The Children's Online Privacy Protection Act

* as published in the Montgomery Bar Association Sidebar, Summer 2000 edition

The advent of the World Wide Web has opened up vast avenues of information and exploration for our children and has a wide array of legitimate and exciting uses for both educational and recreational purposes. Research on just about any topic the teacher requires can be done on the Internet. Game rooms, chat rooms, online contests... all lure our children with promises of fun, excitement, and free stuff. But, short of a total ban on computer use, how do we monitor what shores our children are "surfing" to and what information is available to them? In a world where "identity theft" and "cyber stalking" have become household terms, how do we, as parents of young impressionable children, protect the privacy and safety of our children?

Congress has made an attempt to address these issues. After a three year study, the Children's Online Privacy Protection Act (COPPA) was signed into law on October 21, 1998. The final rule implementing the COPPA became effective April 21, 2000. The Rule, as published by the Federal Trade Commission in November, 1999, requires that commercial web sites that are "directed to, or knowingly collect information from, children under 13" must obtain "verifiable parental consent" before collecting, using or disclosing personal information from children. These sites are required to provide notice both on the site and directly to parents about their policies with respect to the collection, use, and disclosure of children's personal identifying information.

Don't breathe a sigh of relief just yet. COPPA does not prevent children's web sites from requiring personal information in order to participate in web site activities. What it does require is "verifiable parental consent" to the use of such personal information. The statute defines "verifiable parental consent" as "any reasonable effort (taking into consideration available technology)...to ensure that a parent...authorizes the collection, use, and disclosure" of their child's personal information.

The final rule temporarily allows a "sliding scale" approach to vary consent methods based on the intended use of the child's information. If personal information is to be disclosed to third parties or made publicly available through chatrooms or interactive activities (considered the highest risk categories to children's safety and privacy), parental consent must be verified by a "more reliable...