The Privacy Lawyer: Kids' Online Privacy - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

01:40 PM

The Privacy Lawyer: Kids' Online Privacy

What you don't know about children's privacy regulations and your online information collection practices can hurt you, says Parry Aftab.

Every business has a Web site these days. And many of those companies and commercial entities have sites with chat rooms, discussion boards, instant-messaging capability, and forms or technology that collect registration and other information from site visitors. Sometimes, they direct parts of their sites at children, either to develop brand recognition or loyalty or to reach the children's market. Other times, children visit their sites without being targeted by the site.

There are two legal issues you must understand when children are involved online. One is privacy, the other is safety. (Marketing to children online is a third concern which will be discussed in future columns.) Both privacy and safety are regulated in the United States by the Federal Trade Commission, although states are permitted to enforce consistent local laws as well. In brief, privacy relates to the collection, maintenance, or use of personally identifiable information from children under the age of 13 (12-years-old and under). Safety is affected, legally, when a child under the age of 13 is able to share personally identifiable information with others online (such as in a chat, on discussion boards, or via E-mail or instant messaging). The safety concern is that someone such as a pedophile may be able to contact the child either online or offline because the child has shared such contact information, whether intentionally or not. If you keep these two concerns in mind, the regulations make sense. If you don't, you're in serious trouble when it comes to spotting instances when the law is implicated.

Most laws, and their application to a particular company or line of business, are clear-cut. But kids' privacy laws in the United States can be tricky. That's why you need to keep these concerns in mind. Companies that don't believe their sites would come under the regulations for protecting children online often find that they do. Hopefully, the companies find out before the FTC does.

A federal law, The Children's Online Privacy Protection Act (known as COPPA), applies to commercial Web sites, online services "targeted at children," and any online service operators with actual knowledge that they "collect" personal information from a child. (Actual knowledge can be as simple as a child sharing their grade or age in a monitored general audience chat room on your client's site, or can be supplied by an E-mail or phone call from concerned parents who object to the collection practices on behalf of their child.) Personal information includes such items as full name, home address, E-mail address, telephone number, Social Security number, or any other information that the FTC determines "permits the physical or online contacting of a specific individual." While the regulations are aimed principally at the children's Internet industry, they're fully effective against general-interest sites with actual knowledge that a child is using their services.

Broad Application
Unfortunately, many companies (and their legal counsel) are under the mistaken belief that COPPA only applies to those sites which directly and intentionally market to children. But they're mistaken. While there are rules that relate to how children are contacted and those relating to properly identifying promotional materials online, COPPA's main thrust is far broader. "Collection" as defined by COPPA includes allowing children to use any interactive communication tools, such as allowing the children to use chat, E-mail, fill out any forms, or post on a discussion board. While the site itself may not be collecting any information from the children, their ability to share that information online with anyone is considered "collection" by the site. Got an "E-mail us" link? That's enough to trigger the law. (Lawyers are famous for their small print and hiding substance in definition sections.)

The FTC adopted regulations under COPPA which require covered Web-site "operators" to:

  1. Provide notice on the Web site of what information is collected from children as well as how information is used and the Web-site operator's disclosure practices for such information (this applies to all information, not just "personal information");

  2. Obtain verifiable parental consent (which requires more than a mere E-mail consent from the parent) to collect, use, or disclose children's personal information before it is collected from the child, with certain exceptions and special rules for newsletters and internally used information;

  3. Upon request, provide parents with a description of the types of information collected from their child, or the actual information obtained from their child, and the opportunity to refuse to permit the further use, maintenance, or future collection of the child's personal information. Thus, in addition to having to obtain initial consent from the parents, if a parent withdraws consent at any time, the operator must remove that child's personal information from the system;

  4. Cease basing the child's participation in games, contests, or any other activity upon the disclosure of more information than is reasonably necessary to participate, including permitting parents to allow the site to collect personal information but refusing to let the site share the information with third parties; and

  5. Maintain reasonable procedures "to protect the confidentiality, security, and integrity of personal information collected from children."

If you run a Web site that's directed at children either in whole or in part, you need to find an attorney who knows the intricate details of the COPPA regulations.

Among those details are the comprehensive rules for the various types of notices required under the statute, which cover everything from the content of those rules to the look and placement of the link to the privacy policy displayed at the site, as well as the technical requirements for obtaining "verifiable" parental consent.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
1 of 2
Comment  | 
Print  | 
More Insights
The State of IT & Cybersecurity Operations 2020
The State of IT & Cybersecurity Operations 2020
Download this report from InformationWeek, in partnership with Dark Reading, to learn more about how today's IT operations teams work with cybersecurity operations, what technologies they are using, and how they communicate and share responsibility--or create risk by failing to do so. Get it now!
IT Careers: 10 Industries with Job Openings Right Now
Cynthia Harvey, Freelance Journalist, InformationWeek,  5/27/2020
How 5G Rollout May Benefit Businesses More than Consumers
Joao-Pierre S. Ruth, Senior Writer,  5/21/2020
IT Leadership in Education: Getting Online School Right
Jessica Davis, Senior Editor, Enterprise Apps,  5/20/2020
Register for InformationWeek Newsletters
Current Issue
Key to Cloud Success: The Right Management
This IT Trend highlights some of the steps IT teams can take to keep their cloud environments running in a safe, efficient manner.
White Papers
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll