Not Just for Kids' Sites

The Children's Online Privacy Protection Rule seeks to put parents in control of what information commercial sites collect from their children online. The Rule, in effect since April 2000, was issued by the Federal Trade Commission (FTC), the nation's consumer protection agency, as a result of the Children's Online Privacy Protection Act (COPPA), passed by Congress in 1998.

The Rule applies to operators of commercial Web sites and online services directed to children under the age of 13 that collect personal information. It also applies to general audience Web sites and online services that have actual knowledge that they are collecting information from children under the age of 13. The Rule requires that these Web site operators post privacy policies, provide parental notice, and get verifiable consent from a parent or guardian before collecting personal information from children.

Although the Rule doesn't define the term "actual knowledge," it indicates that a Web site operator is considered to have actual knowledge of a user's age if the site asks for - and receives - information from the user from which age can be determined. For example, actual knowledge of age exists when an operator learns a child's age by asking for date of birth on a Web site's registration page. But FTC staff attorneys say Web sites asking indirect questions that may elicit age information may be thought to have actual knowledge, too. For example, actual knowledge of age may be gleaned from the answers to "age identifying" questions like, "What grade are you in?" or "What type of school do you go to: (a) elementary; (b) middle; (c) high school; (d) college."

The Rule does not require operators of general audience sites to investigate the ages of their site's visitors. However, asking for - or otherwise collecting - information that establishes that a visitor is under the age of 13 triggers the requirement that operators obtain verifiable parental consent before collecting personal information from that child and otherwise comply with the requirements of the COPPA Rule.

Is your Web site covered by the Rule? If it is directed to children and collects personal information from them, agency staff attorneys say the answer is yes, compliance is required. If you operate a general audience Web site or online service, and you have actual knowledge that you are collecting personal information from children under the age of 13, compliance is required, as well.

For general information about actual knowledge and how to comply with the COPPA Rule, visit www.ftc.gov/privacy/privacyinitiatives/childrens.html. For answers to particular questions, call the COPPA Compliance Hotline at 202-326-3140.

Your Opportunity to Comment

The National Small Business Ombudsman and 10 Regional Fairness Boards collect comments from small businesses about federal compliance and enforcement activities. Each year, the Ombudsman evaluates the conduct of these activities and rates each agency's responsiveness to small businesses. Small businesses can comment to the Ombudsman without fear of reprisal. To comment, call toll-free 1-888-REGFAIR (1-888-734-3247) or go to www.sba.gov/ombudsman.

For More Information

The FTC works for the consumer to prevent fraudulent, deceptive, and unfair business practices in the marketplace and to provide information to help consumers spot, stop, and avoid them. To file a complaint or to get free information on consumer issues, visit ftc.gov or call toll-free, 1-877-FTC-HELP (1-877-382-4357); TTY: 1-866-653-4261. The FTC enters consumer complaints into the Consumer Sentinel Network, a secure online database and investigative tool used by hundreds of civil and criminal law enforcement agencies in the U.S. and abroad.

February 2004