How to Protect Kids' Privacy Online

Whether playing, shopping, studying or just surfing, today's kids are taking advantage of all that the web has to offer. But when it comes to their personal information online, who's in charge? In an effort to put parents in the catbird seat, the Federal Trade Commission has established new rules for website operators to make sure that kids' privacy is protected while they're online. These rules are part of the 1998 Children's Online Privacy Protection Act. Here's a look at what the law requires, starting April 21, 2000.

Website Operators Must:

1. Post their privacy policy: Websites directed to children or that knowingly collect information from kids under 13 must post a notice of their information collection practices that includes:
   • types of personal information they collect from kids-for example, name, home address, email address or hobbies.
   • how the site will use the information - for example, to market to the child who supplied the information, to notify contest winners or to make the information available through a child's participation in a chat room.
   • whether personal information is forwarded to advertisers or other third parties.
   • a contact at the site.
2. Get parental consent: In many cases, a site must obtain parental consent before collecting, using or disclosing personal information about a child. Consent is not required when a site is collecting an email address to:
   • respond to a one-time request from the child.
   • provide notice to the parent.
   • ensure the safety of the child or the site.
   • send a newsletter or other information on a regular basis as long as the site notifies a parent and gives them a chance to say no to the arrangement.
3. Get new consent when information-practices change in a "material" way: Website operators need to notify parents and get consent again if they plan to change the kinds of information they collect, change how they use the information or offer the information to new and different third parties. For example, new parental consent would be required if the website decides to:
   • send information from children to marketers of diet pills instead of only marketers of stuffed animals, as covered in the original consent.
   • give a child access to a chat room if the parent's original consent covered only sending a newsletter.
4. Allow parents to review personal information collected from their children: To do this, website operators must verify the identity of the requesting parent.
5. Allow parents to revoke their consent, and delete information collected from their children at the parents' request: Parents can revoke their consent and ask that information about their children be deleted from the site's database. When a parent revokes consent, the website must stop collecting, using or disclosing information from that child. The site may end a child's participation in an activity if the information it collected was necessary for participation in the website's activity.

Parents Should:

1. Look for a privacy policy on any website directed to children: The policy must be available through a link on the website's homepage and at each area where personal information is collected from kids. Websites for general audiences that have a children's section must post the notice on the homepages of the section for kids. Read the policy closely to learn the kinds of personal information being collected, how it will be used, and whether it will be passed on to third parties. If you find a website that doesn't post basic protections for children's personal information, ask for details about their information collection practices.
2. Decide whether to give consent: Giving consent authorizes the website to collect personal information from your child. You can give consent and still say no to having your child's information passed along to a third party. Your consent isn't necessary if the website is collecting your child's email address simply to respond to a one-time request for information.
3. Decide whether to approve information collection from your kids based on new uses for the information: Website operators will let you know about the need for new consent by sending you a new notice and request. They will do this when they are changing the terms-of-use of the information in a "material" or significant way.
4. Ask to see the information your child has submitted: The site will ask you to verify your identity to ensure that your child's information isn't given out improperly.
5. Understand that you may revoke your consent at any time and have your child's information deleted: To stop a website from collecting additional information from your child, you can revoke your consent. You also may ask a site to delete any personal information it has already collected from your child.

If you want more information about privacy online or if you suspect a violation of the Children's Online Privacy Protection Rule, contact the FTC's Consumer Response Center

Courtesy of the FTC

- Back to Top -