Ever since the Federal Trade Commission announced their amendments to the Children’s Online Privacy Protection Act (COPPA), the industry has been abuzz. The changes to COPPA resulted in some confusion, a few requests for more time to comply, a lot of media coverage, and in many cases, a significant amount of work to bring products into alignment. With all of that happening, it’s easy to lose sight of the fact that one of the main objectives of COPPA is simply to ensure that parents are in control of personal data that may be collected online from children under the age of 13. And for parents, it may be worth taking a look at what this is all about, and what COPPA does – and doesn’t do – to help protect your children.
What is COPPA all about?
COPPA actually went into effect in April 2000, but it was updated recently to take into account changes in online technology. The goal was and remains, to minimize the amount of personal information that websites and online services collect, use and disclose from children under the age of 13, and to ensure that parents authorize that before it happens.
Essentially, if a site or service doesn’t need certain personal data from a child in order to operate or provide a feature, the data can’t be collected. If data does need to be collected, the operator of the site or service needs to ask the child’s parent for permission first. There are some exceptions to that, but they are very limited, and the parent remains in charge.
The law is also very clear about the steps sites and services need to take to ensure that the person giving permission is the parent. In short, the more extensive the plan to use the data (for example, if the data might be posted publicly on a website), the higher the threshold is for ensuring that the person giving permission is the parent, and not the child.
What sort of information qualifies as personal?
The list is fairly comprehensive, and it includes anything that would allow us to identify the individual child. For example, a full name, email address, phone number, photo of the child or fine geolocation information would qualify, as would an IP address if it was used to track a child across the Internet to build a profile for marketing purposes.
Which sites and services must comply?
COPPA only applies to sites and online services that are directed to children or that are intended for a more general audience but that have sections specifically intended for children. So, if your child is on a site or online service that is meant for adults, with no area intended for children, the law doesn’t apply unless the operator of that site or service knows that a child is there.
What are the rights of parents under COPPA?
In addition to granting (or denying) permission for a child’s data to be collected, used or disclosed, parents also have the right to contact the operator of a site or service and ask to review what types of data the operator collects from children. Parents may also contact the operator of a site or online service and ask that their child’s personal data be deleted, and that no additional information be collected from their child. (Of course, it may be that doing so means that the child can no longer access certain features of the site, since data is only allowed to be collected when it’s needed.)
What doesn’t COPPA address?
COPPA is about data privacy and security, not physical safety or the appropriateness of the content. (While privacy is a subset of safety, it doesn’t cover it all.) COPPA is not going to keep your child safe on a site that isn’t meant for young users. So don’t allow your child to lie about their age to get onto a site that’s not meant for them. When we think about it, there are likely certain TV shows, movies and video games that you don’t allow your young child to access. Apply the same considerations to website and apps. They’re just entertainment or information on a different type of screen. And regardless of the screen, if the product isn’t meant for children, there’s likely a good reason why that’s the case.
Monitor your child’s media usage. Set rules about what content is and isn’t appropriate. Yes, there’s a lot to cover these days, but young children will appreciate the guidance and the boundaries, and you’ll be laying the foundation for good media habits as they get older. Also, take a look at the sites your children are on and the apps that they use. Be sure they’re intended for users your child’s age and that you’re comfortable with the content. And finally, have a conversation with your child about what information they should and shouldn’t share online, and then take some comfort in knowing that COPPA is supporting that too.