Who Must Comply?
The Federal Trade Commission is responsible for enforcing the Act. The FTC's compliance guide provides that you are covered by the law:
If you operate a commercial Web site or an online service directed to children under 13 that collects personal information from children or if you operate a general audience Web site and have actual knowledge that you are collecting personal information from children, you must comply with the Children's Online Privacy Protection Act.What Is Personal Information?
COPPA covers commercial websites which collect "personal information" from children. According to the FTC, "personal information" includes the following types of information:
- Full name
- Home address
- Email address
- Telephone number, or
- Any other information that would allow someone to identify or contact the child.
Fortunately, the "actual knowledge" language in the FTC's quote above creates a safe harbor for most general audience websites. You are not pulled within COPPA's requirements unless you have "actual knowledge" that information is being collected from someone under 13 years of age.
Compliance Requirements
What if you are required to comply with COPPA?
If you are required to comply with COPPA, then as the operator of the website you must post a link on the website to a COPPA notice at each area where you are collecting information from children and the link must be "clear and prominent."
The COPPA notice must include the following information:
- The name and contact information of all operators collecting or maintaining children's personal information
- The kinds of personal information collected from children and how the information is collected
- How the operator uses the personal information.
- Whether the operator discloses information collected from children to third parties.
- That the parent has the option to agree to the collection and use of the child's information without consenting to the disclosure of the information to third parties.
- That the operator may not require a child to disclose more information than is reasonably necessary to participate in an activity as a condition of participation.
- That the parent can review the child's personal information, ask to have it deleted and refuse to allow any further collection or use of the child's information.
- The notice also must state the procedures for the parent to follow.
No comments:
Post a Comment