Legal Definitions - Child Online Privacy Act

The Child Online Privacy Act is a United States federal law designed to protect the online privacy of children under the age of 13. It requires operators of commercial websites and online services that are directed at children under 13, or those who have actual knowledge that they are collecting personal information from children under 13, to take specific steps to safeguard their data.

Specifically, before collecting, using, or disclosing any personal information from a child under 13, the law mandates that the website or online service operator must:

• Provide clear notice to the child's parent about their information collection, use, and disclosure practices.
• Obtain verifiable parental consent for the collection, use, and/or disclosure of that personal information.

This means that websites and online services cannot simply ask a child for their name, email address, or other identifying details without first getting permission from a parent. The Federal Trade Commission (FTC) enforces this act, and violations are considered "unfair or deceptive practices," leading to significant fines that can range from thousands to millions of dollars, depending on the severity and scope of the violation.

Here are some examples of how the Child Online Privacy Act applies:

• Online Educational Platform: An interactive learning website offers engaging lessons for elementary school students. To track a student's progress and customize their learning path, the site asks for the student's first name and age during registration. If a student indicates they are under 13, the website pauses the registration. It then sends an email to a parent, explaining exactly what personal data will be collected, how it will be used (e.g., to personalize lessons), and requires the parent to click a confirmation link or provide a credit card number (as a verifiable consent method) before the child can fully access the personalized features and the site collects their name.

• Kids' Mobile Gaming App: A popular mobile game designed for young children allows players to create an account to save their game progress and compete on leaderboards. To create an account, the app prompts users to enter a username and an email address. If the app determines a user is under 13 (e.g., through an age gate), it must immediately stop the registration process. It then sends a notification to a parent's email address, detailing the information requested and explaining its purpose. The parent must then provide explicit, verifiable consent (e.g., by responding to the email or using a secure portal) before the child's email address or any other personal information is collected and the account is fully activated.

• Children's Art Contest Website: A website run by a children's book publisher hosts an online art contest for young readers. To submit an entry, the site asks for the child's first name, age, and a parent's email address. Before accepting the submission or collecting the child's name, the website sends an email to the provided parent's address. This email clearly outlines that the child's first name and artwork will be collected and potentially displayed on the website if they win. The parent must then actively confirm their consent, perhaps by clicking a unique link or entering a password, before the child's entry is officially submitted and their personal information is stored.