradicts with this statement: "4. Any communication or material you transmit to the Site by electronic mail or otherwise, including any data, questions, comments, suggestions, or the like is, and will be treated as, non-confidential and non-proprietary. Anything you transmit or post may be used by LEGO A/S or its affiliates for any purpose, including but not limited to reproduction, disclosure, transmission, publication, broadcast, and posting...." and it goes on...

22. Magical Secrets www.magical.com/secrets/

• Collects name, e-mail address, postal address, phone numbers, stage name if applicable, and background in magic.
• Also sells magic products, publications online if visitor provides credit card number and expiration date.
• December 10, 1998 -- Not a kids' site. Stealthencrypt.com discovered that credit card numbers were requested on UNSECURED SERVER in a framed document, with these comments: "Please note: If your web browser isn't compatable with this form, please send us the above information as a regular e-mail message. If you are uncomfortable with sending an order with the above form, over the Net, relax! If you're still feeling a little paranoid, feel free to e-mail us and we'll e-mail or call you back other options."

23. Nabisco www.nabisco.com

• Collects e-mail address from those who wish updates or news on coupons.
• Can enter contest to win prizes by providing first and last names, postal address, age, type of computer system.
• December 10, 1998 -- Stealthencrypt.com found Nabisco's privacy policy accessible from every top level page. They intend to comply with CARU guidelines and never use cookies unless they are temporary, and used to control viewing frames. At the guestbook page, Nabisco asks anyone under 18 NOT to use the guestbook, a good policy. They do use some information provided by visitors, but have guidelines for gathering and use.

24. NBC www.nbc.com

• E-mail address required to play games and win prizes.
• States that site will use address only for a game and will not sell or rent the e-mail address to any third party.
• Sells merchandise offline.
• Sells merchandise online, but this is not really a kid's site. Cookies and popup windows encountered.

25. Nintendo www.nintendo.com

• Contains questionnaire requesting name, postal address, e-mail address ("so we can send you information when something really cool comes out"), age, gender, location from which Web site is accessed (home, work, school), platform, views on additions to site. States that information is requested "so we can make our site better for you" and adds, "We even promise not to sell the information."
• December 10, 1998 - Stealthencrypt.com visted Nintendo's site. Their privacy policy is prominently linked from the home page. They don't use cookies, they don't ask for information to view the site, only email addresses are requested to enter contests, and kids don't have to use their real names. Nintendo says all information from emails sent voluntarily to them is confidential and not reused or kept. They recommend that kids use madeup names and won't sell products to anyone under 18 years old.

26. Real Kids, Real Adventures www.realkids.com/adventur.htm

• Site promotes children's book series.
• Visitors wishing to enter drawing for t-shirt must send name, postal address, phone number. States that "Monthly entries are not saved once that month's winner is drawn, or used for mailing lists."
• Also requires visitors who wish to enter Young Writer's club to provide name, e-mail address.
• E-mail address is collected automatically when a button on the site is clicked. Visitor receives an automatic e-mail message ("Gotcha!") with the introduction,"You touched the button!"
• Provides information re: products, requires purchases be made offline.
• December 10, 1998 -- Stealthencrypt.com discovered that the realkids.com "story room" consisted of one or two paragraphs from each story and accompanying links to Amazon Books to buy the book. To join the young writer's clubhouse, kids are asked for their names and email addresses. To enter writer's contest with $50 cash prizes, children are requested to provide by mail, not email: name, address, phone number, age and parent/guardian names. The children's writing assignment page has a clickable banner at the top, leading to a writing seminar that costs $245. To enter the contest to win a T-shirt, kids must provide the same information, over and over again, all over this website. This site promotes their TV show on the Discovery Network.

27. The Scoop www.friend.ly.net/scoop/

• Site promotes children's books.
• Feedback form requests name, e-mail address, gender, type of books preferred, favorite children's book and author, views on how to improve site. States that information is collected to build better site and to give visitors an opportunity to win new books.
• Sells children's books offline.
• Includes a chat room.
• Adult shopping and book reviews (of children's books) plus children's activity content are mixed together on the same pages. If a child clicks on a book cover from an activity page, he or she lands in the Amazon bookstore. To participate in a monthly contest with a paperback world almanac for a prize, children are told to "Send us an e-mail with your answers and give us your name, school (if applicable), address, phone number and e-mail address so we can notify you if you win." A feedback form also requests this information.

