FTCChargesThatSecurityFlawsinRockYouGameSiteExposed32MillionEmailAddressesandPasswordsSettlementOrderRequiresCompanytoImplementComprehensiveDataSecurityProgramTheoperatorofasocialgamesitehasagreedtosettlechargesthat,whiletoutingitssecurityfeatures,itfailedtoprotecttheprivacyofitsusers,allowinghackerstoaccessthepersonalinformationof32millionusers.TheFederalTradeCommissionalsoallegedinitscomplaintagainstRockYouthatHYPERLINK"http://ftc.gov/os/caselist/1023120/120327rockyoucmpt.pdf"RockYouviolatedtheChildren'sOnlinePrivacyProtectionActRule(COPPARule)incollectinginformationfromapproximately179,000children.TheHYPERLINK"http://ftc.gov/os/caselist/1023120/120327rockyouorder.pdf"proposedFTCsettlementorderwiththecompanybarsfuturedeceptiveclaimsbythecompanyregardingprivacyanddatasecurity,requiresittoimplementandmaintainadatasecurityprogram,barsfutureviolationsoftheCOPPARule,andrequiresittopaya$250,000civilpenaltytosettletheCOPPAcharges.ThecaseagainstRockYouispartoftheHYPERLINK"http://ftc.gov/opa/reporter/privacy/privacypromises.shtml"FTC'songoingefforttomakesurecompaniesliveuptotheprivacypromisestheymaketoconsumers,andthatHYPERLINK"http://ftc.gov/opa/reporter/privacy/coppa.shtml"kids'informationisn'tcollectedorsharedonlinewithouttheirparents'consent.AccordingtotheFTCcomplaint,RockYouoperatedawebsitethatallowedconsumerstoplaygamesanduseotherapplications.Manyconsumersusedthesitetoassembleslideshowsfromtheirphotos,usingacaptioncapabilityandmusicsuppliedbythesite.Tosavetheirslideshows,consumershadtoentertheiremailaddressandemailpassword.TheFTC'sCOPPARulerequiresthatwebsiteoperatorsnotifyparentsandobtaintheirconsentbeforetheycollect,use,ordisclosepersonalinformationfromchildrenunder13.TheRulealsorequiresthatwebsiteoperatorspostaprivacypolicythatisclear,understandable,andcomplete.TheFTCallegedthatRockYouknowinglycollectedapproximately179,000children'semailaddressesandassociatedpasswordsduringregistration–withouttheirparents'consent–andenabledchildrentocreatepersonal