COPPA

The Children’s Online Privacy and Protection Act, (COPPA) effective April 2000, defines specific rules for website operators that collect personal information from children under 13 years of age.  Enforcement authority was provided to the FTC (Federal Trade Commission).  The act applies to commercial websites and online services that are either directed toward children under the age of 13, or general audience websites that have actual knowledge they are collecting personal information from children.  

The Rule does not require operators of general audience sites to investigate the ages of their site's visitors.  However, if a general audience website collects information that provides “actual knowledge” a visitor is under the age of 13, the provisions of the Rule apply.  Although the Rule doesn't define the term "actual knowledge", it indicates that a Web site operator is considered to have actual knowledge of a user's age if the site asks for - and receives - information from the user from which age can be determined. For example, actual knowledge of age exists when an operator learns a child's age by asking for date of birth on a Web site's registration page. FTC staff attorneys say Web sites asking indirect questions that may elicit age information may also be thought to have actual knowledge. For example, actual knowledge of age may be gleaned from the answers to "age identifying" questions like, "What grade are you in?" or "What type of school do you go to: (a) elementary; (b) middle; (c) high school; (d) college."

If your website is directed to children, or if you have a general audience website that collects personal information which age can be determined, compliance is required.  These means that before collecting personal information about a visitor under the age of 13, operators must obtain verifiable parental consent and otherwise comply with the requirements of the COPPA Rule.

Personal information about a child includes items such as full name, home address, email address, telephone number or any other information that would allow someone to identify or contact the child. The Act and Rule also cover other types of information -- for example, hobbies, interests and information collected through cookies or other types of tracking mechanisms -- when they are tied to individually identifiable information.

Websites operators must also have a stated privacy policy and a link to that policy in a spot that is easy to see.  This must be on the home page and any other area where information is collected. The policy must provide details about what kind of information is collected and how it is collected.  It must also clarify how that information will be used.   

A direct notice to parents must be provided, and parental consent needs to be acquired.  The method of consent acquisition depends upon the type of information being collected and how it will be used.

Parents must have the ability to review information collected about their child. 

Parents must have the ability to revoke permission at any time.

Additional information about COPPA can be found at the FTC website (click on link).