28. Silly Billy's World www.sillybilly.com/

• Author's site.
• Requests visitors to provide name, postal address, e-mail, school system, city and state, and whether visitor is student, parent, teacher, administrator, or other.
• States that in future it will sell books, software, etc, online.
• December 1998 - Stealthencrypt.com found that to become a "citizen" the site requests much personal information: name, address, email, school system, city and state of school system, and whether you are a student, parent, teacher, administrator, or just surfing in. He sells books he publishes himself and requests credit card numbers on an UNSECURED SERVER at: http://www.sillybilly.com/shop.html using a cgi script and the post method. Sillybilly makes personal visits to schools to give presentations at "affordable rates." He offers his books for sale as school fundraisers.

29. Splash Kids www.splash.com/

• Requests name, age, birthday, postal address and e-mail address.
• Request for address is accompanied by the following language: "optional--check with your parents first.") Also asks how visitor became aware of site, and their opinions about it.
• States that entrants will have a chance to win a monthly prize and receive newsletters.
• Site includes chat area.
• December 10, 1998 -- Internic.net shows this domain to be on hold. On hold usually means that the domain name has not been paid for, and this name may be available soon. If you are interested in splash.com, keep checking with internic.net until it is available.

30. Street Sharks wid.com/sharks/

• Visitors must provide name, e-mail address, city, and state to enter contest.
• Offers visitors opportunity to write to favorite Street Sharks character by providing name, e-mail address, city and state.
• December 10, 1998 -- stealthencrypt.com found that no kiddie site is attached to this seemingly forgotten page. The home page, Wid.com, has moved and surfers are forwarded to surging.com, a commercial business site.

31. Syndicate.com syndicate.com/index.html

• Operates word puzzle contests and states that it will offer educational products.
• Requests that participants register by providing full name, e-mail address, postal address, phone number.
• Registrants are eligible for monthly drawings and can participate in all contests. To enter specific contests for monthly prizes, visitors must again enter e-mail address and real name.
• December 10, 1998 -- To enter stealthencrypt.com found that visitors must give e-mail address and real name.

32. Tap Online www.taponline.com/

• Registration required to use message boards, enter chat areas, enter contests for prizes. Visitors register by providing full name and e-mail address. Very fine print disclosure following contest entry form states that contestants must be 18 or older.
• Cookie alert upon loading the home page. Privacy page tells exactly what information they collect and what they do with it. (Domain name, email address if possible from chat rooms and correspondence of the type that surfers volunteer.) They provide their street address, phone number, email address. They state that they don't share information with other organizations for commercial purposes. They ask for exact name and address and have a form to help teens create an identity that they will use at the site.

33. Teen Court TV www.courttv.com/teens

• Visitors wanting to provide feedback or suggestions for content of the site are requested to provide name, e-mail and postal addresses, and phone number.
• Visitors wishing to participate in teen chat area must register by providing full name and e-mail address.
• Sells licensed clothing offline.
• December 10, 1998 -- Server errors prevented stealthencrypt.com from looking at registration page for the Talk Back feature. Survey pages were anonymous. No cookie alerts. If teens want to go on the TV show, the form asks for name, address, email address, dates the teen will be in New York, and phone number. Web site topics are legal issues and social concerns. Nothing appears to be for sale at the site.

34. The Kids.com www.thekids.com/

• Full name and e-mail address required to participate in forum (discussion) rooms. Page requesting this information states that "this is solely for our internal use. Your personal data will under no circumstances be made available to any other company. . . .Your first and last name will show up in the forum message that you will post to identify those message [sic] as yours. . . Your e-mail address will not be made available to other forum members. It is for internal forum management only."
• December 10, 1998. Stealthencrypt.com found the discussion room and the parents room were under construction and had no info. Lots of cute graphics, activities, stories, and nursery rhymes were either properly credited or clearly in the public domain. No cookie alerts. Their "best of the net" page has exterior links with descriptions in older kid's language and a prominent message to kids about strangers. thekids.com had a live Amazon logo on their home page, but nothing for sale or advertised on their pages. Don't confuse this site with kidscom.com.

