NEW YORK — The operator of fan websites for pop stars Justin Bieber, Selena Gomez, Rihanna and Demi Lovato agreed to pay a $1 million civil penalty to settle federal charges that the sites had illegally collected personal information about thousands of young children, the Federal Trade Commission said Wednesday.
In a complaint, the FTC alleged that Artist Arena, the operator of the sites, had violated a children’s online privacy rule by collecting personal details — like the names, email addresses, street addresses and cellphone numbers — of about 101,000 children aged 12 or younger without their parents’ permission.
The law, called the Children’s Online Privacy Protection Act, or COPPA , requires operators of websites to notify parents and obtain verifiable parental consent before collecting, using or disclosing personal information about children younger than 13.
The sites are BieberFever.com, SelenaGomez.com, RihannaNow.com and DemiLovatoFanClub.net, which is no longer in operation. The agency did not accuse the pop stars themselves of any wrongdoing.
At a conference on children’s marketing in New York on Wednesday, Edith Ramirez, a member of the FTC, said the settlement still needs to be ratified in court.
As part of the registration process, the four fan sites asked users to submit personal details, including their birth dates, that would enable members to create online profiles, post messages and sign up for newsletters about the pop stars, the complaint said. Because the sites therefore knew the children’s ages, the FTC charged that the company had knowingly collected information and failed to properly notify their parents.
“These were fan sites that knew that a very substantial percentage of users were 12 or under," said David C. Vladeck, the director of the FTC’s Bureau of Consumer Protection. “There is really no excuse for violations like these."
Artist Arena, a division of Warner Music Group that manages artist fan clubs, neither admitted nor denied the agency’s allegations. Warner first invested in Artist Arena in 2007 and bought the company in 2010. James Steven, a spokesman for Artist Arena, declined to comment. The fan sites no longer allow children under 13 to register as members.
The proposed settlement comes at a time when the agency is preparing to extensively strengthen the children’s online privacy protection rule for the first time since its introduction more than a decade ago.
In an effort to keep pace with innovations like mobile apps and facial recognition technology, the agency has proposed widening both the kinds of data about children that would require parental consent and the kinds of operators — like advertising networks or data miners — whose data-collection activities could be subject to the rule.
Last week, major corporations like Apple, Facebook, Google, Microsoft, and Viacom pushed back, submitting public comments to the FTC in which they argued that some of the proposed changes were so unworkable that they could deter companies from providing sites and online services to children.
“To ensure that the Internet continues to be a robust and enriching place for children, the commission should avoid promulgating rules that frustrate operators’ ability to continue providing the same quantity and quality of sites and online services, including those that are directed to children," Michael D. Hintze, Microsoft’s chief privacy counsel, wrote in comments to the agency.
But the case of the pop star websites bolsters the viability of at least one of the FTC’s proposals: that child-friendly sites aimed at audiences of varying ages must either assume all users are under 13, or screen users for age to identify those for whom data collection requires prior parental consent.
Some companies, like Viacom, have objected to this proposed change, saying that such a screening process might cause some sites to block children from participating or deter some children who might end up on inappropriate adult sites that do not screen users for age.
But BieberFever.com and the other fan sites, even if they failed to properly notify parents, seemed to be able to collect information on tens of thousands of children who willingly identified themselves as being younger than 13.
“Marketers need to know that even a bad case of Bieber Fever doesn’t excuse their legal obligation to get parental consent before collecting personal information from children," Jon Leibowitz, the chairman of the FTC, said in a statement.
Each of the fan websites had slightly different registration processes. But the agency charged that Artist Arena had falsely claimed that it would not activate a child’s registration without parental consent.
SelenaGomez.com, for example, required users who wanted to sign up for the online fan newsletter to enter information like their email address, birth date, parent’s name and email address, and in some cases full name, city, state and ZIP code as well, according to the complaint.
The child then received an on-screen notice that said “registration successful" and was able to edit his or her online profile, the complaint said.
Meanwhile, the site sent the child’s parent an email saying that it needed parental consent to complete the child’s registration. The complaint said the email falsely stated that if a parent did not want to approve the child’s registration, “you do not need to do anything else: simply do not click on the above link."
Regardless of the parent’s actions, the site had already registered the child, the complaint said.
From April 25, 2010 to Aug. 2, 2011, SelenaGomez.com registered 10,026 children for its fan newsletter and 2,196 children for its fan club. The site also collected and kept information on 48,531 children who started but did not finish the registration process, the complaint said.
As part of the settlement, Artist Arena agreed to delete the personal information about children under 13. The company also agreed that the sites, in places where they collect personal data, would prominently display links to a federal website, www.OnGuardOnline.gov, that offers information on protecting children’s privacy online.