CONFIDENTIAL CARU SELF-ASSESSMENT FORM Site name(s ...

This confidential self-assessment form is being provided to the CARU staff for the sole purpose of this request that the site(s) listedbelow be accepted into the Children’s Online Privacy Protection Act (COPPA) Safe Harbor program. This document will not beshared or used with anyone outside the CARU staff for any other purpose without the written consent of the applicant.CONFIDENTIAL CARU SELF-ASSESSMENT FORMSite name(s), URL(s) covered by this request:Company Name:Contact Person:Contact phone and email:Please note: If you are seeking Safe Harbor status for multiple sites and information collectionpractices differ significantly at the sites, it is preferable to submit separate forms to facilitate thereview.1. Does your site have a privacy policy linked from its home page and at each area where youcollect personal information from a child under 13? If yes, please attach a copy of your privacypolicy for each site.__ Yes__ No2. Does the privacy policy: (check all that apply)__ Provide full name and online and offline contact information for the operator(s)__ Explain what personal information is collected__ How personal information is used__ With whom personal information is shared3. Does the site collect (please check all that apply):__ first name only__ screen name__ full name (first and last name)__ domain name__ e-mail address of child__ e-mail address of parent__ date of birth/age/grade in school__ full mailing address of parent or child__ phone number__ social security number__ city only__ city and state__ zip code__ credit card number__ name of school__ other, please specify ________________________________________1

This confidential self-assessment form is being provided to the CARU staff for the sole purpose of this request that the site(s) listedbelow be accepted into the Children’s Online Privacy Protection Act (COPPA) Safe Harbor program. This document will not beshared or used with anyone outside the CARU staff for any other purpose without the written consent of the applicant.21. If yes, are they marked as ads?__ Yes__ No22. Are the ads suitable for children?__ Yes__ NoProvide a few examples.23. If a user leaves the site to view an advertiser’s site, are bumper screens used?__ Yes__ NoSECURITY24. Is your server physically secure?__ Yes, please explain: ____________________________________________________ No25. Do you encrypt data during transmission?__ Yes, what kind of information is encrypted?__ Transactional__ Other (describe): ____________________________________________________________ No26. How do you protect data obtained online stored by you using (check all that apply)__ Firewalls__ Encryption__ Password-protected access__ Limits on number, level of employees with access__ Physical security means__ Other27 Do you (check all that apply)__ Designate an individual responsible for compliance with your privacy policy__ Disable employee access to data upon termination or, when appropriate, a change ofresponsibilities__ Investigate external or internal complaints about unauthorized access or use should youreceive any__ Offer periodic education, training, reminders to appropriate employees__ Conduct internal or third party audits__ Review, update, change privacy policies when you materially change data collection activities28. Are Non-Disclosure Agreements regarding personal information in place with contractors andthird parties?__ Yes__ No29, Is there any other pertinent information you would like to provide about the site(s) or your privacypolicy?4

This confidential self-assessment form is being provided to the CARU staff for the sole purpose of this request that the site(s) listedbelow be accepted into the Children’s Online Privacy Protection Act (COPPA) Safe Harbor program. This document will not beshared or used with anyone outside the CARU staff for any other purpose without the written consent of the applicant.ATTESTATIONIn submitting this application on behalf of ____________________________, I undertake that, ifaccepted into CARU’s Safe Harbor program, the Website (s) identified in this application will:Adhere fully to CARU’s Self-Regulatory Guidelines for Children’s Advertising and;Participate fully in resolving any disputes through the NAD/CARU/NARB Procedures. In the event ofa material breach, if internal due diligence and CARU’s inquiry reveal no satisfactory explanation ofhow the breach occurred, the applicant will at CARU’s request, and at its own expense, conduct athird-party security audit to resolve the matter;Submit to CARU on the anniversary of the date of acceptance into the CARU Safe Harbor program aSelf-Assessment Form based on current privacy practices on ______________________________’sWebsite(s); andIn the event of any material change to the privacy practices on __________________________________’s Website(s), submit to CARU for review a full description of such change.___________________________________Designated Safe Harbor Representative_________________________________Date:Printed Name and Title: ____________________________________________________5