35. TVNet tvnet.com/TVnet.html

• Requires full name and e-mail address to register for chat areas; also requests locale and age group. States that the e-mail address will not be shown with name in chat areas but that if visitor acts inappropriately site will send an e-mail.
• December 10, 1998 - Stealthencrypt.com found that the above link now leads to http://www.ultimatetv.com/ and they have various chat rooms, but they are clearly teen chats, not for younger children. This company still requests real full name and real email address, so they can send email if teens misbehave on their boards. Medium tolerance for teen-ish behavior (swearing is allowed as long as no one gets offended and complains.)

36. Yahooligans Club www.yahooligans.com

• To join club visitors are requested to provide name, e-mail address, city, state, age, and gender. Registrants are also asked whether they share computer and with whom, whether Yahooligans can send e-mail to address given, and what registrant does and does not like about site.
• States that those who join club will get advance update of new sites, notice of contests and special offers.
• Promises "we won't bury you in e-mail messages."
• (Note: pages downloaded in April, 1996.)
• December 8, 1998 - Yahooligans privacy policy is written clearly and in kids' language. They ask for little information beyond a first name and last name initial and an email address, and also explain to the kids how cookies work. (They don't use cookies but they DO link to sites which do use cookies, such as Disney.) Separate Yahooligans guidelines for children and parents explain safety and privacy issues. Yahooligans is a member of truste.org and it really shows that they care about their own content and their exterior hyperlinks. Exterior hyperlinks are hooked to kid-oriented places with non-objectionable content.

37. Youth Central youthcentral.apple.com

• Site requires users wishing to access message boards to provide full name and e-mail address. States that it will terminate or suspend a participant's access if site rules are violated.
• Site also features opinion polls. One poll asks opinion of site, gender, year of birth, country of residence.
• Site features contests. Contest targets 10-19 year olds, states that by entering contest visitor acknowledges that he has his parent's or guardian's approval. To enter contest visitor must provide full name, parent's or guardian's name, postal address, e-mail address, and phone number.
• Site also features keypal service.
• December 8, 1998 -- This hyperlink was broken.

1. Given the vast scope of the World Wide Web, it would be difficult to conduct a comprehensive review of sites and site practices, or to determine whether practices are representative of a larger sample. Staff may not have accessed all the pages of each site, and sites may have undergone revision since pages were downloaded for this survey. Further, while each of the sites below appears to have some commercial content or purpose, it is not always clear whether the information practices identified occurred in connection with a commercial activity. Staff's review included sites doing commercial marketing research.

2. Staff used the following lists of children's Web sites:

"4Kids Playroom" (http://array.4kids.com/~4kids/kidplrm.html);

"4Kids Entertainment" (http://array.4kids.com/~4kids/kidentrtn.html);

"KID List" (http://www.clark.net/pub/journalism/kid.html);

"Yahooligans" (http://www.yahooligans.com/docs/cool.html);

"Kids Connection" (http://woi.com/woi/kids.html); and

"World Kids" (http://www.worldaccess.com/OtherSites/KidsCorner/).

3. In its site review, staff also accessed numerous children's sites that appear to be entirely noncommercial, but collect detailed information from children, i.e., sites conducting online pen-pal programs and chat rooms for children that require registration to participate.

4. E.g., sites 2, 3, 5, 14, 15, 21, and 30. Site 27 also asks for age or gender.

5. E.g., sites 4, 9, 12, 15, 21, 22, 31, and 36.

6. E.g., sites 5, 8, 11, 13, 17, 18, 19, and 20. Other information collected included age and gender of other household members, income and occupation (site 11), product preference (site 18), cereal eating preference (site 19), and interests (site 20).

7. E.g., sites 6, 8, 13, 15, and 26. Site 6 also collected parent's name and e-mail address.

8. E.g., sites 1, 6, 10, 13, 33, 34, 35, and 37. In addition, site 13 requested parent or guardian name and e-mail address, site 35 birth date, and site 37 preference information.

9. E.g., sites 16 (nickname, birth date, current age, gender, favorite interests, hometown; and 20 (full name, birth date, gender, number in household, grade, favorite show, commercial and musical group, interests).

10. E.g., sites 2, 7, 9, 10.