The Children’s Online Privacy Protection Act or COPPA was passed in 1998 and amended in 2012. “The primary goal of COPPA,” wrote the FTC in the FAQ, “is to place parents in control over what information is collected from their young children (under 13) online.” The provisions of the Act are intended to help parents keep their children from being exploited or defrauded online. COPPA requires commercial websites and online services to take a number of measures to protect children, including:
- Posting a clear and comprehensive policy describing how they use personal information collected online from children.
- Providing notice and obtaining parental consent before collecting personal information online from children.
- Allowing parents access to their children’s personal information to review or delete.
- Giving parents the opportunity to prevent further use or collection of children’s personal information.
- Maintaining the confidentiality, security and integrity of information they collect from children.
- Retaining personal information collected online from children for only as long as is necessary to fulfill the purpose for which it was collected.
The law, which covers commercial websites and mobile apps, prevents covered entities from obtaining and storing certain kinds of information from children under the age of thirteen. Identifying information includes name, phone number, photos, geolocation, screen names and any “persistent identifier” that can be used to identify a child over time.
While COPPA takes important steps toward protecting children’s information, it is not a comprehensive solution for protecting children’s privacy. COPPA applies to information rather than general online safety. While COPPA addresses sites and services geared toward children under the age of 13, most websites and apps do not independently verify the age of their users. If a child lies about his or her birth date to access a site, the site is not responsible for verifying the user’s actual age. In response to this issue, Facebook and Instagram recently announced that they plan to lock the accounts of underage users. However, the sites do not plan to seek out users who have violated their age requirement policies. Also, although COPPA regulates the use of children’s personal information, compliance with COPPA in no way means that the content of a particular site is safe or appropriate for young children. Children’s online privacy and safety is still, in many ways, up for grabs, or entirely in the hands of parents.