Many websites have a section for children under 13 years of age in their privacy policy, stating that they are not knowingly collecting information from such children and the collected information will be deleted upon request from their parents. I think this document may be relevant but I read it for a while and still couldn't get a clue about what really matters for children under 13 years of age. Any experts can help explain what issues must be addressed by site owners targeting customers who are children under 13 years of age?

Edit. It's a US website.

  • I take it this is in the US? Different countries are likely to have different rules. – David Thornley Oct 19 '18 at 16:13
  • @DavidThornley Yes it's a US website. I remember I have seen this before on other websites but probably those are also US websites. I should mention this in question. Thank you. – Cyker Oct 19 '18 at 17:11

The basic law (COPPA) says that as a website operator, you cannot collect personal information from anyone under 13 without verifiable parental consent. The regulations then tell you what a "parent" is, what "verifiable parental consent" is, what "personal information" is. The latter is defined as:

(A) a first and last name; (B) a home or other physical address including street name and name of a city or town; (C) an e-mail address; (D) a telephone number; (E) a Social Security number; (F) any other identifier that the Commission determines permits the physical or online contacting of a specific individual; or (G) information concerning the child or the parents of that child that the website collects online from the child and combines with an identifier described in this paragraph.

and the commission has determined that (F) includes

(7) A persistent identifier that can be used to recognize a user over time and across different Web sites or online services. Such persistent identifier includes, but is not limited to, a customer number held in a cookie, an Internet Protocol (IP) address, a processor or device serial number, or unique device identifier; (8) A photograph, video, or audio file where such file contains a child's image or voice; (9) Geolocation information sufficient to identify street name and name of a city or town

If you don't collect any such information, you don't have to worry. You do have to worry, though, if you think "collect" means what it ordinarily means. From the regulations (which is where the details of implementation are made clearer):

Collects or collection means the gathering of any personal information from a child by any means, including but not limited to:

Enabling a child to make personal information publicly available in identifiable form. An operator shall not be considered to have collected personal information under this paragraph if it takes reasonable measures to delete all or virtually all personal information from a child's postings before they are made public and also to delete such information from its records;

So if you have a read-only website without accounts, you may be able to avoid reading and complying, but you have to be careful if users can post stuff.

First you have to say what information you collect from children, and what you do with it. Section 312.4 says exactly what that means. Then you need parental consent before you collect such information (which includes their email address), and section 312.5 spells that out; then 312.6 lists the parental right to review their child's peron information. There are "reasonability" limits to what information you can collect (a short section, which doesn't say what would be reasonable).

  • Thank you for pointing out verifiable parental consent. Since someone mentions different countries may have different laws about this, I'm wondering which law applies if an Australian child is visiting a US website and vice versa? – Cyker Oct 19 '18 at 17:18
  • The US law doesn't care about the nationality of the child: via the definition of "operator" it makes the rules applicable to any interaction that involves the US. It is not clear how enforcement would proceed against a rogue Australian or Russian website, but the gov't. would basically sue the website operator in US court, and that might be the end of it, or they may be able to get the judgment enforced by the Australian or Russian courts. – user6726 Oct 19 '18 at 20:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.