Children's Online Privacy Protection Act

In July 1998, the Children's Online Privacy Protection Act of 1998 (COPPA) was introduced by Senators Richard H. Bryan (R-NV) and John McCain (R-AZ). The act was proposed in response to a Federal Trade Commission (FTC) report that found that Web sites targeted at children were collecting personal information without any safeguards. The FTC was concerned that collection of personal information from children without parental consent would be an unfair and deceptive trade practice.

COPPA was passed within months of its introduction and took effect on April 21, 2000. COPPA requires that commercial Web site operators who have knowledge that they are dealing with a child aged 12 or under, or who aim their content at children, obtain verifiable parental consent before collecting any personal information from a child. A child's personal information may include his or her [Page 578]full name, home address, e-mail address, telephone number, and Social Security number. The act also covers information such as hobbies or interests when such information is tied to individually identifiable information.

The FTC considers several factors in order to determine whether a Web site is directed toward children. These factors include subject matter, visual or audio content, age of models on the site, language, advertisements, and whether the site uses animated characters or other child-oriented features. The FTC determines who qualifies as a Web site operator by considering who owns and controls the information, who pays for the collection and maintenance of the information, what the preexisting contractual relationships are in connection with the information, and what role the Web site plays in collecting or maintaining the information.

According to COPPA, the operator must make reasonable efforts to ensure that, before personal information is collected from a child, a parent of the child receives notice of the operator's information practices and consents to those practices. Operators may use e-mail to get parental consent for all internal uses of personal information. However, should operators want to disclose a child's personal information to third parties or make it publicly available, they must use a more reliable method of consent, such as obtaining a signed form from the parent via postal mail or facsimile, accepting and verifying a credit card number in connection with a transaction, taking calls from parents, or obtaining e-mail accompanied by a digital signature.

Additionally, COPPA requires that these Web sites place their information collection, use, and disclosure policies prominently on their Web site, both on their homepage and at each area where personal information is collected. The notice must be clearly written and must state the kinds of information being collected, the methods of collection, how the information is used, by whom the information is collected, and whether the information is disclosed to third parties. The law also states that parents be allowed to review and delete information about their children collected by the Web site. COPPA also forbids Web sites from conditioning a child's participation in online games, contests, or any other activity upon the disclosure of more information than is reasonably necessary to participate.

...