COPPA - The Children's Online Privacy Protection Act
A law created to protect the privacy of children under 13. The Act was passed by the U.S. Congress in 1998 and took effect in April 2000. COPPA is managed by the Federal Trade Commission (FTC).
The Act specifies:
- That sites must require parental consent for the collection or use of any personal information of young Web site users.
- When and how to seek verifiable consent from a parent or guardian.
- What responsibilities the operator of a Web site legally holds with regards to children's privacy and safety online, including restrictions on the types and methods of marketing targeting those under 13.
COPPA was passed to address the rapid growth of online marketing techniques in the 1990s that were targeting children. Various Web sites were collecting personal data from children without parental knowledge or consent. Research published by the Center for Media Education showed that children did not understand the potential negative outcomes of revealing personal information online. In the wake of media reports demonstrating the ease of gathering private data from children, the public pressured Congress to legislate.
Although COPPA does not specifically define how parental consent should be gained, the (FTC) has established guidelines to help Web site operators ensure compliance with the Act. These suggestions include:
- Clear display of downloadable consent forms that may be mailed or faxed to to the operator.
- Requiring that a parent use a credit card to authenticate age and identity.
- Requiring that a parent call a toll-free phone number.
- Accepting an email from a parent that includes a digital signature.
COPPA requires that site operators allow parents to review any information collected from their children. In practice, this means that any relevant site has to provide full access to all user records, profiles and log-in information when a parent requests it. The FTC has stipulated that parents may delete certain information but may not otherwise alter it.
Any Web site that collects information from children under the age of 13 has to abide by COPPA. The Act affects many popular sites like MySpace.com, Facebook.com, Friendster.com, Xanga.com and other social networking sites.
COPPA should not be confused with COPA, the Child Online Protection Act, which was relevant to the exposure of children to online pornography. COPA was ruled to be unconstitutional and was placed under injunction.
In order for the content to be compliant with COPPA, it must:
- Provide direct notice to parents and obtain verifiable parental consent before collecting personal information online from children.
- Give parents the choice of consenting to the collection of a child’s information, but prohibiting disclosure of the information to third parties
- Provide parents access to their child’s personal information to review and/or delete.
- Give parents the opportunity to discontinue use of a child’s personal information and prevent further online collection of information
- Maintain the confidentiality, security, and integrity of information collected from children
- Retain a child’s personal information for only as long as is necessary to fulfill the purpose for which it was collected, then delete the information using reasonable measures to protect against its unauthorized access or use
Another consideration is the security of private student information that is stored online. Protective wireless infrastructure provides a segmented student network that is separate from the one used by teachers and administrators, thereby avoiding data security conflicts and protecting student information.
The amended COPPA defines personal information to include:
- First and last name
- A home or other physical address including street name and name of a city or town
- Online contact information
- A screen or user name that functions as online contact information
- A telephone number
- A social security number
- A persistent identifier that can be used to recognize a user over time and across different web sites or online services
- A photograph, video, or audio file that contains a child’s image or voice
- Geolocation information sufficient to identify street name and name of a city or town