FTC v. Sony BMG

Citation: Federal Trade Comm'n v. Sony BMG Music Entertainment, Case No. 08 CV 10730 (LAK), FTC File No. 082 3071 (S.D.N.Y. Dec. 11, 2008).

Factual Background
Sony BMG Music Entertainment, a subsidiary of Sony Corporation of America, represents hundreds of popular musicians and entertainers, including numerous artists popular with children and teenagers. The company operates over 1,000 websites for its musical artists and labels. Sony Music requires users to submit a broad range of personal information, together with date of birth, in order to register for these sites. On 196 of these sites, Sony Music knowingly collected personal information from at least 30,000 underage children without first obtaining their parents’ consent. Many of these sites also enable children to create personal fan pages, review artists’ albums, upload photos or videos, post comments on message boards and in online forums, and engage in private messaging. In this way, children were able to interact with Sony Music fans of all ages, including adults.

Complaint
The FTC’s [complaint]] alleged that Sony Music violated COPPA by failing to provide sufficient notice on the Sony Music websites of what information the company collects online from children, how it uses such information, and its disclosure practices; failing to provide direct notice to parents of Sony Music’s information practices; failing to obtain verifiable parental consent; and, failing to provide a reasonable means for parents to review the personal information collected from their children and to refuse to permit its further use or maintenance.

The complaint also charges Sony Music with violating Section 5 of the FTC Act by falsely stating in its privacy policy that users who indicate that they were under 13 on its website registration pages will be restricted from participating in Sony Music’s web page activities. In fact, Sony Music accepted registrations from children who entered a date of birth indicating that they were under 13.

Consent settlement
The Commission’s consent order calls for Sony Music to pay a $1 million civil penalty. In addition, the order specifically prohibits Sony Music from violating any provision of the Children’s Online Privacy Protection Rule, and requires it to delete all personal information collected and maintained in violation of the Rule. The company is required to distribute the order and the FTC’s “How to Comply with the Children’s Online Privacy Protection Rule” to company personnel. The order also contains standard compliance, reporting, and record keeping provisions to help ensure the company abides by its terms.

To provide resources to parents and their children about children’s privacy in general, and social networking sites in particular, the order requires Sony Music to link to certain FTC consumer education materials for the next five years.