Summary

  • In 1998 the FTC alleged that GeoCities’ privacy statements promised more limited uses of member information than the company’s disclosures to advertisers and other third parties.
  • The final 1999 consent order tied the site’s statements to operational duties: explain collectors and recipients, obtain parental consent for children’s information, offer access and deletion, and press third parties to remove records.

One club, two data handlers

To join the GeoKidz Club, a child first had to become a GeoCities member. The club form requested a name, age, email address, GeoCities home-page address and gender. On the screen, it sat inside the Enchanted Forest, a children’s neighborhood on GeoCities. The FTC alleged that volunteer Community Leaders ran the club and contests and collected and maintained the information.

The separation was easy to miss. The user saw one site, one neighborhood and one brand. Behind the form, a second operator could hold the record. A page that looked like a single community had become a chain of custody.

GeoCities had built a large version of that arrangement. The FTC’s August 1998 draft complaint described more than 1.8 million members across 40 themed neighborhoods. It counted about 50,000 members under 13 as of 18 May 1998. The member application requested identifying details, marked education, income, marital status, occupation and interests as optional, and offered topic-based advertising mail. The default was to receive special offers unless members changed it.

The form openly offered a commercial exchange: members could choose mail from advertisers and particular companies. The FTC’s complaint centered on what happened beyond that choice. It alleged that GeoCities’ privacy statements said application information would be used to provide the specific offers and products members requested, and that optional information would not be shared without permission. The agency alleged that GeoCities sold, rented or otherwise disclosed personal information to third parties for other uses, including targeting members with unsolicited advertising based on their chosen neighborhoods.

The complaint also challenged how GeoCities presented the children’s club and contests. The pages promoted them as Enchanted Forest activities. The FTC alleged that users could understand GeoCities to be the collector and keeper, while Community Leaders actually collected and maintained the children’s information. That joined two questions a friendly community page could blur: who sponsored the activity, and who took responsibility for its records.

A settlement with a public comment window

On 13 August 1998 the FTC announced that GeoCities had agreed to settle the charges. The proposed consent agreement went out for 60 days of public comment. GeoCities admitted jurisdictional facts and agreed to the process; the document expressly said the settlement did not admit that the legal violations or the complaint’s other factual allegations were true. This was a negotiated order, not a trial verdict.

The Commission issued its Decision and Order on 5 February 1999. On 12 February the FTC announced that the order had become final after comments, with a 4–0 vote. The final text added a provision permitting collection or use of children’s information to the extent allowed by the Children’s Online Privacy Protection Act of 1998.

The order treated privacy as an operating surface rather than a paragraph at the bottom of a page. GeoCities had to place clear, prominent notice on its home page and where information was collected. The notice had to say what the site collected, what it would do with it, who would receive it, how a person could inspect or access it, how to request removal, and what deletion limits applied. A prescribed route connected the home-page privacy notice to each collection point.

For children aged 12 and under, GeoCities had to maintain a process for express parental consent before collecting and using personal information. A narrow screening step could identify a child and reach a parent. If consent did not arrive within 20 days, the company had to remove the child’s information except for the limited record needed to block another unapproved registration.

Previously collected information had its own deadlines. The order set notice and removal options for adults over 12 whose information had been disclosed to CMG Information Services, and a separate parental process for children’s information collected before 20 May 1998. If a parent did not expressly consent to continued retention and disclosure within 20 days, GeoCities had to stop using the information and remove it within 10 days, including a child’s home page and email account. It also had to contact third parties and request that they stop further disclosure and delete their copies.

That requirement followed the records beyond GeoCities’ own servers. The company had to obtain written commitments from third parties and Community Leaders. Under the order’s conditions, it had to stop doing business with a noncompliant third party or end a Community Leader’s status. The operator who lent out a form could not send users to a volunteer when the records needed to be found.

The FTC records state what GeoCities had to request; they do not trace whether each recipient later erased its copy, which recipient compliance records would establish.

Deletion still had a defined edge. The order allowed limited retention in an off-site backup for system maintenance, computer backup, blocking an unapproved child registration, or legal process. GeoCities had to describe the retention, and it could not disclose those backup records except for law-enforcement or judicial requests. The public promise needed a usable deletion path, including an honest description of what that path could not reach immediately.

The promise acquired a checklist

The FTC called the matter its first Internet privacy case. Its historical force sits in the machinery of the order: a statement about information became a list of checks against forms, advertisers, community leaders and removal requests. What was collected? For which purpose? Who received it? Could a member inspect it? Could the platform reach the copies it had sent elsewhere?

Commissioner Orson Swindle put a boundary around the remedy. He voted for the final order in this case and said his vote did not mean he supported imposing the same requirements on other commercial Internet sites through legislation or regulation. The FTC had bound one respondent through a consent order, while leaving the broader policy argument open.

GeoCities still had to answer for the system users met under its name. The browser page was the front door; the order followed the records into the rooms behind it. A platform that recruited members, hosted the activity and supplied the brand had to identify the other hands on the data—and make its downstream handlers answer its call.

Sources