COPPA says you must ask a user's age in a neutral way. Most websites make you enter your birthdate to check whether you're old enough to be using it. But what if you just simply ask the user's age? That seems to be just as neutral as asking their birthdate. Legally speaking, is that the same?
Assume that there are no unique sections of the site. Only 13+ users are legally allowed on any given part.
The Children's Online Privacy Protection Rule, 16 C.F.R. 312 (COPPR), which is a regulation issued by the Federal Trade Commission (FTC) under the Children's Online Privacy Protection Act, 15 U.S.C. 91 (COPPA), applies to:
... any operator of a Web site or online service directed to children [under 13: see §312.2], or any operator that has actual knowledge that it is collecting or maintaining personal information from a child ... [§312.3]
Many operators simply choose to block children to avoid these obligations. The purpose of age-screening is to ensure that your website is not directed to children and that you are not knowingly collecting personal information from children. Whether your website falls into this category will depend on all the facts and circumstances. Your question about a website operator's obligation to "ask a user's age in a neutral way" is reflected in the FTC publication Complying with COPPA: Frequently Asked Questions, which states:
If you choose to block children under 13 on your general audience site or service, you should take care to design your age screen in a manner that does not encourage children to falsify their ages to gain access to your site or service. Ask age information in a neutral manner at the point at which you invite visitors to provide personal information or to create a user ID.
In designing a neutral age-screening mechanism, you should consider:
Making sure the data entry point allows users to enter their age accurately. An example of a neutral age-screen would be a system that allows a user freely to enter month, day, and year of birth. A site that includes a drop-down menu that only permits users to enter birth years making them 13 or older, would not be considered a neutral age-screening mechanism since children cannot enter their correct ages on that site.
Avoiding encouraging children to falsify their age information, for example, by stating that visitors under 13 cannot participate or should ask their parents before participating. In addition, simply including a check box stating, “I am over 12 years old” would not be considered a neutral age-screening mechanism.
In addition, consistent with long standing Commission advice, FTC staff recommends using a cookie to prevent children from back-buttoning to enter a different age. Note that if you ask participants to enter age information, and then you fail either to screen out children under age 13 or to obtain their parents’ consent to collecting these children’s personal information, you may be liable for violating COPPA. See, e.g., the FTC’s COPPA cases against Path, Inc., Playdom, Inc. and Sony BMG Music Entertainment.
None of the three cases cited in the last paragraph deal directly with the situation you have asked about, but they contain useful factual examples of how the law is actually applied, as well as a detailed legal complaint filed by the FTC which precisely sets out the legal basis for the defendants' alleged violations.
For example, the FTC's case against Path, Inc. involved allegations that the operators of the Path social network had violated various federal laws, including COPPR. The case was settled on terms that Path admitted no wrongdoing but agreed to pay an $800,000 penalty. Count III of the FTC's complaint sets out the COPPR allegations. Basically, Path asked users for their date of birth but then failed to actually block users under 13 or obtain verifiable parental consent.
In Path, Inc., Playdom, Inc. and Sony BMG Music Entertainment, it was clear that the defendants had actual knowledge that they were collecting information from children. These were not cases involving operators who were found to be subject to COPPR because their age-screening mechanism was not robust enough. However, it is difficult to go wrong by following the advice of the federal regulator.
The FTC says that an example of a neutral age-screen is one that allows a user freely to enter month, day and year of birth, and that a screen which only allows users to specify an age of 13 or older is not neutral. Your question falls in between these two extremes. There is no rule which makes it absolutely mandatory to ask for a full date of birth. What matters is that your website is not directed to children and that you are not knowingly collecting information from children. Obviously, it's safer to err on the side of caution and take the approach recommended by the FTC. If you don't want to follow the FTC's advice, you should take other active steps to ensure that your website is not directed to children and that you are not collecting personal information from children.
