Complying with COPPA

[Kyttias]

"When it comes to the collection of personal information from children under 13, the Children’s Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission, the nation’s consumer protection agency, enforces the COPPA Rule, which spells out what operators of websites and online services must do to protect children’s privacy and safety online. For example, if your company is covered by COPPA, you need to have certain information in your privacy policy and get parental consent before collecting some types of information from kids under 13."

After reading through the following two articles:

A Six-Step Compliance Plan for Your Business
Complying with COPPA: Frequently Asked Questions

I would like to point out before anything else that section B, question 5 in the FAQ linked above clearly states that "COPPA expressly states that the law applies to commercial websites and online services and not to nonprofit entities". So don't immediately worry about the government breathing down your neck if you don't have a privacy policy in place on your fledgling website.

It's also worth noting in section B, question 7 of the FAQ that "Foreign-based websites and online services must comply with COPPA if they are directed to children in the United States, or if they knowingly collect personal information from children in the U.S.".

There are also exceptions as to when you don't need direct parental consent (found in a chart under the first link), which includes "To provide support for internal operations of your site or service" for "performing network communications". Basically meaning, you don't really need consent if all you're collecting is an IP Address and creating a Username.

The trouble comes in when you start collecting personal information such as a user's real name and email address. You must inform the child's parents or legal guardians, and possibly even jump through the hoop of gaining consent.

I'm personally eliminating the need to collect some information during user sign up. This is my blue print I will be using for my Privacy Policy (during registration). Parts of it will be replaced with form fields such as check boxes and text entry.

Want to join but are under 13?
Pull up a chair for your parent or ask to print this off and take it to them to read!

COPPA, or Children’s Online Privacy Protection Act, is a United States law first enacted in 1998, and it's most recent update went into effect in July 2013. After reading through guidelines on how best to comply with with COPPA, I'm here to inform you of what information is collected about your child and what is being done with it.

The best news is that this site is only collecting the bare minimum it needs to operate for basic log in functionality, security against users operating multiple accounts, and account recovery. These things are:

>>An IP Address. Never publically displayed and only stored internally, but nonetheless a persistent identifier that can be used to recognize a user over time and across different sites. It is collected passively through the browse and never asked for it. Having it is a necessary part of site operations.
>>An E-Mail address. This won't be displayed publicly and is used primarily for account recovery. In the future, promotional mail about the site itself may be sent to this address to advertise new site features, but these can be opted out of.
>>A screen name or user name that functions as online contact information. It is created upon sign up.

The latter is being used on the site to identify virtual pets in public display on your site as belonging to your child going under a chosen psuedonym as a screen name. These names are unique to each individual user and no two people can have the same screen name.

As the site's owner, I will be the sole operator with access to the former data - your child's current IP Address and an E-Mail address. I will personally respond to all inquiries from parents about my site or service’s practices.

However, COPPA also covers information given voluntary. While this is no mandatory obligation to ever present personal information, user profiles on this site provide text fields where users may provide a few short words about themselves. Fields specifically for contact information (of other sites and instant messengers) also exist. This information is not mandatory.

>>Even if my child should fill out voluntary information, I do NOT want anyone seeing it.

The site will never require a child to disclose more information than is reasonably necessary to participate in site activities. You may, at any time, ask to review information collected. If asked, I can delete information collected and you may refuse to allow any further collection or use of a child's information. Information will not ever be disclosed to third parties!

You can, at any time, ask for a child's account to be closed and it will be done to the best of my technical ability. Closed accounts may or may not be able to be reactivated at a later date such as they are over the age of 13.

In order to make you personally indentifiable as the parent or legal guardian of your child, I will ask that you make a custom security question below. If you opt not to create a security question, I cannot confirm that the account belongs to your child. This is necessary to prevent foul play among other users who may claim to be the child's parent in order to have their account closed as an act of cyber bullying! As such, please create a security question.

>>Security question?
>>Answer.

COPPA was designed to protect children of the United States. However, even if you are not a resident or citizen of the United States, I hope the above information provided you with peace of mind and knowledge that this site considers the safety of children very important.

>>I officially give my child consent to participate in this website,
>>Parent or Guardian E-Mail Address
>>Please e-mail me immediately, as I have further questions.

You may opt not to leave an e-mail address. If provided, it will never be given to any third parties or publically posted. I may use the e-mail provided in the future to contact you about changes to the above policy if deemed necessary by law.

You may revoke your consent to let your child participate in the site at any time. If the same email address is used you will not need to provide the answer to a security question or even remember the screen name created for your child. If your email address has changed you can always contact us if you still know the child's screen name and the answer to your security question.

>>Submit consent and continue with registration!