How the Children's Online Privacy Protection Act
Can Protect Your Kids

Whether chatting online, conducting research for homework assignments, or just surfing, today’s kids are taking advantage of all the Internet has to offer. As a result, Internet companies want as much information as possible about young consumers. In order to protect the privacy of children who surf the Internet, the Federal Trade Commission has established rules for Web site operators. These rules are part of the 1998 Children’s Online Privacy Protection Act (COPPA). The following is a summary of what the law requires:

Web Site Operators Must:

• Post their privacy policy. Any Web site that is directed to children or that knowingly collects information from kids under 13 years of age must post a notice of their information collection practices that includes:

• The nature of the personal information they collect from a child, such as a child’s name, home address, e-mail address, or hobbies.
• How the site will use the child’s personal information. For example, Internet companies must indicate if they plan to solicit the child with products or services, to notify contest winners, or to make the information available through a child’s participation in a chat room.
• Whether personal information is forwarded to advertisers or third parties.
• A representative at the Web site to contact for more information regarding their privacy policy.

• Get parental consent. In many cases, a site must obtain parental
  consent before collecting, using, or disclosing personal information
  about a child. However, parental consent is not required when a site is
  collecting an e-mail address to:

• Respond to a one-time request from the child.
• Provide notice to the parent of how his or her child is conducting himself or herself online.
• Ensure the safety of the child or of the site.
• Send a newsletter or other information to a child on a regular basis as long as the site notifies a parent and gives them a chance to reject the arrangement.

• Obtain new parental consent when information practices change
  in a "material" way. Web site operators need to notify parents and get consent again if they plan to change the kinds of information they collect, change how they use the information, or offer the information to new and different third parties. For example, new consent would be required if:

• The Web site sends information from children to marketers of diet pills instead of only marketers of stuffed animals, as covered in the original consent.
• The Web site operator gave a child access to a chat room when the parent’s original consent covered only the sending of an electronic newsletter.

• Allow parents to review the personal information collected online from their children.
• Allow parents to revoke their consent and delete collected information from their child upon request. When a parent revokes consent, the Web site must stop collecting, using, or disclosing information about that child immediately.