The first step is that you need to determine if your company is a website or an online service that collects any personal information from kids under 13.

The Children’s Online Privacy Protection Act (“COPPA”) doesn’t apply to everyone operating a website or online service. COPPA applies to operators of websites and online services that collect personal information from kids under 13. Here’s a simple way to determine if COPPA applies to you.  You must comply with COPPA if:

  • Your website or online service is directed to children under 13 and you collect personal information from them.
  • Your website or online service is directed to children under 13 and you let others collect personal information from them.
  • Your website or online service is directed to a general audience, but you have actual knowledge that you collect personal information from children under 13.
  • Your company runs an ad network or plug-in, for example, and you have actual knowledge that you collect personal information from users of a website or service directed to children under 13.

The FTC looks at a variety of factors to see if a site or service is directed to children under 13, including:

  • the subject matter of the site or service,
  • visual and audio content,
  • the use of animated characters or other child-oriented activities and incentives, the age of models,
  • the presence of child celebrities or celebrities who appeal to kids,
  • ads on the site or service that are directed to children, and other reliable evidence about the age of the actual or intended audience.

If your website doesn’t target children as its primary audience, but is “directed to children under 13” based on those factors, you may choose to apply COPPA protections only to users under age 13. If that’s what you decide to do, you must not collect personal information from any users without first collecting age information. For users who say they are under age 13, don’t collect any personal information until you have obtained verifiable parental consent.

Each of these is considered personal information under COPPA:

  • child’s full name;
  • home or other physical address, including street name and city or town;
  • online contact information like an email address or other identifier that permits someone to contact a person directly — for example, an IM identifier, VoIP identifier, or video chat identifier;
  • screen name or user name where it functions as online contact information;
  • telephone number;
  • Social Security number;
  • a persistent identifier that can be used to recognize a user over time and across different sites, including a cookie number, an IP address, a processor or device serial number, or a unique device identifier;
  • a photo, video, or audio file containing a child’s image or voice;
  • geolocation information sufficient to identify a street name and city or town;
  • or other information about the child or parent that is collected from the child and is combined with one of these identifiers.

Under COPPA, you’re collecting information if you:

  • request, prompt, or encourage the submission of information, even if it’s optional;
  • let information be made publicly available (for example, with an open chat or posting function) unless you take reasonable measures to delete all or virtually all personal information before postings are public and delete all information from your records; or
  • passively track a child online.

If another company collects personal information through your child-directed site or service — through a plug-in for example — you are responsible for complying with COPPA. If you have actual knowledge that you’re collecting personal information directly from users of a child-directed site or service, you are responsible for complying with COPPA, too.

The next step, if you determine you fall under COPPA, is to post a privacy policy.  It must clearly and comprehensively describe how personal information collected online from kids under 13 is treated. The notice must describe not only your practices, but also the practices of any others collecting personal information on your site or service — for example, plug-ins or ad networks.

You must also include a link to your privacy policy on your homepage and anywhere you collect personal information from children.  If you operate a site or service directed to a general audience, but have a separate section for kids, post a link to your privacy policy on the homepage of the kids’ part of your site or service.

Make those links clear and prominent. Consider using a larger font or a different color type on a contrasting background. A fineprint link at the bottom of the page or a link that isn’t distinguishable from other links on your site won’t do the trick.

To comply with COPPA, your privacy policy should be clear and easy to read. Don’t add any unrelated or confusing information. Here’s what your policy must include:

  • A list of all operators collecting personal information;
  • Name each third party operator, such as an advertising network or social network plug-in, that collects or maintains children’s personal information through your site or service;
  • For each, include a name and contact information (address, telephone number, and email address).

Your policy must describe:

  • the types of personal information collected from children (for example, name, address, email address, hobbies, etc.);
  • how the personal information is collected — directly from the child or passively, say, through cookies;
  • how the personal information will be used (for example, for marketing to the child, notifying contest winners, or allowing the child to make information publicly available through a chat room); and
  • whether you disclose personal information collected from kids to third parties. If you do, your privacy policy must list the types of businesses you disclose information to (for example, ad networks) and how they use the information.

