This post is a quick note for those of you who serve children online as audience members of your websites, either intentionally or unintentionally. The FTC announced an extension of the public comment period for COPPA Rule Review until July 12, 2010. If you are familiar with COPPA you may want to take this short window to comment; if you aren’t, and include minors under 13 in your online communities you may want to take the time to familiarize yourself with COPPA.
For those that don't know COPPA, it is the Children's Online Privacy Protection Act of 1998, a US federal law.
According to the FTC web site:
Congress enacted the Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501-6508, in 1998. COPPA contains a requirement that the Federal Trade Commission (FTC or Commission) issue and enforce a rule concerning children’s online privacy, which the Commission did in 1999. The Children’s Online Privacy Protection Rule, 16 C.F.R. Part 312, became effective on April 21, 2000.
Under the act “operators covered by the Rule must:
- Provide direct notice to parents and obtain verifiable parental consent, with limited exceptions, before collecting personal information from children;
- Give parents the choice of consenting to the operator’s collection and internal use of a child’s information, but prohibiting the operator from disclosing that information to third parties;
- Provide parents access to their child’s personal information to review and/or have the information deleted;
- Give parents the opportunity to prevent further use or online collection of a child’s personal information;
- Maintain the confidentiality, security, and integrity of information they collect from children.
In addition, the Rule prohibits operators from conditioning a child’s participation in an online activity on the child’s providing more information than is reasonably necessary to participate in that activity.
Though we've touched on COPPA in the field when we've worked on assessments and governance formation within the higher education sector, I've not had much direct field experience with COPPA. Here are some articles online that helped me understand it, its implementation and limitations:
Read the Rule and compliance materials, at www.ftc.gov/privacy/privacyinitiatives/childrens.html.
How the COPPA, as Implemented, Is Misinterpreted by the Public: A Research Perspective
Statement to the United States Senate, Subcommittee on Consumer Protection, Product Safety, and Insurance of the Committee on Commerce, Science, and Transportation by danah boyd, Urs Gasser, and John Palfrey
COPA vs. COPPA and the U.S. Supreme Court (January 29th, 2009) by Steven Leung. Leung quotes n FTC press release that says that “there is potential for age falsification on general audience websites, as well as liability under COPPA, should these sites obtain actual knowledge that they are collecting, using, or disclosing personal information from children online.”
As a parent with 3 boys 13 or under this was an interesting topic.
As a risk management perspective I recommend that you consider whether you have any exposure to children that age group using your online properties. If you do, you'll want to plan on how you can reduce your risk in regard to COPPA.Related articles by Zemanta