The Children’s Online Privacy Protection Act (COPPA) is the key privacy regulation that protects children from having information about them collected by web site owners. In effect since April 2000, COPPA prohibits a web site owner or operator from “knowingly collecting information from children under the age of 13 unless the operator obtains parental consent and allows parents to review their children’s information and restrict its further use.”
Below are some basic facts about COPPA:
• What exactly does COPPA say? For the full regulatory language, go to http://www.cdt.org/legislation/105th/privacy/coppa.html.
• Who enforces COPPA? The Federal Trade Commission and state attorneys general.
• Is this the child online protection law? No. That’s called the Child Online Protection Act (COPA), which prohibited online distribution of content that is “harmful” to minors (and was struck down as unconstitutional by the courts).
• Is COPPA constitutional? It hasn’t been tested, but experts say it’s likely to be upheld in court.
• Who must comply? Every operator of a commercial web site. The law makes it a crime to collect information knowingly in ways that fail to meet COPPA’s guidelines.
• What does “knowingly” mean under the law? According to the FTC, the term means that web site operators cannot claim they did not know an address they collected was a child’s, simply because they did not ask for the child’s age. The site operator must make some proactive effort and exercise some judgment to ascertain its users’ ages.
• What information cannot be collected? Name, eMail address, phone number, and other information that makes it possible to identify children as individuals. Collection of aggregate data, such as the number of site visits by all users, is allowed.
• Will COPPA result in the demise of youth-oriented chat rooms and other useful resources? No, but if the site wants to collect data to help guide children’s chats, it must comply with COPPA. This means obtaining parental consent; letting parents review the information their children submitted; letting parents restrict the use of that information; and prominently posting a privacy statement and its policy on collecting and using information.
• What form of parental consent is acceptable? The law says consent must be “verifiable.” Ironically, this means that some type of paper transaction is probably necessary. For example, parents can fill out and sign a form found on the web site, and then mail or fax that form to the site operator. Online consent can be considered verifiable, but only if additional steps are taken to assure the legitimacy of the consent.
• What types of sites fall under the definition of “commercial use”? This can get confusing, FTC admits. A public school’s web site and online discussion forums are not commercial, but a for-profit school’s sites are. The safest route is to comply with COPPA regardless.
• Can schools help sites obtain consent? Yes. The parental consent form for internet access that many parents sign at the beginning of the year is considered adequate under COPPA for school-approved sites and online activities.