The operator of fan Web sites for pop stars Justin Bieber, Selena Gomez, Rihanna and Demi Lovato agreed to pay a $1 million civil penalty to settle federal charges that the sites had illegally collected personal information about thousands of children, the Federal Trade Commission said Wednesday.
In a complaint, the Federal Trade Commission alleged that Artist Arena, the operator of the sites, had violated a children's online privacy rule by collecting personal details -- like the names, e-mail addresses, street addresses and cellphone numbers -- of about 101,000 children aged 12 or younger without their parents' permission.
The law, called the Children's Online Privacy Protection Act, or COPPA for short, requires operators of Web sites to notify parents and obtain verifiable parental consent before collecting, using or disclosing personal information about children younger than 13.
The sites are BieberFever.com, SelenaGomez.com, RihannaNow.com and DemiLovatoFanClub.net. The agency did not accuse the pop stars themselves of any wrongdoing.
At a conference on children's marketing in New York on Wednesday, Edith Ramirez, a member of the F.T.C., said the settlement still needs to be ratified in court.
As part of the registration process, the four fan sites asked users to submit personal details including their birth dates that would enable members to create online profiles, post messages on members' walls and sign up for newsletters about the pop stars, the complaint said. Because the sites therefore knew the children's ages, the F.T.C. charged that the company had knowingly collected information and failed to properly notify their parents.
"These were fan sites that knew that a very substantial percentage of users were 12 or under," said David C. Vladeck, the director of the F.T.C.'s bureau of consumer protection. "There is really no excuse for violations like these."
Artist Arena, a company in Manhattan that manages fan clubs for solo artists and bands, neither admitted nor denied the agency's allegations. Executives at the company did not immediately return e-mail seeking comment.
The deal comes at a time when the agency is preparing to extensively strengthen the children's online privacy protection rule for the first time since its introduction more than a decade ago.
In an effort to keep pace with innovations like mobile apps and facial recognition technology, the agency has proposed to widen both the kinds of data about children that would require parental consent and the kinds of operators -- like advertising networks or analytics companies -- whose data-collection activities could be subject to the rule.
Last week, major corporations like Apple, Facebook, Google, Microsoft, and Viacom pushed back, submitting public comments to the F.T.C. in which they argued that some of the proposed changes were so unworkable that they could deter companies from providing sites and online services to children.
"To ensure that the Internet continues to be a robust and enriching place for children, the Commission should avoid promulgating rules that frustrate operators' ability to continue providing the same quantity and quality of sites and online services, including those that are directed to children," Michael D. Hintze, Microsoft's chief privacy counsel, wrote in comments to the agency.
But the case of the pop star Web sites bolsters the viability of at least one of the F.T.C.'s proposals: that child-friendly sites aimed at mixed audiences of varying ages screen users for age in order to determine those children for whom data collection requires prior parental consent.
Some companies, like Viacom, have objected to this proposed change, saying that such a screening process might cause some sites to block children from participating or deter some children who might end up on inappropriate grown-up sites that do not screen users for age.
But BieberFever.com and the other fan sites, even if they failed to properly notify parents, seemed to be able to collect information on tens of thousands of children who willingly identified themselves as being younger than 13.
"Marketers need to know that even a bad case of Bieber Fever doesn't excuse their legal obligation to get parental consent before collecting personal information from children," Jon Leibowitz, the chairman of the F.T.C., said in a statement. "The F.T.C. is in the process of updating the COPPA rule to ensure it continues to protect kids growing up in the digital age."
Each of the fan Web sites had slightly different registration processes. But the agency charged that Artist Arena had falsely claimed that it would not activate a child's registration without parental consent.
SelenaGomez.com, for example, required users who wanted to sign up for the online fan newsletter to enter information like their e-mail address, birth date, parent's name and e-mail address, and in some cases full name, city, state and ZIP code as well, according to the complaint.
The child then received an on-screen notice that said "registration successful" and was able to edit his or her online profile, the complaint said.
Meanwhile, the site sent the child's parent an e-mail saying that it needed parental consent to complete the child's registration, the complaint said, falsely stating that if a parent did not want to approve the child's registration, "you do not need to do anything else: simply do not click on the above link."
Regardless of the parent's actions, the site had already registered the child, the complaint said.
Between April 25, 2010, and Aug. 2, 2011, SelenaGomez.com registered 10,026 children for its fan newsletter and 2,196 children for its fan club. The site also collected and kept information on 48,531 children who started but did not finish the registration process, the complaint said.
As part of the settlement, Artist Arena agreed to delete the personal information about children under 13. The company also agreed that the sites, in places where they collect personal data, would prominently display links to a federal Web site, www.OnGuardOnline.gov, that offers information on protecting children's privacy online.
This article originally appeared in The New York Times.