5

Since my site collects personal information, people under 13 years of age are not allowed because of the COPPA law (and the site is not directed towards children).

The most common ban appeals that these people make are:

  • The person claims they were joking when they said they were 12 in the chat and they're actually older than 13.
  • Some months pass after a 12 year old is banned, and they claim that they have now turned 13

Can I take someone's word for it that they are 13+, or do I need some sort of proof like an ID or birth certificate? Is it even okay to ask for such private documents?

Improve this question

1 Answer 1

Reset to default
2

The regulations are addressed to the "operator of a Web site or online service directed to children, or any operator that has actual knowledge that it is collecting or maintaining personal information from a child". If you have an enforced policy of banning those under 13, you gain "actual knowledge" of the status of the liar when yuo learn their age. The FTC addresses the lying child question in FAQ 14, saying

The Rule does not require operators to ask the age of visitors. However, an operator of a general audience site or service that chooses to screen its users for age in a neutral fashion may rely on the age information its users enter, even if that age information is not accurate. In some circumstances, this may mean that children are able to register on a site or service in violation of the operator’s Terms of Service. If, however, the operator later determines that a particular user is a child under age 13, COPPA’s notice and parental consent requirements will be triggered.

If a banned lying child claims to now be 13 but in fact is still not 13, the notice and consent requirements have been triggered and you can be (massively) punished. If the child is over 13, there will be no penalty, since you didn't violate the rule.

The rule does not include any standards for proving age, and you have to evaluate any such evidence at your own risk. Whatever proof you would require, that would (if it were reasonably related to proof of age) constitute personal information, and the regulations require you to "obtain verifiable parental consent prior to any collection, use, and/or disclosure of personal information from children". In other words, parental consent is necessary to get the information necessary (birth certificate for example) to establish that parental consent is not necessary. You are strictly liable for violating the rule if you actually know that a user is under 13, and you can't argue "But he showed me a birth certificate".

§312.5 gives details about what constitutes "verifiable parental consent". (c) Exceptions to prior parental consent says that you can obtain personal information for the purpose of obtaining parental consent (otherwise, you would never be able to ask for parental consent, since you can't ask "who are your parents"). (c)(6) allows "collecting a child's name and online contact information to... take precautions against liability", but that does not include e.g. collecting a child's birth certificate. In other words, the only apparently safe course of action in case you have obtained actual knowledge that a user is a child is to require parental consent.

Improve this answer
5
  • If all you learned was that the user was under 13, but you didn't learn their actual age, then for all you know, they might have been 12 years and 364 days, so by the next day, you could argue that you no longer have actual knowledge that they're under 13. That logic doesn't sound right, but I don't see how the law forbids it.
    – Nate Eldredge
    Aug 24, 2018 at 0:10
  • I guess the point is that "actual knowledge" is not the same as "provable certainty". But then what does "actual knowledge" mean?
    – Nate Eldredge
    Aug 24, 2018 at 0:13
  • From what I can tell, the courts have not weighed in on the matter, so we only have the FTC FAQ to go on, in order to guess how they will interpret such a case. However, "ability to imagine otherwise" does not sweep away actual knowledge.
    – user6726
    Aug 24, 2018 at 0:25
  • 1
    Isn't the quote language saying the opposite of what you're saying? "An operator ... may rely on the age information its users enter, even if that age information is not accurate." So if the child claims to be over 13, how can the operator be both entitled to rely on that information but also subject to massive punishment?
    – bdb484
    Aug 24, 2018 at 0:33
  • It's the later part, about when you gain actual knowledge and thus ban the child, that causes problems. There's no "un-know" provision in the law.
    – user6726
    Aug 24, 2018 at 1:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .