Recent developments in online privacy laws.

• Author: Scelsi, Chrissie N.
• Position: Special Issue: Technology & the Practice of Law

Have you ever wondered why you have to click a box certifying that you are over the age of 13 or enter your birth date as part of the registration process for a website? The reason that you have to click the box or enter that data is the result of the requirements of the Children's Online Privacy Protection Act (COPPA). This law protects minors under the age of 13 from having their personal information collected without the consent of their parents. COPPA requires that website operators that are collecting or disclosing data from minors to have mechanisms and policies in place to obtain verifiable parental consent in order to collect such data. In addition to the federal law, state laws are increasingly being passed to protect consumer data online, like the California Online Privacy Protection Act (CalOPPA), which can have far-reaching consequences for commercial website operators who do not comply, even here in Florida.

COPPA

The goal of Congress in enacting the COPPA rule was to allow parents to control what personal information is collected from their children when using websites and online services. (1) While there is a common misconception that the rule applies only to websites or services directed at children under 13, this law also applies to operators of websites or online services (including mobile applications), such as advertising networks that have actual knowledge their site or service is collecting personal information from the users of other websites or online services that are directed toward children. (2) However, the FTC has noted that the operators of general audience sites are not obligated to investigate the ages of the visitors to the site or service, though many general audience sites have opted to implement COPPA screening mechanisms as a precautionary measure or to block them altogether. (3)

The COPPA rule requires operators of websites or online services to take certain steps in order to be compliant, including:

* Posting a clear online privacy policy that describes the site/service's information practices for personal information collected from children;

* Providing notice to parents and obtaining verifiable parental consent before collection of personal information from children;

* Providing parents with the option of giving consent to the collection and use of the child's internal information by the operator, but prohibiting the operator from sharing that information with third parties;

* Providing parents with access to their child's information for review, as well as the option to have that information deleted;

* Providing parents with the ability to prevent further use or collection of a child's personal information;

* Maintaining the security, confidentiality, and integrity of the information that is collected from children, including taking reasonable steps to release that information only to parties who are capable of maintaining it with the same level of security and confidentiality;

* Retaining personal information that has been collected from children using the...