Your privacy policy must tell parents:

  • that you won’t require a child to disclose more information than is reasonably necessary to participate in an activity;
  • that they can review their child’s personal information, direct you to delete it, and refuse to allow any further collection or use of the child’s information;
  • that they can agree to the collection and use of their child’s information, but still not allow disclosure to third parties unless that’s part of the service (for example, social networking); and
  • the procedures to follow to exercise their rights.

Then you have to notify parents directly about your practices before collecting personal information from their kids. COPPA requires that you give parents “direct notice” of your information practices before collecting information from their kids. In addition, if you make a material change to the practices parents previously agreed to, you must send an updated direct notice.

The notice should be clear and easy to read. Don’t include any unrelated or confusing information. The notice must tell parents:

  • that you collected their online contact information for the purpose of getting their consent;
  • that you want to collect personal information from their child;
  • that their consent is required for the collection, use, and disclosure of the information;
  • the specific personal information you want to collect and how it might be disclosed to others;
  • a link to your online privacy policy;
  • how the parent can give their consent; and
  • that if the parent doesn’t consent within a reasonable time, you’ll delete the parent’s online contact information from your records.

In certain circumstances, it’s okay under COPPA to collect a narrow class of personal information without getting parental consent. But you may still have to give parents direct notice of your activities.

You must get the parent’s verifiable consent before collecting personal information from their kids. Before collecting, using or disclosing personal information from a child, you must get their parent’s verifiable consent.  So how do you do that? COPPA leaves it up to you, but it’s important to choose a method reasonably designed in light of available technology to ensure that the person giving the consent is the child’s parent. If you have actual knowledge that you’re collecting personal information from a site or service that is directed to children, you may get consent directly or through the child-directed site or service.

Acceptable methods include having the parent:

  • sign a consent form and send it back to you via fax, mail, or electronic scan; use a credit card, debit card, or other online payment system that provides notification of each separate transaction to the account holder;
  • call a toll-free number staffed by trained personnel;
  • connect to trained personnel via a video conference;
  • provide a copy of a form of government issued ID that you check against a database, as long as you delete the identification from your records when you finish the verification process;
  • answer a series of knowledge-based challenge questions that would be difficult for someone other than the parent to answer; or verify a picture of a driver’s license of other photo ID submitted by the parent and then comparing that photo to a second photo submitted by the parent, using facial recognition technology.

You must give parents the option of allowing the collection and use of their child’s personal information without agreeing to disclosing that information to third parties.  If you make changes to the collection, use, or disclosure practices the parent already agreed to, you must send the parent a new notice and get their consent.

It’s critical to remember that even if parents have agreed that you may collect information from their kids, parents have ongoing rights — and you have continuing obligations.

If a parent asks, you must:

  • give them a way to review the personal information collected from their child;
  • give them a way to revoke their consent and refuse the further use or collection of personal information from their child;
  • and delete their child’s personal information. Any time you’re communicating with a parent about personal information already collected from their child, take reasonable steps to ensure you’re dealing with the child’s parent.

At the same time, make sure the method you use to give parents access to information collected from their kids isn’t unduly burdensome on the parent. Under COPPA, it may be okay to terminate a service to a child if the parent revokes consent, but only if the information at issue is reasonably necessary for the child’s participation in that activity.

Your final step is to implement reasonable procedures to protect the security of Kids’ Personal Information. COPPA requires you to establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children. Some other steps  you can take include getting assurances they’ll live up to those responsibilities, holding on to personal information only as long as is reasonably necessary for the purpose for which it was collected, and securely disposing of it once you no longer have a legitimate reason for retaining it.

This may seem like a lot. That’s why we’re hear to help! Let us write your privacy policy and help ensure your company stays compliant with COPPA and avoid hefty fines and penalties.